LoginSign Up
← Back to all sparks
I

Inspektor Gadget

INFRA · APIS
Velocity2.5

eBPF-based tool collection for debugging and observing Kubernetes workloads

www.inspektor-gadget.io ↗

Inspektor Gadget v0.58 adds SELinux and rename tracing and fixes stale OTel series

ebpfkubernetesopentelemetryleast-privilegesecurity-tracing
◆Current state
Inspektor Gadget v0.58.0 adds trace_selinux for SELinux AVC decisions and trace_rename for file renames, an opt-in OpenTelemetry snapshot mode that drops series for processes that no longer exist, and IPv6 support in trace_sni. The profiler fork was rebased onto upstream, and trace_fsslower's output format changed in a breaking way. v0.57.0 had already let gadgets run rootless with narrow capabilities.
◆Where it's heading
The project is pairing two tracks: reducing the privileges and trust an eBPF tool needs (rootless runs, multi-tenancy, hardened parsing) and making its output fit standard observability pipelines (OTel metrics and profiles). New gadgets keep widening security-relevant coverage.
◆Prediction
Expect further OpenTelemetry alignment and more security-focused gadgets; the experimental multi-tenancy from v0.56 has not yet shown a path to stable in the entries.

◆Recent moves

  1. 2d ago

    v0.58.0: SELinux and rename tracing, OTel snapshot mode

    Two new gadgets extend security coverage to SELinux denials and file renames, and an OTel snapshot mode removes stale series for dead processes. It continues the move toward clean output in standard observability pipelines, at the cost of a breaking format change in trace_fsslower.

    View source ↗
  2. 1mo ago

    v0.57.0: rootless ig run and reduced-privilege deploys

    Gadgets can now run rootless with only cap_bpf, cap_perfmon and cap_sys_ptrace, and a new flag drops CAP_SYS_ADMIN on Kubernetes deployments. That is a real cut in the privileges an eBPF tool asks for.

    View source ↗
  3. 1mo ago

    v0.56.2: bounded owner reference enrichment

    A single backported fix that bounds the owner reference enrichment loop in the container collection.

    View source ↗
  4. 1mo ago

    v0.56.1 hardens USDT parsing against crafted binaries

    Backports USDT parsing fixes so a crafted binary cannot crash the process or exhaust memory, the second such hardening after v0.55.1. It also picks up gRPC and OpenTelemetry security updates.

    View source ↗
  5. 2mo ago

    Release v0.56.0

    ⚡ SPARK

    v0.56 introduces Kubernetes multi-tenancy as an experimental opt-in: every kubectl-gadget request is now authenticated via TokenReview and scoped to namespaces the user is authorized to access by RBAC. This removes the cluster-admin requirement that has blocked Inspektor Gadget deployment in shared Kubernetes environments. Combined with rootless ig image commands and stripped Go binary uprobe support (attaches to production kubelets without full symbol tables), v0.56 is the most enterprise-readiness-focused release yet.

    View source ↗
  6. 2mo ago

    Release v0.55.1

    v0.55.1 patches a security issue where crafted ELF binaries from untrusted containers could exhaust memory or CPU in the privileged uprobe process — bounded stream parsing now caps the risk. A meaningful hardening fix given that Inspektor Gadget processes container workload binaries as part of its normal operation.

    View source ↗