diff --git a/stable/falco/CHANGELOG.md b/stable/falco/CHANGELOG.md index 085d3e18fb..5ab2189ccf 100644 --- a/stable/falco/CHANGELOG.md +++ b/stable/falco/CHANGELOG.md @@ -3,6 +3,10 @@ This file documents all notable changes to Sysdig Falco Helm Chart. The release numbering uses [semantic versioning](http://semver.org). +## v0.7.1 + +* Add Google Pub/Sub Output integration + ## v0.7.0 ### Major Changes diff --git a/stable/falco/Chart.yaml b/stable/falco/Chart.yaml index 2cb1da65ab..6ee2f2c73a 100644 --- a/stable/falco/Chart.yaml +++ b/stable/falco/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: falco -version: 0.7.0 +version: 0.7.1 appVersion: 0.14.0 description: Sysdig Falco keywords: diff --git a/stable/falco/README.md b/stable/falco/README.md index b2336872d6..e66e1e4018 100644 --- a/stable/falco/README.md +++ b/stable/falco/README.md @@ -43,59 +43,62 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the Falco chart and their default values. -| Parameter | Description | Default | -| --- | --- | --- | -| `image.registry` | The image registry to pull from | `docker.io` | -| `image.repository` | The image repository to pull from | `falcosecurity/falco` | -| `image.tag` | The image tag to pull | `0.14.0` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `resources.requests.cpu` | CPU requested for being run in a node | `100m` | -| `resources.requests.memory` | Memory requested for being run in a node | `512Mi` | -| `resources.limits.cpu` | CPU limit | `200m` | -| `resources.limits.memory` | Memory limit | `1024Mi` | -| `extraArgs` | Specify additional container args | `[]` | -| `rbac.create` | If true, create & use RBAC resources | `true` | -| `serviceAccount.create` | Create serviceAccount | `true` | -| `serviceAccount.name` | Use this value as serviceAccountName | ` ` | -| `fakeEventGenerator.enabled` | Run falco-event-generator for sample events | `false` | -| `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` | -| `daemonset.updateStrategy.type` | The updateStrategy for updating the daemonset | `RollingUpdate` | -| `proxy.httpProxy` | Set the Proxy server if is behind a firewall | `` | -| `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | `` | -| `proxy.noProxy` | Set the Proxy server if is behind a firewall | `` | -| `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false` | -| `ebpf.settings.hostNetwork` | Needed to enable eBPF JIT at runtime for performance reasons | `true` | -| `ebpf.settings.mountEtcVolume` | Needed to detect which kernel version are running in Google COS | `true` | -| `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` | -| `falco.jsonOutput` | Output events in json or text | `false` | -| `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` | -| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` | -| `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` | -| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` | -| `falco.priority` | The minimum rule priority level to load and run | `debug` | -| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` | -| `falco.outputs.rate` | Number of tokens gained per second | `1` | -| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` | -| `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` | -| `falco.fileOutput.enabled` | Enable file output for security notifications | `false` | -| `falco.fileOutput.keepAlive` | Open file once or every time a new notification arrives | `false` | -| `falco.fileOutput.filename` | The filename for logging notifications | `./events.txt` | -| `falco.stdoutOutput.enabled` | Enable stdout output for security notifications | `true` | -| `falco.programOutput.enabled` | Enable program output for security notifications | `false` | -| `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` | -| `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` | -| `customRules` | Third party rules enabled for Falco | `{}` | -| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` | -| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` | -| `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` | -| `integrations.natsOutput.enabled` | Enable NATS Output integration | `false` | -| `integrations.natsOutput.natsUrl` | The NATS' URL where Falco is going to publish security alerts | `nats://nats.nats-io.svc.cluster.local:4222` | -| `integrations.snsOutput.enabled` | Enable Amazon SNS Output integration | `false` | -| `integrations.snsOutput.topic` | The SNS topic where Falco is going to publish security alerts | ` ` | -| `integrations.snsOutput.aws_access_key_id` | The