github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[stable/falco] Add Falco chart (#5853)

Browse Source 
* [stable/falco] Add Falco chart

* Fix indentation and other stuff reported by CI

* Add appVersion to Chart.yaml

* Specify container resources

* Allow to load external Falco rules

* Move GCSCC integrations to a top level integrations section

We can correlate falco.* keys for falco related settings, and refer them
in Falco Wiki

* Rename deployment to fakeEventGenerator

First one is too generic

* Add OWNERS file

* Separate rbac and serviceAccount

Follow RBAC best practices: https://github.com/kubernetes/helm/blob/master/docs/chart_best_practices/rbac.md

* Use falco.serviceAccount name template for cluster role binding

* Fixes required from reviewer

* Allow passing rules in an external file instead of editing configMap by hand

* Remove quotes from Chart version

I'm not sure if this break lint stage in CircleCI

* Update Chart.yaml
This commit is contained in:
Néstor Salceda
2018-07-03 20:38:20 -07:00
committed by k8s-ci-robot
parent eaa7a34dcf
commit 48f8a87dc8
16 changed files with 2295 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/falco/.helmignore
+21
View File
@@ -0,0 +1,21 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*~
# Various IDEs
.project
.idea/
*.tmproj
stable/falco/Chart.yaml
+19
View File
@@ -0,0 +1,19 @@
apiVersion: v1
name: falco
version: 0.1.0
appVersion: 0.10.0
description: Sysdig Falco
keywords:
- monitoring
- security
- alerting
- metric
- troubleshooting
- run-time
home: https://www.sysdig.com/opensource/falco/
icon: https://sysdig.com/wp-content/uploads/2016/08/falco_blog_480.jpg
sources:
- https://github.com/draios/falco
maintainers:
- name: nestorsalceda
email: nestor.salceda@sysdig.com
stable/falco/OWNERS
+5
View File
@@ -0,0 +1,5 @@
approvers:
- bencer
reviewers:
- bencer
- nestorsalceda
stable/falco/README.md
+172
View File
@@ -0,0 +1,172 @@
# Sysdig Falco
[Sysdig Falco](https://www.sysdig.com/opensource/falco/) is a behavioral activity monitor designed to detect anomalous activity in your applications. You can use Falco to monitor run-time security of your Kubernetes applications and internal components.
To know more about Sysdig Falco have a look at:
- [Kubernetes security logging with Falco & Fluentd
](https://sysdig.com/blog/kubernetes-security-logging-fluentd-falco/)
- [Active Kubernetes security with Sysdig Falco, NATS, and kubeless](https://sysdig.com/blog/active-kubernetes-security-falco-nats-kubeless/)
- [Detecting cryptojacking with Sysdig’s Falco
](https://sysdig.com/blog/detecting-cryptojacking-with-sysdigs-falco/)
## Introduction
This chart adds Falco to all nodes in your cluster using a DaemonSet.
Also provides a Deployment for generating Falco alerts. This is useful for testing purposes.
## Installing the Chart
To install the chart with the release name `my-release` run:
```bash
$ helm install --name my-release stable/falco
```
After a few seconds, Falco should be running.
> **Tip**: List all releases using `helm list`, a release is a name used to track an specific deployment
## Uninstalling the Chart
To uninstall/delete the `my-release` deployment:
```bash
$ helm delete my-release
```
> **Tip**: Use helm delete --purge my-release to completely remove the release from Helm internal storage
The command removes all the Kubernetes components associated with the chart and deletes the release.
## Configuration
The following table lists the configurable parameters of the Falco chart and their default values.
| Parameter | Description | Default |
| --- | --- | --- |
| `image.repository` | The image repository to pull from | `sysdig/falco` |
| `image.tag` | The image tag to pull | `latest` |
| `image.pullPolicy` | The image pull policy | `Always` |
| `resources` | Specify container resources | `{}` |
| `rbac.create` | If true, create & use RBAC resources | `true` |
| `serviceAccount.create` | Create serviceAccount | `true` |
| `serviceAccount.name` | Use this value as serviceAccountName | ` ` |
| `fakeEventGenerator.enabled` | Run falco-event-generator for sample events | `false` |
| `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` |
| `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` |
| `falco.jsonOutput` | Output events in json or text | `false` |
| `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` |
| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` |
| `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` |
| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` |
| `falco.priority` | The minimum rule priority level to load an run | `debug` |
| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` |
| `falco.outputs.rate` | Number of tokens gained per second | `1` |
| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` |
| `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` |
