Falco Talon

Tetragon is a Kubernetes-aware security observability and runtime enforcement tool developed as a Cilium sub-project and CNCF project. It uses eBPF and Linux kernel security mechanisms to monitor processes, system calls, file access, network activity, namespace changes and privilege changes, correlating events with workload and network identity. Its policy engine performs monitoring, filtering and enforcement in the kernel, including controls such as restricting binary execution, detecting Kubernetes data exfiltration and monitoring file integrity. Tetragon exposes event data through JSON logs and a gRPC endpoint, and can be installed on Kubernetes with Helm, on Linux from released packages, or as a container.

Talos Linux is a modern, minimal Linux distribution built for running Kubernetes. Developed and supported by Sidero Labs, it is immutable and hardened, with all system management performed through an API rather than a shell or interactive console. API access uses mutual TLS authentication, while immutable infrastructure and atomic updates are intended to reduce configuration drift and support predictable Kubernetes and Linux updates. The project is fully open source and production-ready.

KubeArmor is a runtime security and protection tool for Kubernetes environments that uses Linux security modules to enforce runtime policies and prevent malicious or disallowed commands from executing. Its prevention mode blocks commands at execution time rather than merely alerting afterward; in the demonstrated example, an attempted `ls` command fails.

Cast AI is a Kubernetes optimization platform for cloud-native teams. It uses workload, infrastructure, cost, and SLO signals to automate actions such as pod rightsizing, node scaling, GPU and Spot optimization, workload replica and resource tuning, bin packing, and operational remediation with approval workflows. The platform connects to EKS, AKS, GKE, and on-premises clusters without requiring cluster changes. The videos also identify Cast AI as the company that created Kimchi, an open-source coding harness with tools for autonomous coding tasks, persistent agent sessions, and team collaboration.

Tailcat is an open-source Go CLI and library from Tailscale that provides Netcat-style connections over Tailscale's encrypted data plane without using the Tailscale control plane or requiring a Tailscale account. A server generates a connection token containing WireGuard and relay metadata; a client uses the token to establish an end-to-end encrypted tunnel, initially through a DERP relay, while magicsock attempts NAT traversal and a direct peer-to-peer UDP connection. Its userspace networking stack does not alter routing tables, DNS settings, or require root access. The CLI can pipe standard input and output between machines, forward local TCP ports, provide an unauthenticated SSH server, run commands through a SOCKS5 proxy, act as an exit node, ping and inspect connection tokens, and publish tokens through DNS TXT records. The Go library exposes server and client APIs for dialing TCP ports through the tunnel. Tailcat can use Tailscale's public rate-limited DERP relays or user-operated relays, and an experimental WebAssembly browser demo supports file and text transfer. The project states that its CLI, API, and wire format have no stability guarantees.