AWS Access Key Id credentials for access to SNS n | ` ` | -| `integrations.snsOutput.aws_secret_access_key` | The AWS Secret Access Key credential to access to SNS | ` ` | -| `integrations.snsOutput.aws_default_region` | The AWS region where SNS is deployed | ` ` | -| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` | +| Parameter | Description | Default | +| --- | --- | --- | +| `image.registry` | The image registry to pull from | `docker.io` | +| `image.repository` | The image repository to pull from | `falcosecurity/falco` | +| `image.tag` | The image tag to pull | `0.14.0` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `resources.requests.cpu` | CPU requested for being run in a node | `100m` | +| `resources.requests.memory` | Memory requested for being run in a node | `512Mi` | +| `resources.limits.cpu` | CPU limit | `200m` | +| `resources.limits.memory` | Memory limit | `1024Mi` | +| `extraArgs` | Specify additional container args | `[]` | +| `rbac.create` | If true, create & use RBAC resources | `true` | +| `serviceAccount.create` | Create serviceAccount | `true` | +| `serviceAccount.name` | Use this value as serviceAccountName | ` ` | +| `fakeEventGenerator.enabled` | Run falco-event-generator for sample events | `false` | +| `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` | +| `daemonset.updateStrategy.type` | The updateStrategy for updating the daemonset | `RollingUpdate` | +| `proxy.httpProxy` | Set the Proxy server if is behind a firewall | `` | +| `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | `` | +| `proxy.noProxy` | Set the Proxy server if is behind a firewall | `` | +| `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false` | +| `ebpf.settings.hostNetwork` | Needed to enable eBPF JIT at runtime for performance reasons | `true` | +| `ebpf.settings.mountEtcVolume` | Needed to detect which kernel version are running in Google COS | `true` | +| `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` | +| `falco.jsonOutput` | Output events in json or text | `false` | +| `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` | +| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` | +| `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` | +| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` | +| `falco.priority` | The minimum rule priority level to load and run | `debug` | +| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` | +| `falco.outputs.rate` | Number of tokens gained per second | `1` | +| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` | +| `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` | +| `falco.fileOutput.enabled` | Enable file output for security notifications | `false` | +| `falco.fileOutput.keepAlive` | Open file once or every time a new notification arrives | `false` | +| `falco.fileOutput.filename` | The filename for logging notifications | `./events.txt` | +| `falco.stdoutOutput.enabled` | Enable stdout output for security notifications | `true` | +| `falco.programOutput.enabled` | Enable program output for security notifications | `false` | +| `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` | +| `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` | +| `customRules` | Third party rules enabled for Falco | `{}` | +| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` | +| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` | +| `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` | +| `integrations.natsOutput.enabled` | Enable NATS Output integration | `false` | +| `integrations.natsOutput.natsUrl` | The NATS' URL where Falco is going to publish security alerts | `nats://nats.nats-io.svc.cluster.local:4222` | +| `integrations.pubsubOutput.credentials_data` | Contents retrieved from `cat $HOME/.config/gcloud/legacy_credentials//adc.json | jq -c .` | ` ` | +| `integrations.pubsubOutput.enabled` | Enable GCloud PubSub Output Integration | `false` | +| `integrations.pubsubOutput.project_id` | GCloud Project ID where the Pub/Sub will be created | ` ` | +| `integrations.snsOutput.enabled` | Enable Amazon SNS Output integration | `false` | +| `integrations.snsOutput.topic` | The SNS topic where Falco is going to publish security alerts | ` ` | +| `integrations.snsOutput.aws_access_key_id` | The AWS Access Key Id credentials for access to SNS n | ` ` | +| `integrations.snsOutput.aws_secret_access_key` | The AWS Secret Access Key credential to access to SNS | ` ` | +| `integrations.snsOutput.aws_default_region` | The AWS region where SNS is deployed | ` ` | +| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/stable/falco/templates/configmap.yaml b/stable/falco/templates/configmap.yaml index 60732f44eb..9eb2119ee1 100644 --- a/stable/falco/templates/configmap.yaml +++ b/stable/falco/templates/configmap.yaml @@ -27,7 +27,7 @@ data: {{- end }} # Whether to output events in json or text - {{- if (or .Values.integrations.gcscc.enabled .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }} + {{- if (or .Values.integrations.gcscc.enabled .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }} json_output: true {{- else }} json_output: {{ .Values.falco.jsonOutput }} @@ -37,7 +37,7 @@ data: # itself (e.g. "File below a known binary directory opened for writing # (user=root ....") in the json output. - {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }} + {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }} json_include_output_property: true {{- else }} json_include_output_property: {{ .Values.falco.jsonIncludeOutputProperty }} @@ -93,7 +93,7 @@ data: # Also, the file will be closed and reopened if falco is signaled with # SIGUSR1. - {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }} + {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }} file_output: enabled: true keep_alive: true diff --git a/stable/falco/templates/daemonset.yaml b/stable/falco/templates/daemonset.yaml index 4b10de4142..81950ac4cc 100644 --- a/stable/falco/templates/daemonset.yaml +++ b/stable/falco/templates/daemonset.yaml @@ -87,7 +87,7 @@ spec: - mountPath: /etc/falco/rules.d name: rules-volume {{- end }} - {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }} + {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }} - mountPath: /var/run/falco/ name: shared-pipe readOnly: false @@ -126,7 +126,27 @@ spec: name: {{ template "falco.fullname" . }} key: aws_default_region {{- end }} - {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }} + {{- if .Values.integrations.pubsubOutput.enabled }} + - name: {{ .Chart.Name }}-pubsub + image: sysdiglabs/falco-pubsub:latest + imagePullPolicy: Always + args: [ "/bin/falco-pubsub", "-t", {{ .Values.integrations.pubsubOutput.topic | quote }}] + volumeMounts: + - mountPath: /var/run/falco/ + name: shared-pipe + env: + - name: GOOGLE_PROJECT_ID + valueFrom: + secretKeyRef: + name: {{ template "falco.fullname" . }} + key: gcp-project-id + - name: GOOGLE_CREDENTIALS_DATA + valueFrom: + secretKeyRef: + name: {{ template "falco.fullname" . }} + key: gcp-credentials-data + {{- end }} + {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }} initContainers: - name: init-pipe image: busybox @@ -178,7 +198,7 @@ spec: configMap: name: {{ template "falco.fullname" . }}-rules {{- end }} - {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled) }} + {{- if (or .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }} - name: shared-pipe emptyDir: {} {{- end }} diff --git a/stable/falco/templates/secret.yaml b/stable/falco/templates/secret.yaml index 44d0fe4dfd..5b315cb562 100644 --- a/stable/falco/templates/secret.yaml +++ b/stable/falco/templates/secret.yaml @@ -1,4 +1,5 @@ -{{- if .Values.integrations.snsOutput.enabled }} +{{- if (or .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }} +--- apiVersion: v1 kind: Secret metadata: @@ -10,6 +11,14 @@ metadata: heritage: "{{ .Release.Service }}" type: Opaque data: +{{- if .Values.integrations.snsOutput.enabled }} aws_access_key_id: {{ .Values.integrations.snsOutput.aws_access_key_id | b64enc | quote }} aws_secret_access_key: {{ .Values.integrations.snsOutput.aws_secret_access_key | b64enc | quote }} {{- end }} +{{- if .Values.integrations.pubsubOutput.enabled }} + gcp-credentials-data: {{ .Values.integrations.pubsubOutput.credentialsData | toJson | b64enc | quote }} + gcp-project-id: {{ .Values.integrations.pubsubOutput.projectID | b64enc | quote }} +{{- end }} +{{- end }} + + diff --git a/stable/falco/values.yaml b/stable/falco/values.yaml index b334ac9e10..2ffec0b760 100644 --- a/stable/falco/values.yaml +++ b/stable/falco/values.yaml @@ -200,6 +200,22 @@ integrations: aws_secret_access_key: "" aws_default_region: "" + + # If GCloud Pub/Sub integration is enabled, falco will be configured to use this + # integration as file_output and sets the following values: + # * json_output: true + # * json_include_output_property: true + # * file_output: + # enabled: true + # keep_alive: true + # filename: /var/run/falco/nats + pubsubOutput: + enabled: false + topic: "" + credentialsData: "" + projectID: "" + + # Allow falco to run on Kubernetes 1.6 masters. tolerations: - effect: NoSchedule