From 1eaeebaae1dfabd7c9401d77175c7b6fa7c45609 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=A9stor=20Salceda?= Date: Tue, 2 Apr 2019 13:42:34 +0200 Subject: [PATCH] [stable/falco] Upgrade to Falco 0.14.0 (#12439) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Upgrade to Falco 0.14.0 Signed-off-by: Néstor Salceda * Enable eBPF by default on Falco builds Signed-off-by: Néstor Salceda * Allow to specify images from different registries than `docker.io` Signed-off-by: Néstor Salceda * Upgrade Chart version to a minor one because eBPF default value Signed-off-by: Néstor Salceda * Use RollingUpgrade strategy by default Signed-off-by: Néstor Salceda * Provide a sane defaults for resources Signed-off-by: Néstor Salceda * Update CHANGELOG entries Signed-off-by: Néstor Salceda * Add minor / major categorization to changelog Signed-off-by: Néstor Salceda --- stable/falco/CHANGELOG.md | 23 +++ stable/falco/Chart.yaml | 4 +- stable/falco/README.md | 13 +- stable/falco/rules/falco_rules.local.yaml | 18 ++ stable/falco/rules/falco_rules.yaml | 191 +++++++++++++++------- stable/falco/templates/_helpers.tpl | 23 +++ stable/falco/templates/daemonset.yaml | 5 +- stable/falco/values.yaml | 37 +++-- 8 files changed, 224 insertions(+), 90 deletions(-) diff --git a/stable/falco/CHANGELOG.md b/stable/falco/CHANGELOG.md index 793f4a9ec3..fa3a156ed4 100644 --- a/stable/falco/CHANGELOG.md +++ b/stable/falco/CHANGELOG.md @@ -3,29 +3,52 @@ This file documents all notable changes to Sysdig Falco Helm Chart. The release numbering uses [semantic versioning](http://semver.org). +## v0.6.0 + +### Major Changes + +* Upgrade to Falco 0.14.0 +* Upgrade rules to Falco 0.14.0 +* Enable eBPF by default on Falco +* Allow to download Falco images from different registries than `docker.io` +* Use rollingUpdate strategy by default +* Provide sane defauls for falco resource management + ## v0.5.6 +### Minor Changes + * Allow extra container args ## v0.5.5 +### Minor Changes + * Update correct slack example ## v0.5.4 +### Minor Changes + * Using Falco version 0.13.0 instead of latest. ## v0.5.3 +### Minor Changes + * Update falco_rules.yaml file to use the same rules that Falco 0.13.0 ## v0.5.2 +### Minor Changes + * Falco was accepted as a CNCF project. Fix references and download image from falcosecurity organization. ## v0.5.1 +### Minor Changes + * Allow falco to resolve cluster hostnames when running with ebpf.hostNetwork: true ## v0.5.0 diff --git a/stable/falco/Chart.yaml b/stable/falco/Chart.yaml index 6da3fc8df6..3a03d18fbe 100644 --- a/stable/falco/Chart.yaml +++ b/stable/falco/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: falco -version: 0.5.6 -appVersion: 0.13.0 +version: 0.6.0 +appVersion: 0.14.0 description: Sysdig Falco keywords: - monitoring diff --git a/stable/falco/README.md b/stable/falco/README.md index 16e4b88e29..94773ebfa3 100644 --- a/stable/falco/README.md +++ b/stable/falco/README.md @@ -45,20 +45,25 @@ The following table lists the configurable parameters of the Falco chart and the | Parameter | Description | Default | | --- | --- | --- | +| `image.registry` | The image registry to pull from | `docker.io` | | `image.repository` | The image repository to pull from | `falcosecurity/falco` | -| `image.tag` | The image tag to pull | `0.13.0` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `resources` | Specify container resources | `{}` | +| `image.tag` | The image tag to pull | `0.14.0` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `resources.requests.cpu` | CPU requested for being run in a node | `100m` | +| `resources.requests.memory` | Memory requested for being run in a node | `512Mi` | +| `resources.limits.cpu` | CPU limit | `200m` | +| `resources.limits.memory` | Memory limit | `1024Mi` | | `extraArgs` | Specify additional container args | `[]` | | `rbac.create` | If true, create & use RBAC resources | `true` | | `serviceAccount.create` | Create serviceAccount | `true` | | `serviceAccount.name` | Use this value as serviceAccountName | ` ` | | `fakeEventGenerator.enabled` | Run falco-event-generator for sample events | `false` | | `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` | +| `daemonset.updateStrategy.type` | The updateStrategy for updating the daemonset | `RollingUpdate` | | `proxy.httpProxy` | Set the Proxy server if is behind a firewall | `` | | `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | `` | | `proxy.noProxy` | Set the Proxy server if is behind a firewall | `` | -| `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false` | +| `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `true` | | `ebpf.settings.hostNetwork` | Needed to enable eBPF JIT at runtime for performance reasons | `true` | | `ebpf.settings.mountEtcVolume` | Needed to detect which kernel version are running in Google COS | `true` | | `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` | diff --git a/stable/falco/rules/falco_rules.local.yaml b/stable/falco/rules/falco_rules.local.yaml index 3c8e3bb5aa..d4b619ab64 100644 --- a/stable/falco/rules/falco_rules.local.yaml +++ b/stable/falco/rules/falco_rules.local.yaml @@ -1,3 +1,21 @@ +# +# Copyright (C) 2016-2018 Draios Inc dba Sysdig. +# +# This file is part of falco. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + #################### # Your custom rules! #################### diff --git a/stable/falco/rules/falco_rules.yaml b/stable/falco/rules/falco_rules.yaml index 167a1ddf25..947228a86f 100644 --- a/stable/falco/rules/falco_rules.yaml +++ b/stable/falco/rules/falco_rules.yaml @@ -16,6 +16,16 @@ # limitations under the License. # +# See xxx for details on falco engine and rules versioning. Currently, +# this specific rules file is compatible with engine version 0 +# (e.g. falco releases <= 0.13.1), so we'll keep the +# required_engine_version lines commented out, so maintain +# compatibility with older falco releases. With the first incompatible +# change to this rules file, we'll uncomment this line and set it to +# the falco engine version in use at the time. +# +#- required_engine_version: 2 + # Currently disabled as read/write are ignored syscalls. The nearly # similar open_write/open_read check for files being opened for # reading/writing. @@ -178,17 +188,23 @@ - list: deb_binaries items: [dpkg, dpkg-preconfigu, dpkg-reconfigur, dpkg-divert, apt, apt-get, aptitude, frontend, preinst, add-apt-reposit, apt-auto-remova, apt-key, - apt-listchanges, unattended-upgr, apt-add-reposit + apt-listchanges, unattended-upgr, apt-add-reposit, apt-config, apt-cache ] # The truncated dpkg-preconfigu is intentional, process names are # truncated at the sysdig level. - list: package_mgmt_binaries - items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client] + items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client, apk] - macro: package_mgmt_procs condition: proc.name in (package_mgmt_binaries) +- macro: package_mgmt_ancestor_procs + condition: proc.pname in (package_mgmt_binaries) or + proc.aname[2] in (package_mgmt_binaries) or + proc.aname[3] in (package_mgmt_binaries) or + proc.aname[4] in (package_mgmt_binaries) + - macro: coreos_write_ssh_dir condition: (proc.name=update-ssh-keys and fd.name startswith /home/core/.ssh) @@ -262,14 +278,18 @@ # Network - macro: inbound condition: > - (((evt.type in (accept,listen) and evt.dir=<)) or + (((evt.type in (accept,listen) and evt.dir=<) or + (evt.type in (recvfrom,recvmsg) and evt.dir=< and + fd.l4proto != tcp and fd.connected=false and fd.name_changed=true)) and (fd.typechar = 4 or fd.typechar = 6) and (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and (evt.rawres >= 0 or evt.res = EINPROGRESS)) - macro: outbound condition: > - (((evt.type = connect and evt.dir=<)) or + (((evt.type = connect and evt.dir=<) or + (evt.type in (sendto,sendmsg) and evt.dir=< and + fd.l4proto != tcp and fd.connected=false and fd.name_changed=true)) and (fd.typechar = 4 or fd.typechar = 6) and (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and (evt.rawres >= 0 or evt.res = EINPROGRESS)) @@ -580,7 +600,7 @@ condition: (proc.pname=run-openldap.sh and fd.name startswith /etc/openldap) - macro: ucpagent_writing_conf - condition: (proc.name=apiserver and container.image startswith docker/ucp-agent and fd.name=/etc/authorization_config.cfg) + condition: (proc.name=apiserver and container.image.repository=docker/ucp-agent and fd.name=/etc/authorization_config.cfg) - macro: iscsi_writing_conf condition: (proc.name=iscsiadm and fd.name startswith /etc/iscsi) @@ -628,7 +648,7 @@ condition: (veritas_progs and (fd.name startswith /etc/vx or fd.name startswith /etc/opt/VRTS or fd.name startswith /etc/vom)) - macro: nginx_writing_conf - condition: (proc.name=nginx and fd.name startswith /etc/nginx) + condition: (proc.name in (nginx,nginx-ingress-c) and fd.name startswith /etc/nginx) - macro: nginx_writing_certs condition: > @@ -802,7 +822,7 @@ condition: (proc.name=rabbitmq-server and fd.directory=/etc/rabbitmq) - macro: rook_writing_conf - condition: (proc.name=toolbox.sh and container.image startswith rook/toolbox + condition: (proc.name=toolbox.sh and container.image.repository=rook/toolbox and fd.directory=/etc/ceph) - macro: httpd_writing_conf_logs @@ -839,7 +859,17 @@ condition: (proc.aname[2] in (dpkg-reconfigur, dpkg-preconfigu)) - macro: ufw_writing_conf - condition: proc.name=ufw and fd.directory=/etc/ufw + condition: (proc.name=ufw and fd.directory=/etc/ufw) + +- macro: calico_writing_conf + condition: > + (proc.name = calico-node and fd.name startswith /etc/calico) + +- macro: prometheus_conf_writing_conf + condition: (proc.name=prometheus-conf and fd.directory=/etc/prometheus/config_out) + +- macro: openshift_writing_conf + condition: (proc.name=oc and fd.name=/etc/origin/node/node.kubeconfig) # Add conditions to this macro (probably in a separate file, # overwriting this macro) to allow for specific combinations of @@ -943,6 +973,9 @@ and not iscsi_writing_conf and not istio_writing_conf and not ufw_writing_conf + and not calico_writing_conf + and not prometheus_conf_writing_conf + and not openshift_writing_conf - rule: Write below etc desc: an attempt to write to any file below /etc @@ -1153,7 +1186,7 @@ as a part of creating a container) by calling setns. condition: > evt.type = setns - and not proc.name in (docker_binaries, k8s_binaries, lxd_binaries, sysdigcloud_binaries, sysdig, nsenter) + and not proc.name in (docker_binaries, k8s_binaries, lxd_binaries, sysdigcloud_binaries, sysdig, nsenter, calico) and not proc.name in (user_known_change_thread_namespace_binaries) and not proc.name startswith "runc:" and not proc.pname in (sysdigcloud_binaries) @@ -1314,50 +1347,43 @@ - macro: allowed_openshift_registry_root condition: > - (container.image startswith openshift3/ or - container.image startswith registry.access.redhat.com/openshift3/) + (container.image.repository startswith openshift3/ or + container.image.repository startswith registry.access.redhat.com/openshift3/) # Source: https://docs.openshift.com/enterprise/3.2/install_config/install/disconnected_install.html - macro: openshift_image condition: > (allowed_openshift_registry_root and - (container.image contains logging-deployment or - container.image contains logging-elasticsearch or - container.image contains logging-kibana or - container.image contains logging-fluentd or - container.image contains logging-auth-proxy or - container.image contains metrics-deployer or - container.image contains metrics-hawkular-metrics or - container.image contains metrics-cassandra or - container.image contains metrics-heapster or - container.image contains ose-haproxy-router or - container.image contains ose-deployer or - container.image contains ose-sti-builder or - container.image contains ose-docker-builder or - container.image contains ose-pod or - container.image contains ose-docker-registry or - container.image contains image-inspector)) + (container.image.repository contains logging-deployment or + container.image.repository contains logging-elasticsearch or + container.image.repository contains logging-kibana or + container.image.repository contains logging-fluentd or + container.image.repository contains logging-auth-proxy or + container.image.repository