Runtime policy in Kubernetes YAML

Policy as a first-class Kubernetes resource

TracingPolicy is a standard CRD. Write it as YAML, check it into git, apply it with kubectl. Nightshift reconciles the resource into Tetragon, which enforces the policy inline in the kernel via kprobes. A single policy can match by pod, namespace, or workload identity, and the same surface covers syscall tracing, process lifecycle, file access, and network events — so your audit log and your enforcement rules live in the same place.