mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[stable/falco] Add GCloud PubSub integration (#12204)
* [stable/falco] Add GCloud PubSub integration * Add GCloud PubSub integration This allows Falco to publish alerts to a PubSub topic Signed-off-by: Federico Barcelona <fede_rico_94@hotmail.com> * [stable/falco] Fix values to follow naming conventions Signed-off-by: Federico Barcelona <fede_rico_94@hotmail.com> * [stable/falco] Changes requested in the PR - Follow naming conventions - Use only one secret instead of two different ones Signed-off-by: Federico Barcelona <fede_rico_94@hotmail.com>
This commit is contained in:
Fede Barcelona
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
5bdb308239
commit
5e85bb7d41
@@ -3,6 +3,10 @@
|
||||
This file documents all notable changes to Sysdig Falco Helm Chart. The release
|
||||
numbering uses [semantic versioning](http://semver.org).
|
||||
|
||||
## v0.7.1
|
||||
|
||||
* Add Google Pub/Sub Output integration
|
||||
|
||||
## v0.7.0
|
||||
|
||||
### Major Changes
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
name: falco
|
||||
version: 0.7.0
|
||||
version: 0.7.1
|
||||
appVersion: 0.14.0
|
||||
description: Sysdig Falco
|
||||
keywords:
|
||||
|
||||
+56
-53
@@ -43,59 +43,62 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
|
||||
The following table lists the configurable parameters of the Falco chart and their default values.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| --- | --- | --- |
|
||||
| `image.registry` | The image registry to pull from | `docker.io` |
|
||||
| `image.repository` | The image repository to pull from | `falcosecurity/falco` |
|
||||
| `image.tag` | The image tag to pull | `0.14.0` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `resources.requests.cpu` | CPU requested for being run in a node | `100m` |
|
||||
| `resources.requests.memory` | Memory requested for being run in a node | `512Mi` |
|
||||
| `resources.limits.cpu` | CPU limit | `200m` |
|
||||
| `resources.limits.memory` | Memory limit | `1024Mi` |
|
||||
| `extraArgs` | Specify additional container args | `[]` |
|
||||
| `rbac.create` | If true, create & use RBAC resources | `true` |
|
||||
| `serviceAccount.create` | Create serviceAccount | `true` |
|
||||
| `serviceAccount.name` | Use this value as serviceAccountName | ` ` |
|
||||
| `fakeEventGenerator.enabled` | Run falco-event-generator for sample events | `false` |
|
||||
| `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` |
|
||||
| `daemonset.updateStrategy.type` | The updateStrategy for updating the daemonset | `RollingUpdate` |
|
||||
| `proxy.httpProxy` | Set the Proxy server if is behind a firewall | `` |
|
||||
| `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | `` |
|
||||
| `proxy.noProxy` | Set the Proxy server if is behind a firewall | `` |
|
||||
| `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false` |
|
||||
| `ebpf.settings.hostNetwork` | Needed to enable eBPF JIT at runtime for performance reasons | `true` |
|
||||
| `ebpf.settings.mountEtcVolume` | Needed to detect which kernel version are running in Google COS | `true` |
|
||||
| `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` |
|
||||
| `falco.jsonOutput` | Output events in json or text | `false` |
|
||||
| `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` |
|
||||
| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` |
|
||||
| `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` |
|
||||
| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` |
|
||||
| `falco.priority` | The minimum rule priority level to load and run | `debug` |
|
||||
| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` |
|
||||
| `falco.outputs.rate` | Number of tokens gained per second | `1` |
|
||||
| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` |
|
||||
| `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` |
|
||||
| `falco.fileOutput.enabled` | Enable file output for security notifications | `false` |
|
||||
| `falco.fileOutput.keepAlive` | Open file once or every time a new notification arrives | `false` |
|
||||
| `falco.fileOutput.filename` | The filename for logging notifications | `./events.txt` |
|
||||
| `falco.stdoutOutput.enabled` | Enable stdout output for security notifications | `true` |
|
||||
| `falco.programOutput.enabled` | Enable program output for security notifications | `false` |
|
||||
| `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` |
|
||||
| `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` |
|
||||
| `customRules` | Third party rules enabled for Falco | `{}` |
|
||||
| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` |
|
||||
| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` |
|
||||
| `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` |
|
||||
| `integrations.natsOutput.enabled` | Enable NATS Output integration | `false` |
|
||||
| `integrations.natsOutput.natsUrl` | The NATS' URL where Falco is going to publish security alerts | `nats://nats.nats-io.svc.cluster.local:4222` |
|
||||
| `integrations.snsOutput.enabled` | Enable Amazon SNS Output integration | `false` |
|
||||
| `integrations.snsOutput.topic` | The SNS topic where Falco is going to publish security alerts | ` ` |
|
||||
| `integrations.snsOutput.aws_access_key_id` | The AWS Access Key Id credentials for access to SNS n | ` ` |
|
||||
| `integrations.snsOutput.aws_secret_access_key` | The AWS Secret Access Key credential to access to SNS | ` ` |
|
||||
| `integrations.snsOutput.aws_default_region` | The AWS region where SNS is deployed | ` ` |
|
||||
| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` |
|
||||
| Parameter | Description | Default |
|
||||
| --- | --- | --- |
|
||||
| `image.registry` | The image registry to pull from | `docker.io` |
|
||||
| `image.repository` | The image repository to pull from | `falcosecurity/falco` |
|
||||
| `image.tag` | The image tag to pull | `0.14.0` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `resources.requests.cpu` | CPU requested for being run in a node | `100m` |
|
||||
| `resources.requests.memory` | Memory requested for being run in a node | `512Mi` |
|
||||
| `resources.limits.cpu` | CPU limit | `200m` |
|
||||
| `resources.limits.memory` | Memory limit | `1024Mi` |
|
||||
| `extraArgs` | Specify additional container args | `[]` |
|
||||
| `rbac.create` | If true, create & use RBAC resources | `true` |
|
||||
| `serviceAccount.create` | Create serviceAccount | `true` |
|
||||
| `serviceAccount.name` | Use this value as serviceAccountName | ` ` |
|
||||
| `fakeEventGenerator.enabled` | Run falco-event-generator for sample events | `false` |
|
||||
| `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` |
|
||||
| `daemonset.updateStrategy.type` | The updateStrategy for updating the daemonset | `RollingUpdate` |
|
||||
| `proxy.httpProxy` | Set the Proxy server if is behind a firewall | `` |
|
||||
| `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | `` |
|
||||
| `proxy.noProxy` | Set the Proxy server if is behind a firewall | `` |
|
||||
| `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false` |
|
||||
| `ebpf.settings.hostNetwork` | Needed to enable eBPF JIT at runtime for performance reasons | `true` |
|
||||
| `ebpf.settings.mountEtcVolume` | Needed to detect which kernel version are running in Google COS | `true` |
|
||||
| `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` |
|
||||
| `falco.jsonOutput` | Output events in json or text | `false` |
|
||||
| `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` |
|
||||
| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` |
|
||||
| `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` |
|
||||
| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` |
|
||||
| `falco.priority` | The minimum rule priority level to load and run | `debug` |
|
||||
| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` |
|
||||
| `falco.outputs.rate` | Number of tokens gained per second | `1` |
|
||||
| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` |
|
||||
| `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` |
|
||||
| `falco.fileOutput.enabled` | Enable file output for security notifications | `false` |
|
||||
| `falco.fileOutput.keepAlive` | Open file once or every time a new notification arrives | `false` |
|
||||
| `falco.fileOutput.filename` | The filename for logging notifications | `./events.txt` |
|
||||
| `falco.stdoutOutput.enabled` | Enable stdout output for security notifications | `true` |
|
||||
| `falco.programOutput.enabled` | Enable program output for security notifications | `false` |
|
||||
| `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` |
|
||||
| `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` |
|
||||
| `customRules` | Third party rules enabled for Falco | `{}` |
|
||||
| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` |
|
||||
| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` |
|
||||
| `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` |
|
||||
| `integrations.natsOutput.enabled` | Enable NATS Output integration | `false` |
|
||||
| `integrations.natsOutput.natsUrl` | The NATS' URL where Falco is going to publish security alerts | `nats://nats.nats-io.svc.cluster.local:4222` |
|
||||
| `integrations.pubsubOutput.credentials_data` | Contents retrieved from `cat $HOME/.config/gcloud/legacy_credentials/<email>/adc.json | jq -c .` | ` ` |
|
||||
| `integrations.pubsubOutput.enabled` | Enable GCloud PubSub Output Integration | `false` |
|
||||
| `integrations.pubsubOutput.project_id` | GCloud Project ID where the Pub/Sub will be created | ` ` |
|
||||
| `integrations.snsOutput.enabled` | Enable Amazon SNS Output integration | `false` |
|
||||
| `integrations.snsOutput.topic` | The SNS topic where Falco is going to publish security alerts | ` ` |
|
||||
| `integrations.snsOutput.aws_access_key_id` | The AWS Access Key Id credentials for access to SNS n | ` ` |
|
||||
| `integrations.snsOutput.aws_secret_access_key` | The AWS Secret Access Key credential to access to SNS | ` ` |
|
||||
| `integrations.snsOutput.aws_default_region` | The AWS region where SNS is deployed | ` ` |
|
||||
| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` |
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
|
||||
@@ -27,7 +27,7 @@ data:
|
||||
{{- end }}
|
||||
|
||||
# Whether to output events in json or text
|
||||
{{- if (or .Values.integrations.gcscc.enabled .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }}
|
||||
{{- if (or .Values.integrations.gcscc.enabled .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
|
||||
json_output: true
|
||||
{{- else }}
|
||||
json_output: {{ .Values.falco.jsonOutput }}
|
||||
@@ -37,7 +37,7 @@ data:
