In this recording we answer the question "Can I use Tetragon without Cilium CNI?"This tutorial will cover how to install and configure Tetragon in Kubernetes with another CNI. In this example we use the open-source Calico project. Futher information and a text based guide can be found at this supporting blog post. Can I Use Tetragon Without Cilium? The short answer is yes, absolutely. In this walkthrough I’m showing Tetragon running in a Kubernetes environment where the networking stack is not Cilium. Tetragon is able to collect security events and runtime activity because it works at the eBPF and kernel level. It does not require Cilium to be present in order to observe process execution, file activity, or network events. First I deploy the demo application. If you’ve used our hands-on labs before, the application will probably look familiar. We’ve got the Death Star service, along with the X-Wing and TIE Fighter pods. Once everything is running, I install the Tetra CLI, which is the command-line tool we use to consume and format the events coming out of Tetragon. In one terminal I start tailing the Tetragon logs and pipe them through the Tetra CLI so I can watch live events. In another terminal I exec into the X-Wing pod and run a few simple commands like sh, whoami, ls, and cat. Immediately, Tetragon captures those process events. We can see the execution of the commands, their arguments, their exits, and the surrounding Kubernetes metadata. If I switch to JSON output, I can see even richer data. That includes things like pod name, container image information, labels, node identity, process details, and other metadata that helps us understand exactly what happened and where. Next I apply one of the example tracing policies so I can observe TCP-level activity. The policy hooks into kernel events like tcp_connect, tcp_sendmsg, and tcp_close. Then I exec back into the pod and run a curl command. In the Tetragon output, I can now see the DNS resolution, the connection, the bytes sent, and the connection teardown. That gives me network-level visibility even though I am not using Cilium. After that, I enable additional options so Tetragon also captures Linux capabilities and namespaces. I restart the Tetragon DaemonSet, deploy a privileged pod, and observe the resulting process execution. Now I can see kernel capability information like CAP_SYS_ADMIN alongside the normal process events. That gives us much deeper insight into what workloads are allowed to do in the environment. Then I enable pod and namespace-level policy filtering. This lets me apply a tracing policy only to a specific namespace. I create a namespace-scoped tracing policy that watches reads and writes to files like /etc/passwd and /etc/shadow. When I exec into the X-Wing pod and attempt to write to those files, Tetragon captures the file activity exactly as expected. Finally, I show a namespace policy with a pod selector and a SIGKILL action. The policy watches for write activity in the /tmp directory, but only for pods that carry a specific label. I label one pod to match the selector, create a file in /tmp, and then try to edit it. Tetragon kills the process immediately, so the write does not complete. When I repeat the same action in a pod that does not match the selector, the write succeeds. That demonstrates both selective enforcement and runtime response. So we started with a simple question: can we use Tetragon without Cilium? The answer is completely yes. And what you’ve probably noticed is that I barely had to talk about the underlying CNI at all, because Tetragon is using eBPF at the kernel level to provide process visibility, file monitoring, network observability, and enforcement regardless of the networking plugin. If you want to take the next step, I’d recommend going through the hands-on labs. We have Tetragon-focused labs that let you explore these capabilities in more detail, including attack simulation, runtime security visibility, and enterprise integrations. That was a quick overview, but hopefully it shows how powerful Tetragon can be even without Cilium.