| `falco.fileOutput.enabled` | Enable file output for security notifications | `false` |
| `falco.fileOutput.keepAlive` | Open file once or every time a new notification arrives | `false` |
| `falco.fileOutput.filename` | The filename for logging notifications | `./events.txt` |
| `falco.stdoutOutput.enabled` | Enable stdout output for security notifications | `true` |
| `falco.programOutput.enabled` | Enable program output for security notifications | `false` |
| `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` |
| `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` |
| `customRules` | Third party rules enabled for Falco | `{}` |
| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` |
| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` |
| `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` |
| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` |
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
```bash
$ helm install --name my-release --set falco.jsonOutput=true stable/falco
```
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
```bash
$ helm install --name my-release -f values.yaml stable/falco
```
> **Tip**: You can use the default [values.yaml](values.yaml)
## Loading custom rules
Falco ships with a nice default ruleset. Is a good starting point but sooner or later we are going to need to add custom rules which fits our needs.
A few days ago [we published several rules](https://github.com/draios/falco-extras) for well known container images.
So the question is: How we can load custom rules in our Falco deployment?
We are going to create a file which contains custom rules so that we can keep it in a Git repository.
```bash
$ cat custom-rules.yaml
```
And the file looks like this one:
```yaml
customRules:
rules-traefik.yaml: |-
- macro: traefik_consider_syscalls
condition: (evt.num < 0)
- macro: app_traefik
condition: container and container.image startswith "traefik"
# Restricting listening ports to selected set
- list: traefik_allowed_inbound_ports_tcp
items: [443, 80, 8080]
- rule: Unexpected inbound tcp connection traefik
desc: Detect inbound traffic to traefik using tcp on a port outside of expected set
condition: inbound and evt.rawres >= 0 and not fd.sport in (traefik_allowed_inbound_ports_tcp) and app_traefik
output: Inbound network connection to traefik on unexpected port (command=%proc.cmdline pid=%proc.pid connection=%fd.name sport=%fd.sport user=%user.name %container.info image=%container.image)
priority: NOTICE
# Restricting spawned processes to selected set
- list: traefik_allowed_processes
items: ["traefik"]
- rule: Unexpected spawned process traefik
desc: Detect a process started in a traefik container outside of an expected set
condition: spawned_process and not proc.name in (traefik_allowed_processes) and app_traefik
output: Unexpected process spawned in traefik container (command=%proc.cmdline pid=%proc.pid user=%user.name %container.info image=%container.image)
priority: NOTICE
```
So next step is to use the custom-rules.yaml file for installing the Falco Helm chart.
```bash
$ helm install --name falco -f custom-rules.yaml stable/falco
```
And we will see in our logs something like:
```bash
Tue Jun 5 15:08:57 2018: Loading rules from file /etc/falco/rules.d/rules-traefik.yaml:
```
And this means that our Falco installation has loaded the rules and is ready to help us.
### Automating the generation of custom-rules.yaml file
Sometimes edit YAML files with multistrings is a bit error prone, so we added an script for automating this step and make your life easier.
This script lives in [falco-extras repository](https://github.com/draios/falco-extras) in the scripts directory.
Imagine that you would like to add rules for your Redis, MongoDB and Traefik containers, you have to:
```bash
$ git clone https://github.com/draios/falco-extras.git
$ cd falco-extras
$ ./scripts/rules2helm rules/rules-mongo.yaml rules/rules-redis.yaml rules/rules-traefik.yaml > custom-rules.yaml
$ helm install --name falco -f custom-rules.yaml stable/falco
```
And that's all, in a few seconds you will see your pods up and running with MongoDB, Redis and Traefik rules enabled.
stable/falco/rules/falco_rules.local.yaml
+13
View File
@@ -0,0 +1,13 @@
####################
# Your custom rules!
####################
# Add new rules, like this one
# - rule: The program "sudo" is run in a container
# desc: An event will trigger every time you run sudo in a container
# condition: evt.type = execve and evt.dir=< and container.id != host and proc.name = sudo
# output: "Sudo run in container (user=%user.name %container.info parent=%proc.pname cmdline=%proc.cmdline)"
# priority: ERROR
# tags: [users, container]
# Or override/append to any rule, macro, or list from the Default Rules
stable/falco/rules/falco_rules.yaml
+1540
View File
File diff suppressed because it is too large Load Diff
stable/falco/templates/NOTES.txt
+5
View File
@@ -0,0 +1,5 @@
