diff --git a/stable/falco/CHANGELOG.md b/stable/falco/CHANGELOG.md new file mode 100644 index 0000000000..862a7967a4 --- /dev/null +++ b/stable/falco/CHANGELOG.md @@ -0,0 +1,26 @@ +# Change Log + +This file documents all notable changes to Sysdig Falco Helm Chart. The release +numbering uses [semantic versioning](http://semver.org). + +## v0.2.0 + +### Major Changes + +* Add NATS Output integration + +### Minor Changes + +* Fix value mismatch between code and documentation + +## v0.1.1 + +### Minor Changes + +* Fix several typos + +## v0.1.0 + +### Major Changes + +* Initial release of Sysdig Falco Helm Chart diff --git a/stable/falco/Chart.yaml b/stable/falco/Chart.yaml index 2858bd9ef5..944a485664 100644 --- a/stable/falco/Chart.yaml +++ b/stable/falco/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: falco -version: 0.1.1 +version: 0.2.0 appVersion: 0.10.0 description: Sysdig Falco keywords: diff --git a/stable/falco/README.md b/stable/falco/README.md index 9a09b61b65..f888ea049c 100644 --- a/stable/falco/README.md +++ b/stable/falco/README.md @@ -60,7 +60,7 @@ The following table lists the configurable parameters of the Falco chart and the | `falco.logStderr` | Send Falco debugging information logs to stderr | `true` | | `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` | | `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` | -| `falco.priority` | The minimum rule priority level to load and run | `debug` | +| `falco.priority` | The minimum rule priority level to load and run | `debug` | | `falco.bufferedOutputs` | Use buffered outputs to channels | `false` | | `falco.outputs.rate` | Number of tokens gained per second | `1` | | `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` | @@ -76,6 +76,8 @@ The following table lists the configurable parameters of the Falco chart and the | `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` | | `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` | | `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` | +| `integrations.natsOutput.enabled` | Enable NATS Output integration | `false` | +| `integrations.natsOutput.natsUrl` | The NATS' URL where Falco is going to publish security alerts | `nats://nats.nats-io.svc.cluster.local:4222` | | `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/stable/falco/templates/configmap.yaml b/stable/falco/templates/configmap.yaml index 1717ff1831..9978fdd517 100644 --- a/stable/falco/templates/configmap.yaml +++ b/stable/falco/templates/configmap.yaml @@ -27,7 +27,7 @@ data: {{- end }} # Whether to output events in json or text - {{- if .Values.integrations.gcscc.enabled }} + {{- if (or .Values.integrations.gcscc.enabled .Values.integrations.natsOutput.enabled) }} json_output: true {{- else }} json_output: {{ .Values.falco.jsonOutput }} @@ -36,7 +36,12 @@ data: # When using json output, whether or not to include the "output" property # itself (e.g. "File below a known binary directory opened for writing # (user=root ....") in the json output. + + {{- if .Values.integrations.natsOutput.enabled }} + json_include_output_property: true + {{- else }} json_include_output_property: {{ .Values.falco.jsonIncludeOutputProperty }} + {{- end }} # Send information logs to stderr and/or syslog Note these are *not* security # notification logs! These are just Falco lifecycle (and possibly error) logs. @@ -56,7 +61,7 @@ data: priority: {{ .Values.falco.priority }} # Whether or not output to any of the output channels below is - # buffered. Defaults to true + # buffered. Defaults to false buffered_outputs: {{ .Values.falco.bufferedOutputs }} # A throttling mechanism implemented as a token bucket limits the @@ -88,10 +93,17 @@ data: # Also, the file will be closed and reopened if falco is signaled with # SIGUSR1. + {{- if .Values.integrations.natsOutput.enabled }} + file_output: + enabled: true + keep_alive: true + filename: /var/run/falco/nats + {{- else }} file_output: enabled: {{ .Values.falco.fileOutput.enabled }} keep_alive: {{ .Values.falco.fileOutput.keepAlive }} filename: {{ .Values.falco.fileOutput.filename }} + {{- end }} stdout_output: enabled: {{ .Values.falco.stdoutOutput.enabled }} diff --git a/stable/falco/templates/daemonset.yaml b/stable/falco/templates/daemonset.yaml index 839c89bcb5..16e7dc5f7d 100644 --- a/stable/falco/templates/daemonset.yaml +++ b/stable/falco/templates/daemonset.yaml @@ -50,6 +50,28 @@ spec: - mountPath: /etc/falco/rules.d name: rules-volume {{- end }} + {{- if .Values.integrations.natsOutput.enabled }} + - mountPath: /var/run/falco/ + name: shared-pipe + readOnly: false + {{- end }} + {{- if .Values.integrations.natsOutput.enabled }} + - name: {{ .Chart.Name }}-nats + image: sysdig/falco-nats:latest + imagePullPolicy: Always + args: [ "/bin/falco-nats", "-s", {{ .Values.integrations.natsOutput.natsUrl | quote }}] + volumeMounts: + - mountPath: /var/run/falco/ + name: shared-pipe + initContainers: + - name: init-pipe + image: busybox + command: ['mkfifo','/var/run/falco/nats'] + volumeMounts: + - mountPath: /var/run/falco/ + name: shared-pipe + readOnly: false + {{- end }} volumes: - name: dshm emptyDir: @@ -87,6 +109,10 @@ spec: configMap: name: {{ template "falco.fullname" . }}-rules {{- end }} + {{- if .Values.integrations.natsOutput.enabled }} + - name: shared-pipe + emptyDir: {} + {{- end }} updateStrategy: type: {{ default "OnDelete" .Values.daemonset.updateStrategy | quote }} diff --git a/stable/falco/values.yaml b/stable/falco/values.yaml index 06a3b70a4a..f4f017c7c5 100644 --- a/stable/falco/values.yaml +++ b/stable/falco/values.yaml @@ -141,6 +141,7 @@ customRules: {} # rules-traefik.yaml: |- # [ rule body ] +integrations: # If Google Cloud Security Command Center integration is enabled, falco will # be configured to use this integration as program_output and sets the following values: # * json_output: true @@ -148,11 +149,21 @@ customRules: {} # enabled: true # keep_alive: false # program: "\"curl -d @- -X POST --header 'Content-Type: application/json' --header 'Authorization: authentication_token' url \"" -integrations: gcscc: enabled: false webhookUrl: http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events webhookAuthenticationToken: b27511f86e911f20b9e0f9c8104b4ec4 + # If Nats Output integration is enabled, falco will be configured to use this + # integration as file_output and sets the following values: + # * json_output: true + # * json_include_output_property: true + # * file_output: + # enabled: true + # keep_alive: true + # filename: /var/run/falco/nats + natsOutput: + enabled: false + natsUrl: "nats://nats.nats-io.svc.cluster.local:4222" # Allow falco to run on Kubernetes 1.6 masters. tolerations: