Plugins
The plugins in the box, what each reads, and what is planned.
A plugin is a Go package for one system. It reads state, takes in telemetry, publishes what it finds into the graph, and can declare the fixes it knows how to apply. If a system can report changes, it can be a plugin. To build one, see Write a plugin.
In the box
| Plugin | Role | Discovery | Telemetry | Primary contribution | Can apply |
|---|---|---|---|---|---|
| Kubernetes | Source | Yes | No | inventory | NetworkPolicy ingress isolation for a Pod or a Service |
| Istio | Semantic, telemetry mapper | Yes | Yes | semantics | STRICT mutual TLS with PeerAuthentication |
| Cilium | Semantic | Yes | Not yet | cni-semantics | CiliumNetworkPolicy ingress isolation |
| agentgateway (early) | Semantic | Yes | Not yet | semantics | Nothing |
| Falco (early) | Telemetry mapper | No | Yes | Host-owned rollups | Nothing |
| AWS (early) | Source, telemetry receiver | Yes | Yes | inventory | Nothing |
Cilium and agentgateway have normalizers for Hubble flows and access logs, but no transport feeds them yet.
Kubernetes
Owns API discovery and one shared informer per resource type, covering workloads, services, RBAC, and admission configuration. It publishes one collection per type and reuses it for every plugin that asks. Secrets arrive as object metadata and a sorted list of key names. Values, type, and annotations are excluded. See Kubernetes.
Istio
Models AuthorizationPolicy, PeerAuthentication, ambient enrollment, waypoints, ServiceEntry, and VirtualService on top of the Kubernetes plugin’s watches. It maps waypoint OTLP access logs into bounded communication rollups, which needs a custom access-log provider. ServiceEntry endpoint values stay out of the graph, and only counts and address classes are kept. See Istio.
Cilium
Reads CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy, CiliumEndpoint, and CiliumNode, and enriches the matching Pods and Nodes instead of creating rival identities. It covers CNI state only. Service mesh, Envoy, and L7 policy are out of scope, and L7 sections are diagnosed and omitted. See Cilium.
agentgateway
Early. Expect it to change. It projects GatewayClass, Gateway, HTTPRoute, and the Services they reference for agentgateway instances managed through Gateway API.
- Cross-namespace backends are omitted because ReferenceGrant coverage is missing.
See agentgateway.
Falco
Early. It maps Falco interactive-shell alerts that your OpenTelemetry Collector forwards, so a Pod that opens a shell gains an executes edge to the shell process class, and a detection rule can match on it. It reads no provider API. See Falco.
AWS
Early. It inventories EC2 instances, network interfaces, and security groups in one region and takes VPC Flow Logs straight from Amazon Data Firehose. It uses the default AWS credential chain and needs no Kubernetes cluster. It does not model routing, gateways, network ACLs, or IAM, and it has no actions to apply. See AWS.
Planned
None of these are in this release.
| Plugin | Purpose |
|---|---|
| Tetragon | Runtime events from eBPF |
The graph does not model permissions, reachability derived from network policy, or secret access as edges yet.
Kubernetes
What the Kubernetes plugin watches, the RBAC it needs, what it puts in the graph, and the NetworkPolicy fixes it can apply.
Istio
How the Istio plugin describes mesh security in the graph, how to send it waypoint access logs, and the mutual TLS fix it can apply.
Cilium
What the Cilium plugin reads, what it adds to the graph, the Hubble normalizer that has no transport yet, and the CiliumNetworkPolicy fix it can apply.
agentgateway
How the agentgateway plugin selects Gateways and routes, what it adds to the graph, and the access-log normalizer that has no transport yet.
Falco
How shell alerts from Falco reach the graph, how to wire a collector to agentshield, and how a rule can match on them.
AWS
What the AWS plugin reads, the permissions and event infrastructure it needs, how VPC Flow Logs arrive, and what it leaves out.
Write a plugin
The runtime contract, the rules a plugin follows, a sample, and how to test one.
Plugin contract
Plugin capabilities, runtime contracts, collection ownership, publication, health, and testing requirements.
Plugin style guide
Code conventions for plugin identity, evidence, projection, errors, and tests.
Tutorial: the life of a plugin
Follow a plugin from registration and observations through projection and graph publication.