Falco agents are spinning up on each node in your cluster. After a few
seconds, they are going to start monitoring your containers looking for
security issues.
No further action should be required.
stable/falco/templates/_helpers.tpl
+43
View File
@@ -0,0 +1,43 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "falco.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "falco.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "falco.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
{{- define "falco.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "falco.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
stable/falco/templates/clusterrole.yaml
+32
View File
@@ -0,0 +1,32 @@
{{- if .Values.rbac.create }}
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: {{ template "falco.fullname" .}}
labels:
app: {{ template "falco.fullname" . }}
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
rules:
- apiGroups:
- extensions
- ""
resources:
- nodes
- namespaces
- pods
- replicationcontrollers
- services
- events
- configmaps
verbs:
- get
- list
- watch
- nonResourceURLs:
- /healthz
- /healthz/*
verbs:
- get
{{- end }}
stable/falco/templates/clusterrolebinding.yaml
+19
View File
@@ -0,0 +1,19 @@
{{- if .Values.rbac.create }}
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: {{ template "falco.fullname" .}}
labels:
app: {{ template "falco.fullname" . }}
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
subjects:
- kind: ServiceAccount
name: {{ template "falco.serviceAccountName" .}}
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ template "falco.fullname" .}}
apiGroup: rbac.authorization.k8s.io
{{- end }}
stable/falco/templates/configmap-rules.yaml
+16
View File
@@ -0,0 +1,16 @@
{{- if .Values.customRules }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "falco.fullname" . }}-rules
labels:
app: {{ template "falco.fullname" . }}
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
data:
{{- range $file, $content := .Values.customRules }}
{{ $file }}: |-
{{ $content | indent 4}}
{{- end }}
{{- end }}
stable/falco/templates/configmap.yaml
+126
View File
@@ -0,0 +1,126 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "falco.fullname" . }}
labels:
app: {{ template "falco.fullname" . }}
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
data:
falco.yaml: |-
# File(s) or Directories containing Falco rules, loaded at startup.
# The name "rules_file" is only for backwards compatibility.
# If the entry is a file, it will be read directly. If the entry is a directory,
# every file in that directory will be read, in alphabetical order.
#
# falco_rules.yaml ships with the falco package and is overridden with
# every new software version. falco_rules.local.yaml is only created
# if it doesn't exist. If you want to customize the set of rules, add
# your customizations to falco_rules.local.yaml.
#
# The files will be read in the order presented here, so make sure if
# you have overrides they appear in later files.
rules_file:
{{- range .Values.falco.rulesFile }}
- {{ . }}
{{- end }}
# Whether to output events in json or text
{{- if .Values.integrations.gcscc.enabled }}
json_output: true
{{- else }}
json_output: {{ .Values.falco.jsonOutput }}
{{- end }}
# When using json output, whether or not to include the "output" property
# itself (e.g. "File below a known binary directory opened for writing
# (user=root ....") in the json output.
json_include_output_property: {{ .Values.falco.jsonIncludeOutputProperty }}
# Send information logs to stderr and/or syslog Note these are *not* security
# notification logs! These are just Falco lifecycle (and possibly error) logs.
log_stderr: {{ .Values.falco.logStderr }}
log_syslog: {{ .Values.falco.logSyslog }}
# Minimum log level to include in logs. Note: these levels are
# separate from the priority field of rules. This refers only to the
# log level of falco's internal logging. Can be one of "emergency",
# "alert", "critical", "error", "warning", "notice", "info", "debug".
log_level: {{ .Values.falco.logLevel }}
# Minimum rule priority level to load and run. All rules having a
# priority more severe than this level will be loaded/run. Can be one
# of "emergency", "alert", "critical", "error", "warning", "notice",
# "info", "debug".
priority: {{ .Values.falco.priority }}
# Whether or not output to any of the output channels below is
# buffered. Defaults to true
buffered_outputs: {{ .Values.falco.bufferedOutputs }}
# A throttling mechanism implemented as a token bucket limits the
# rate of falco notifications. This throttling is controlled by the following configuration
# options:
# - rate: the number of tokens (i.e. right to send a notification)
# gained per second. Defaults to 1.
# - max_burst: the maximum number of tokens outstanding. Defaults to 1000.
#
# With these defaults, falco could send up to 1000 notifications after
# an initial quiet period, and then up to 1 notification per second
# afterward. It would gain the full burst back after 1000 seconds of
# no activity.
outputs:
rate: {{ .Values.falco.outputs.rate }}
max_burst: {{ .Values.falco.outputs.maxBurst }}
# Where security notifications should go.
# Multiple outputs can be enabled.
syslog_output:
enabled: {{ .Values.falco.syslogOutput.enabled }}
# If keep_alive is set to true, the file will be opened once and
# continuously written to, with each output message on its own
# line. If keep_alive is set to false, the file will be re-opened
# for each output message.
#
# Also, the file will be closed and reopened if falco is signaled with
# SIGUSR1.
file_output:
enabled: {{ .Values.falco.fileOutput.enabled }}
keep_alive: {{ .Values.falco.fileOutput.keepAlive }}
filename: {{ .Values.falco.fileOutput.filename }}
stdout_output:
enabled: {{ .Values.falco.stdoutOutput.enabled }}
# Possible additional things you might want to do with program output:
# - send to a slack webhook:
# program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX"
# - logging (alternate method than syslog):
# program: logger -t falco-test
# - send over a network connection:
# program: nc host.example.com 80
# If keep_alive is set to true, the program will be started once and
# continuously written to, with each output message on its own
# line. If keep_alive is set to false, the program will be re-spawned
# for each output message.
#
# Also, the program will be closed and reopened if falco is signaled with
# SIGUSR1.
{{- if .Values.integrations.gcscc.enabled }}
programOutput:
enabled: true
keep_alive: false
program: "\"curl -d @- -X POST --header 'Content-Type: application/json' --header 'Authorization: {{ .Values.integrations.gcscc.webhookAuthenticationToken }}' {{ .Values.integrations.gcscc.webhookUrl }}/\""
{{- else }}
program_output:
enabled: {{ .Values.falco.programOutput.enabled }}
keep_alive: {{ .Values.falco.programOutput.keepAlive }}
program: {{ .Values.falco.programOutput.program }}
{{- end }}
{{ (.Files.Glob "rules/*").AsConfig | indent 2 }}
stable/falco/templates/daemonset.yaml
+92
View File
@@ -0,0 +1,92 @@
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
name: {{ template "falco.fullname" . }}
labels:
app: {{ template "falco.fullname" . }}
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
spec:
template:
metadata:
name: {{ template "falco.fullname" .}}
labels:
app: {{ template "falco.fullname" .}}
role: security
spec:
serviceAccountName: {{ template "falco.serviceAccountName" .}}
tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
resources:
{{ toYaml .Values.resources | indent 12 }}
securityContext:
privileged: true
args: [ "/usr/bin/falco", "-K", "/var/run/secrets/kubernetes.io/serviceaccount/token", "-k", "https://kubernetes.default", "-pk"]
volumeMounts:
- mountPath: /host/var/run/docker.sock
name: docker-socket
- mountPath: /host/dev
name: dev-fs
- mountPath: /host/proc
name: proc-fs
readOnly: true
- mountPath: /host/boot
name: boot-fs
readOnly: true
- mountPath: /host/lib/modules
name: lib-modules
readOnly: true
- mountPath: /host/usr
name: usr-fs
readOnly: true
- mountPath: /etc/falco
name: config-volume
{{- if .Values.customRules }}
- mountPath: /etc/falco/rules.d
name: rules-volume
{{- end }}
volumes:
- name: dshm
emptyDir:
medium: Memory
- name: docker-socket
hostPath:
path: /var/run/docker.sock
- name: dev-fs
hostPath:
path: /dev
- name: proc-fs
hostPath:
path: /proc
- name: boot-fs
hostPath:
path: /boot
- name: lib-modules
hostPath:
path: /lib/modules
- name: usr-fs
hostPath:
path: /usr
- name: config-volume
configMap:
name: {{ template "falco.fullname" . }}
items:
- key: falco.yaml
path: falco.yaml
- key: falco_rules.yaml
path: falco_rules.yaml
- key: falco_rules.local.yaml
path: falco_rules.local.yaml
{{- if .Values.customRules }}
- name: rules-volume
configMap:
name: {{ template "falco.fullname" . }}-rules
{{- end }}
updateStrategy:
type: {{ default "OnDelete" .Values.daemonset.updateStrategy | quote }}
stable/falco/templates/deployment.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if .Values.fakeEventGenerator.enabled }}
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: {{ template "falco.fullname" . }}-event-generator
labels:
app: {{ template "falco.fullname" . }}-event-generator
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
spec:
replicas: {{ .Values.fakeEventGenerator.replicas }}
template:
metadata:
labels:
app: {{ template "falco.fullname" . }}-event-generator
spec:
containers:
- name: {{ template "falco.fullname" . }}-event-generator
image: sysdig/falco-event-generator:latest
{{- end }}
stable/falco/templates/serviceaccount.yaml
+11
View File
@@ -0,0 +1,11 @@
{{- if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "falco.serviceAccountName" .}}
labels:
app: {{ template "falco.fullname" . }}
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
{{- end }}
stable/falco/values.yaml
+160
View File