contains metrics-deployer or + container.image.repository contains metrics-hawkular-metrics or + container.image.repository contains metrics-cassandra or + container.image.repository contains metrics-heapster or + container.image.repository contains ose-haproxy-router or + container.image.repository contains ose-deployer or + container.image.repository contains ose-sti-builder or + container.image.repository contains ose-docker-builder or + container.image.repository contains ose-pod or + container.image.repository contains ose-docker-registry or + container.image.repository contains image-inspector)) + +- list: trusted_images + items: [ + sysdig/agent, sysdig/falco, sysdig/sysdig, gcr.io/google_containers/hyperkube, + quay.io/coreos/flannel, gcr.io/google_containers/kube-proxy, calico/node, + rook/toolbox, cloudnativelabs/kube-router, consul, mesosphere/mesos-slave, + datadog/docker-dd-agent, datadog/agent, docker/ucp-agent, gliderlabs/logspout + ] - macro: trusted_containers - condition: (container.image startswith sysdig/agent or - (container.image startswith sysdig/falco and - not container.image startswith sysdig/falco-event-generator) or - container.image startswith quay.io/sysdig or - container.image startswith sysdig/sysdig or - container.image startswith gcr.io/google_containers/hyperkube or - container.image startswith quay.io/coreos/flannel or - container.image startswith gcr.io/google_containers/kube-proxy or - container.image startswith calico/node or - container.image startswith rook/toolbox or - openshift_image or - container.image startswith cloudnativelabs/kube-router or - container.image startswith "consul:" or - container.image startswith mesosphere/mesos-slave or - container.image startswith istio/proxy_ or - container.image startswith datadog/docker-dd-agent or - container.image startswith datadog/agent or - container.image startswith docker/ucp-agent or - container.image startswith gliderlabs/logspout) + condition: (openshift_image or + container.image.repository in (trusted_images) or + container.image.repository startswith istio/proxy_ or + container.image.repository startswith quay.io/sysdig) # Add conditions to this macro (probably in a separate file, # overwriting this macro) to specify additional containers that are @@ -1366,7 +1392,7 @@ # In this file, it just takes one of the images in trusted_containers # and repeats it. - macro: user_trusted_containers - condition: (container.image startswith sysdig/agent) + condition: (container.image.repository=sysdig/agent) # Add conditions to this macro (probably in a separate file, # overwriting this macro) to specify additional containers that are @@ -1375,7 +1401,7 @@ # In this file, it just takes one of the images in trusted_containers # and repeats it. - macro: user_sensitive_mount_containers - condition: (container.image startswith sysdig/agent) + condition: (container.image.repository=sysdig/agent) - rule: Launch Privileged Container desc: Detect the initial process started in a privileged container. Exceptions are made for known trusted images. @@ -1384,7 +1410,7 @@ and container.privileged=true and not trusted_containers and not user_trusted_containers - output: Privileged container started (user=%user.name command=%proc.cmdline %container.info image=%container.image) + output: Privileged container started (user=%user.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag) priority: INFO tags: [container, cis] @@ -1395,7 +1421,8 @@ - macro: sensitive_mount condition: (container.mount.dest[/proc*] != "N/A" or container.mount.dest[/var/run/docker.sock] != "N/A" or - container.mount.dest[/var/lib/kubelet*] != "N/A" or + container.mount.dest[/var/lib/kubelet] != "N/A" or + container.mount.dest[/var/lib/kubelet/pki] != "N/A" or container.mount.dest[/] != "N/A" or container.mount.dest[/etc] != "N/A" or container.mount.dest[/root*] != "N/A") @@ -1423,7 +1450,7 @@ and sensitive_mount and not trusted_containers and not user_sensitive_mount_containers - output: Container with sensitive mount started (user=%user.name command=%proc.cmdline %container.info image=%container.image mounts=%container.mounts) + output: Container with sensitive mount started (user=%user.