mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[stable/falco] Add Falco NATS output integration (#6600)
* Update value of bufferedOutputs in configmap documentation * Add NATS output integration for Sysdig Falco * Add a change log
This commit is contained in:
Néstor Salceda
committed by
k8s-ci-robot
k8s-ci-robot
parent
6791878b94
commit
0dbd3513ef
@@ -0,0 +1,26 @@
|
||||
# Change Log
|
||||
|
||||
This file documents all notable changes to Sysdig Falco Helm Chart. The release
|
||||
numbering uses [semantic versioning](http://semver.org).
|
||||
|
||||
## v0.2.0
|
||||
|
||||
### Major Changes
|
||||
|
||||
* Add NATS Output integration
|
||||
|
||||
### Minor Changes
|
||||
|
||||
* Fix value mismatch between code and documentation
|
||||
|
||||
## v0.1.1
|
||||
|
||||
### Minor Changes
|
||||
|
||||
* Fix several typos
|
||||
|
||||
## v0.1.0
|
||||
|
||||
### Major Changes
|
||||
|
||||
* Initial release of Sysdig Falco Helm Chart
|
||||
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
name: falco
|
||||
version: 0.1.1
|
||||
version: 0.2.0
|
||||
appVersion: 0.10.0
|
||||
description: Sysdig Falco
|
||||
keywords:
|
||||
|
||||
@@ -60,7 +60,7 @@ The following table lists the configurable parameters of the Falco chart and the
|
||||
| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` |
|
||||
| `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` |
|
||||
| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` |
|
||||
| `falco.priority` | The minimum rule priority level to load and run | `debug` |
|
||||
| `falco.priority` | The minimum rule priority level to load and run | `debug` |
|
||||
| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` |
|
||||
| `falco.outputs.rate` | Number of tokens gained per second | `1` |
|
||||
| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` |
|
||||
@@ -76,6 +76,8 @@ The following table lists the configurable parameters of the Falco chart and the
|
||||
| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` |
|
||||
| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` |
|
||||
| `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` |
|
||||
| `integrations.natsOutput.enabled` | Enable NATS Output integration | `false` |
|
||||
| `integrations.natsOutput.natsUrl` | The NATS' URL where Falco is going to publish security alerts | `nats://nats.nats-io.svc.cluster.local:4222` |
|
||||
| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` |
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
@@ -27,7 +27,7 @@ data:
|
||||
{{- end }}
|
||||
|
||||
# Whether to output events in json or text
|
||||
{{- if .Values.integrations.gcscc.enabled }}
|
||||
{{- if (or .Values.integrations.gcscc.enabled .Values.integrations.natsOutput.enabled) }}
|
||||
json_output: true
|
||||
{{- else }}
|
||||
json_output: {{ .Values.falco.jsonOutput }}
|
||||
@@ -36,7 +36,12 @@ data:
|
||||
# When using json output, whether or not to include the "output" property
|
||||
# itself (e.g. "File below a known binary directory opened for writing
|
||||
# (user=root ....") in the json output.
|
||||
|
||||
{{- if .Values.integrations.natsOutput.enabled }}
|
||||
json_include_output_property: true
|
||||
{{- else }}
|
||||
json_include_output_property: {{ .Values.falco.jsonIncludeOutputProperty }}
|
||||
{{- end }}
|
||||
|
||||
# Send information logs to stderr and/or syslog Note these are *not* security
|
||||
# notification logs! These are just Falco lifecycle (and possibly error) logs.
|
||||
@@ -56,7 +61,7 @@ data:
|
||||
priority: {{ .Values.falco.priority }}
|
||||
|
||||
# Whether or not output to any of the output channels below is
|
||||
# buffered. Defaults to true
|
||||
# buffered. Defaults to false
|
||||
buffered_outputs: {{ .Values.falco.bufferedOutputs }}
|
||||
|
||||
# A throttling mechanism implemented as a token bucket limits the
|
||||
@@ -88,10 +93,17 @@ data:
|
||||
# Also, the file will be closed and reopened if falco is signaled with
|
||||
# SIGUSR1.
|
||||
|
||||
{{- if .Values.integrations.natsOutput.enabled }}
|
||||
file_output:
|
||||
enabled: true
|
||||
keep_alive: true
|
||||
filename: /var/run/falco/nats
|
||||
{{- else }}
|
||||
file_output:
|
||||
enabled: {{ .Values.falco.fileOutput.enabled }}
|
||||
keep_alive: {{ .Values.falco.fileOutput.keepAlive }}
|
||||
filename: {{ .Values.falco.fileOutput.filename }}
|
||||
{{- end }}
|
||||
|
||||
stdout_output:
|
||||
enabled: {{ .Values.falco.stdoutOutput.enabled }}
|
||||
|
||||
@@ -50,6 +50,28 @@ spec:
|
||||
- mountPath: /etc/falco/rules.d
|
||||
name: rules-volume
|
||||
{{- end }}
|
||||
{{- if .Values.integrations.natsOutput.enabled }}
|
||||
- mountPath: /var/run/falco/
|
||||
name: shared-pipe
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
{{- if .Values.integrations.natsOutput.enabled }}
|
||||
- name: {{ .Chart.Name }}-nats
|
||||
image: sysdig/falco-nats:latest
|
||||
imagePullPolicy: Always
|
||||
args: [ "/bin/falco-nats", "-s", {{ .Values.integrations.natsOutput.natsUrl | quote }}]
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/falco/
|
||||
name: shared-pipe
|
||||
initContainers:
|
||||
- name: init-pipe
|
||||
image: busybox
|
||||
command: ['mkfifo','/var/run/falco/nats']
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/falco/
|
||||
name: shared-pipe
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: dshm
|
||||
emptyDir:
|
||||
@@ -87,6 +109,10 @@ spec:
|
||||
configMap:
|
||||
name: {{ template "falco.fullname" . }}-rules
|
||||
{{- end }}
|
||||
{{- if .Values.integrations.natsOutput.enabled }}
|
||||
- name: shared-pipe
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
|
||||
updateStrategy:
|
||||
type: {{ default "OnDelete" .Values.daemonset.updateStrategy | quote }}
|
||||
|
||||
@@ -141,6 +141,7 @@ customRules: {}
|
||||
# rules-traefik.yaml: |-
|
||||
# [ rule body ]
|
||||
|
||||
integrations:
|
||||
# If Google Cloud Security Command Center integration is enabled, falco will
|
||||
# be configured to use this integration as program_output and sets the following values:
|
||||
# * json_output: true
|
||||
@@ -148,11 +149,21 @@ customRules: {}
|
||||
# enabled: true
|
||||
# keep_alive: false
|
||||
# program: "\"curl -d @- -X POST --header 'Content-Type: application/json' --header 'Authorization: authentication_token' url \""
|
||||
integrations:
|
||||
gcscc:
|
||||
enabled: false
|
||||
webhookUrl: http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events
|
||||
webhookAuthenticationToken: b27511f86e911f20b9e0f9c8104b4ec4
|
||||
# If Nats Output integration is enabled, falco will be configured to use this
|
||||
# integration as file_output and sets the following values:
|
||||
# * json_output: true
|
||||
# * json_include_output_property: true
|
||||
# * file_output:
|
||||
# enabled: true
|
||||
# keep_alive: true
|
||||
# filename: /var/run/falco/nats
|
||||
natsOutput:
|
||||
enabled: false
|
||||
natsUrl: "nats://nats.nats-io.svc.cluster.local:4222"
|
||||
|
||||
# Allow falco to run on Kubernetes 1.6 masters.
|
||||
tolerations:
|
||||
|
||||
Reference in New Issue
Block a user