@@ -0,0 +1,160 @@
# Default values for falco.
image:
repository: sysdig/falco
tag: latest
pullPolicy: Always
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# limits:
# cpu: 30m
# memory: 128Mi
# requests:
# cpu: 20m
# memory: 128Mi
rbac:
# Create and use rbac resources
create: true
serviceAccount:
# Create and use serviceAccount resources
create: true
# Use this value as serviceAccountName
name:
fakeEventGenerator:
enabled: false
replicas: 1
daemonset: {}
# Allow the DaemonSet to perform a rolling update on helm update
# ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/
# If you do want to specify resources, uncomment the following lines, adjust
# them as necessary, and remove the curly braces after 'resources:'.
# updateStrategy: RollingUpdate
falco:
# The location of the rules file(s). This can contain one or more paths to
# separate rules files.
rulesFile:
- /etc/falco/falco_rules.yaml
- /etc/falco/falco_rules.local.yaml
- /etc/falco/rules.d
# Whether to output events in json or text
jsonOutput: false
# When using json output, whether or not to include the "output" property
# itself (e.g. "File below a known binary directory opened for writing
# (user=root ....") in the json output.
jsonIncludeOutputProperty: true
# Send information logs to stderr and/or syslog Note these are *not* security
# notification logs! These are just Falco lifecycle (and possibly error) logs.
logStderr: true
logSyslog: true
# Minimum log level to include in logs. Note: these levels are
# separate from the priority field of rules. This refers only to the
# log level of falco's internal logging. Can be one of "emergency",
# "alert", "critical", "error", "warning", "notice", "info", "debug".
logLevel: info
# Minimum rule priority level to load and run. All rules having a
# priority more severe than this level will be loaded/run. Can be one
# of "emergency", "alert", "critical", "error", "warning", "notice",
# "info", "debug".
priority: debug
# Whether or not output to any of the output channels below is
# buffered.
bufferedOutputs: false
# A throttling mechanism implemented as a token bucket limits the
# rate of falco notifications. This throttling is controlled by the following configuration
# options:
# - rate: the number of tokens (i.e. right to send a notification)
# gained per second. Defaults to 1.
# - max_burst: the maximum number of tokens outstanding. Defaults to 1000.
#
# With these defaults, falco could send up to 1000 notifications after
# an initial quiet period, and then up to 1 notification per second
# afterward. It would gain the full burst back after 1000 seconds of
# no activity.
outputs:
rate: 1
maxBurst: 1000
# Where security notifications should go.
# Multiple outputs can be enabled.
syslogOutput:
enabled: true
# If keep_alive is set to true, the file will be opened once and
# continuously written to, with each output message on its own
# line. If keep_alive is set to false, the file will be re-opened
# for each output message.
#
# Also, the file will be closed and reopened if falco is signaled with
# SIGUSR1.
fileOutput:
enabled: false
keepAlive: false
filename: ./events.txt
stdoutOutput:
enabled: true
# Possible additional things you might want to do with program output:
# - send to a slack webhook:
# program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX"
# - logging (alternate method than syslog):
# program: logger -t falco-test
# - send over a network connection:
# program: nc host.example.com 80
# If keep_alive is set to true, the program will be started once and
# continuously written to, with each output message on its own
# line. If keep_alive is set to false, the program will be re-spawned
# for each output message.
#
# Also, the program will be closed and reopened if falco is signaled with
# SIGUSR1.
programOutput:
enabled: false
keepAlive: false
program: mail -s "Falco Notification" someone@example.com
customRules: {}
# Although Falco comes with a nice default rule set for detecting weird
# behavior in containers, our users are going to customize the run-time
# security rule sets or policies for the specific container images and
# applications they run. This feature can be handled in this section.
#
# Example:
#
# rules-traefik.yaml: |-
# [ rule body ]
# If Google Cloud Security Command Center integration is enabled, falco will
# be configured to use this integration as program_output and sets the following values:
# * json_output: true
# * program_output:
# enabled: true
# keep_alive: false
# program: "\"curl -d @- -X POST --header 'Content-Type: application/json' --header 'Authorization: authentication_token' url \""
integrations:
gcscc:
enabled: false
webhookUrl: http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events
webhookAuthenticationToken: b27511f86e911f20b9e0f9c8104b4ec4
# Allow falco to run on Kubernetes 1.6 masters.
tolerations:
- effect: NoSchedule
key: node-role.kubernetes.io/master