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag mounts=%container.mounts) priority: INFO tags: [container, cis] @@ -1434,8 +1461,8 @@ # alllowed, by using a filter that is guaranteed to evaluate to true # (the same proc.vpid=1 that's in the Launch Disallowed Container # rule). In the overridden macro, the condition would look something -# like (container.image startswith vendor/container-1 or -# container.image startswith vendor/container-2 or ...) +# like (container.image.repository = vendor/container-1 or +# container.image.repository = vendor/container-2 or ...) - macro: allowed_containers condition: (proc.vpid=1) @@ -1444,7 +1471,7 @@ desc: > Detect the initial process started by a container that is not in a list of allowed containers. condition: evt.type=execve and proc.vpid=1 and container and not allowed_containers - output: Container started and not in allowed list (user=%user.name command=%proc.cmdline %container.info image=%container.image) + output: Container started and not in allowed list (user=%user.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag) priority: WARNING tags: [container] @@ -1686,8 +1713,8 @@ # any way to know all the containers that should have access, so any # container is alllowed, by repeating the "container" macro. In the # overridden macro, the condition would look something like -# (container.image startswith vendor/container-1 or container.image -# startswith vendor/container-2 or ...) +# (container.image.repository = vendor/container-1 or +# container.image.repository = vendor/container-2 or ...) - macro: ec2_metadata_containers condition: container @@ -1697,7 +1724,7 @@ - rule: Contact EC2 Instance Metadata Service From Container desc: Detect attempts to contact the EC2 Instance Metadata Service from a container condition: outbound and fd.sip="169.254.169.254" and container and not ec2_metadata_containers - output: Outbound connection to EC2 instance metadata service (command=%proc.cmdline connection=%fd.name %container.info image=%container.image) + output: Outbound connection to EC2 instance metadata service (command=%proc.cmdline connection=%fd.name %container.info image=%container.image.repository:%container.image.tag) priority: NOTICE tags: [network, aws, container] @@ -1713,16 +1740,14 @@ # within a container. - macro: k8s_containers condition: > - (container.image startswith gcr.io/google_containers/hyperkube-amd64 or - container.image startswith gcr.io/google_containers/kube2sky or - container.image startswith sysdig/agent or - container.image startswith sysdig/falco or - container.image startswith sysdig/sysdig) + (container.image.repository in (gcr.io/google_containers/hyperkube-amd64, + gcr.io/google_containers/kube2sky, sysdig/agent, sysdig/falco, + sysdig/sysdig)) - rule: Contact K8S API Server From Container desc: Detect attempts to contact the K8S API Server from a container condition: outbound and k8s_api_server and container and not k8s_containers - output: Unexpected connection to K8s API Server from container (command=%proc.cmdline %container.info image=%container.image connection=%fd.name) + output: Unexpected connection to K8s API Server from container (command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag connection=%fd.name) priority: NOTICE tags: [network, k8s, container] @@ -1742,6 +1767,46 @@ priority: NOTICE tags: [network, k8s, container] +- list: network_tool_binaries + items: [nc, ncat, nmap] + +- macro: network_tool_procs + condition: proc.name in (network_tool_binaries) + +# Container is supposed to be immutable. Package management should be done in building the image. +- rule: Launch Package Management Process in Container + desc: Package management process ran inside container + condition: > + spawned_process and container and user.name != "_apt" and package_mgmt_procs and not package_mgmt_ancestor_procs + output: > + Package management process launched in container (user=%user.name + command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag) + priority: ERROR + tags: [process] + +- rule: Netcat Remote Code Execution in Container + desc: Netcat Program runs inside container that allows remote code execution + condition: > + spawned_process and container and + ((proc.name = "nc" and (proc.args contains "-e" or proc.args contains "-c")) or + (proc.name = "ncat" and (proc.args contains "--sh-exec" or proc.args contains "--exec")) + ) + output: > + Netcat runs inside container that allows remote code execution (user=%user.name + command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag) + priority: WARNING + tags: [network, process] + +- rule: Lauch Suspicious Network Tool in Container + desc: Detect network tools launched inside container + condition: > + spawned_process and container and network_tool_procs + output: > + Network tool launched in container (user=%user.name + command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag) + priority: NOTICE + tags: [network, process] + # Application rules have moved to application_rules.yaml. Please look # there if you want to enable them by adding to # falco_rules.local.yaml. diff --git a/stable/falco/templates/_helpers.tpl b/stable/falco/templates/_helpers.tpl index 71d84f9ff0..c6e4082536 100644 --- a/stable/falco/templates/_helpers.tpl +++ b/stable/falco/templates/_helpers.tpl @@ -41,3 +41,26 @@ Create the name of the service account to use {{ default "default" .Values.serviceAccount.name }} {{- end -}} {{- end -}} + +{{/* +Return the proper Falco image name +*/}} +{{- define "falco.image" -}} +{{- $registryName := .Values.image.registry -}} +{{- $repositoryName := .Values.image.repository -}} +{{- $tag := .Values.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} diff --git a/stable/falco/templates/daemonset.yaml b/stable/falco/templates/daemonset.yaml index 07dcca8129..4b10de4142 100644 --- a/stable/falco/templates/daemonset.yaml +++ b/stable/falco/templates/daemonset.yaml @@ -24,7 +24,7 @@ spec: {{ toYaml .Values.tolerations | indent 8 }} containers: - name: {{ .Chart.Name }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + image: {{ template "falco.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy }} resources: {{ toYaml .Values.resources | indent 12 }} @@ -182,6 +182,5 @@ spec: - name: shared-pipe emptyDir: {} {{- end }} - updateStrategy: - type: {{ default "OnDelete" .Values.daemonset.updateStrategy | quote }} +{{ toYaml .Values.daemonset.updateStrategy | indent 4 }} diff --git a/stable/falco/values.yaml b/stable/falco/values.yaml index f259949f18..1df1abad6a 100644 --- a/stable/falco/values.yaml +++ b/stable/falco/values.yaml @@ -1,21 +1,21 @@ # Default values for falco. image: + registry: docker.io repository: falcosecurity/falco - tag: 0.13.0 + tag: 0.14.0 pullPolicy: IfNotPresent -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 30m - # memory: 128Mi - # requests: - # cpu: 20m - # memory: 128Mi +resources: + # Although resources needed are subjective on the actual workload we provide + # a sane defaults ones. If you have more questions or concerns, please refer + # to Sysdig Support for more info about it + requests: + cpu: 100m + memory: 512Mi + limits: + cpu: 200m + memory: 1024Mi extraArgs: [] @@ -33,12 +33,13 @@ fakeEventGenerator: enabled: false replicas: 1 -daemonset: {} - # Allow the DaemonSet to perform a rolling update on helm update +daemonset: + # Perform rolling updates by default in the DaemonSet agent # ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/ - # If you do want to specify resources, uncomment the following lines, adjust - # them as necessary, and remove the curly braces after 'resources:'. - # updateStrategy: RollingUpdate + updateStrategy: + # You can also customize maxUnavailable, maxSurge or minReadySeconds if you + # need it + type: RollingUpdate # If is behind a proxy you can set the proxy server proxy: @@ -48,7 +49,7 @@ proxy: ebpf: # Enable eBPF support for Falco - enabled: false + enabled: true settings: # Needed to enable eBPF JIT at runtime for performance reasons.