Measuring Telemetry Retention and Stability for Post-Termination Forensics in a Single-Node Kubernetes Cluster

Source abstract

Short-lived Kubernetes workloads can terminate before investigators acquire evidence, leaving reconstruction dependent on telemetry retained by other components. How consistently that telemetry is retained as workloads scale, and whether count-based retention measurements can be trusted, remain poorly characterized. We analyzed 180 scripted trial attempts on a single-node kind cluster that collected Kubernetes Event objects, Istio control-plane logs, node packet captures, and eBPF/Tetragon process events. At 100 replicas, the volume of orchestration-event records and control-plane log lines fell to about two-thirds and three-quarters of matched no-attack baselines, with lower run-to-run stability than at 4 or 50 replicas. All ten four-collector trials at 100 replicas failed under host memory pressure. A trial-level audit of the released raw data showed that the credential-access and stress actions were not recorded in any run, that the in-pod deletion action was recorded only at the smallest scale, and that most orchestration-event records in some conditions were carry-over from earlier trials. We report those scenarios as inconclusive and quantify how these measurement-pipeline effects change retention estimates. The findings apply to the evaluated single-node configuration.