|
||||
# itself (e.g. "File below a known binary directory opened for writing
|
||||
# (user=root ....") in the json output.
|
||||
|
||||
{{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }}
|
||||
{{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
|
||||
json_include_output_property: true
|
||||
{{- else }}
|
||||
json_include_output_property: {{ .Values.falco.jsonIncludeOutputProperty }}
|
||||
@@ -93,7 +93,7 @@ data:
|
||||
# Also, the file will be closed and reopened if falco is signaled with
|
||||
# SIGUSR1.
|
||||
|
||||
{{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }}
|
||||
{{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
|
||||
file_output:
|
||||
enabled: true
|
||||
keep_alive: true
|
||||
|
||||
@@ -87,7 +87,7 @@ spec:
|
||||
- mountPath: /etc/falco/rules.d
|
||||
name: rules-volume
|
||||
{{- end }}
|
||||
{{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }}
|
||||
{{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
|
||||
- mountPath: /var/run/falco/
|
||||
name: shared-pipe
|
||||
readOnly: false
|
||||
@@ -126,7 +126,27 @@ spec:
|
||||
name: {{ template "falco.fullname" . }}
|
||||
key: aws_default_region
|
||||
{{- end }}
|
||||
{{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }}
|
||||
{{- if .Values.integrations.pubsubOutput.enabled }}
|
||||
- name: {{ .Chart.Name }}-pubsub
|
||||
image: sysdiglabs/falco-pubsub:latest
|
||||
imagePullPolicy: Always
|
||||
args: [ "/bin/falco-pubsub", "-t", {{ .Values.integrations.pubsubOutput.topic | quote }}]
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/falco/
|
||||
name: shared-pipe
|
||||
env:
|
||||
- name: GOOGLE_PROJECT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "falco.fullname" . }}
|
||||
key: gcp-project-id
|
||||
- name: GOOGLE_CREDENTIALS_DATA
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "falco.fullname" . }}
|
||||
key: gcp-credentials-data
|
||||
{{- end }}
|
||||
{{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
|
||||
initContainers:
|
||||
- name: init-pipe
|
||||
image: busybox
|
||||
@@ -178,7 +198,7 @@ spec:
|
||||
configMap:
|
||||
name: {{ template "falco.fullname" . }}-rules
|
||||
{{- end }}
|
||||
{{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }}
|
||||
{{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
|
||||
- name: shared-pipe
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
{{- if .Values.integrations.snsOutput.enabled }}
|
||||
{{- if (or .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
@@ -10,6 +11,14 @@ metadata:
|
||||
heritage: "{{ .Release.Service }}"
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if .Values.integrations.snsOutput.enabled }}
|
||||
aws_access_key_id: {{ .Values.integrations.snsOutput.aws_access_key_id | b64enc | quote }}
|
||||
aws_secret_access_key: {{ .Values.integrations.snsOutput.aws_secret_access_key | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.integrations.pubsubOutput.enabled }}
|
||||
gcp-credentials-data: {{ .Values.integrations.pubsubOutput.credentialsData | toJson | b64enc | quote }}
|
||||
gcp-project-id: {{ .Values.integrations.pubsubOutput.projectID | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
|
||||
@@ -200,6 +200,22 @@ integrations:
|
||||
aws_secret_access_key: ""
|
||||
aws_default_region: ""
|
||||
|
||||
|
||||
# If GCloud Pub/Sub integration is enabled, falco will be configured to use this
|
||||
# integration as file_output and sets the following values:
|
||||
# * json_output: true
|
||||
# * json_include_output_property: true
|
||||
# * file_output:
|
||||
# enabled: true
|
||||
# keep_alive: true
|
||||
# filename: /var/run/falco/nats
|
||||
pubsubOutput:
|
||||
enabled: false
|
||||
topic: ""
|
||||
credentialsData: ""
|
||||
projectID: ""
|
||||
|
||||
|
||||
# Allow falco to run on Kubernetes 1.6 masters.
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
|
||||
Reference in New Issue
Block a user