mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[stable/falco] Enable eBPF support for Sysdig Falco helm chart (#7191)
* Add eBPF support for Falco in Helm Chart * Add a more fine grained settings for eBPF stuff
This commit is contained in:
Néstor Salceda
committed by
k8s-ci-robot
k8s-ci-robot
parent
abf3585f32
commit
6ef865b5bb
@@ -3,6 +3,13 @@
|
||||
This file documents all notable changes to Sysdig Falco Helm Chart. The release
|
||||
numbering uses [semantic versioning](http://semver.org).
|
||||
|
||||
## v0.3.0
|
||||
|
||||
### Major Changes
|
||||
|
||||
* Add eBPF support for Falco. Falco can now read events via an eBPF program
|
||||
loaded into the kernel instead of the `falco-probe` kernel module.
|
||||
|
||||
## v0.2.1
|
||||
|
||||
### Minor Changes
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
name: falco
|
||||
version: 0.2.1
|
||||
version: 0.3.0
|
||||
appVersion: 0.11.1
|
||||
description: Sysdig Falco
|
||||
keywords:
|
||||
|
||||
+39
-36
@@ -43,42 +43,45 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
|
||||
The following table lists the configurable parameters of the Falco chart and their default values.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| --- | --- | --- |
|
||||
| `image.repository` | The image repository to pull from | `sysdig/falco` |
|
||||
| `image.tag` | The image tag to pull | `latest` |
|
||||
| `image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `resources` | Specify container resources | `{}` |
|
||||
| `rbac.create` | If true, create & use RBAC resources | `true` |
|
||||
| `serviceAccount.create` | Create serviceAccount | `true` |
|
||||
| `serviceAccount.name` | Use this value as serviceAccountName | ` ` |
|
||||
| `fakeEventGenerator.enabled` | Run falco-event-generator for sample events | `false` |
|
||||
| `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` |
|
||||
| `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` |
|
||||
| `falco.jsonOutput` | Output events in json or text | `false` |
|
||||
| `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` |
|
||||
| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` |
|
||||
| `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` |
|
||||
| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` |
|
||||
| `falco.priority` | The minimum rule priority level to load and run | `debug` |
|
||||
| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` |
|
||||
| `falco.outputs.rate` | Number of tokens gained per second | `1` |
|
||||
| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` |
|
||||
| `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` |
|
||||
| `falco.fileOutput.enabled` | Enable file output for security notifications | `false` |
|
||||
| `falco.fileOutput.keepAlive` | Open file once or every time a new notification arrives | `false` |
|
||||
| `falco.fileOutput.filename` | The filename for logging notifications | `./events.txt` |
|
||||
| `falco.stdoutOutput.enabled` | Enable stdout output for security notifications | `true` |
|
||||
| `falco.programOutput.enabled` | Enable program output for security notifications | `false` |
|
||||
| `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` |
|
||||
| `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` |
|
||||
| `customRules` | Third party rules enabled for Falco | `{}` |
|
||||
| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` |
|
||||
| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` |
|
||||
| `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` |
|
||||
| `integrations.natsOutput.enabled` | Enable NATS Output integration | `false` |
|
||||
| `integrations.natsOutput.natsUrl` | The NATS' URL where Falco is going to publish security alerts | `nats://nats.nats-io.svc.cluster.local:4222` |
|
||||
| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` |
|
||||
| Parameter | Description | Default |
|
||||
| --- | --- | --- |
|
||||
| `image.repository` | The image repository to pull from | `sysdig/falco` |
|
||||
| `image.tag` | The image tag to pull | `latest` |
|
||||
| `image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `resources` | Specify container resources | `{}` |
|
||||
| `rbac.create` | If true, create & use RBAC resources | `true` |
|
||||
| `serviceAccount.create` | Create serviceAccount | `true` |
|
||||
| `serviceAccount.name` | Use this value as serviceAccountName | ` ` |
|
||||
| `fakeEventGenerator.enabled` | Run falco-event-generator for sample events | `false` |
|
||||
| `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` |
|
||||
| `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false` |
|
||||
| `ebpf.settings.hostNetwork` | Needed to enable eBPF JIT at runtime for performance reasons | `true` |
|
||||
| `ebpf.settings.mountEtcVolume` | Needed to detect which kernel version are running in Google COS | `true` |
|
||||
| `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` |
|
||||
| `falco.jsonOutput` | Output events in json or text | `false` |
|
||||
| `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` |
|
||||
| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` |
|
||||
| `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` |
|
||||
| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` |
|
||||
| `falco.priority` | The minimum rule priority level to load and run | `debug` |
|
||||
| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` |
|
||||
| `falco.outputs.rate` | Number of tokens gained per second | `1` |
|
||||
| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` |
|
||||
| `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` |
|
||||
| `falco.fileOutput.enabled` | Enable file output for security notifications | `false` |
|
||||
| `falco.fileOutput.keepAlive` | Open file once or every time a new notification arrives | `false` |
|
||||
| `falco.fileOutput.filename` | The filename for logging notifications | `./events.txt` |
|
||||
| `falco.stdoutOutput.enabled` | Enable stdout output for security notifications | `true` |
|
||||
| `falco.programOutput.enabled` | Enable program output for security notifications | `false` |
|
||||
| `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` |
|
||||
| `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` |
|
||||
| `customRules` | Third party rules enabled for Falco | `{}` |
|
||||
| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` |
|
||||
| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` |
|
||||
| `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` |
|
||||
| `integrations.natsOutput.enabled` | Enable NATS Output integration | `false` |
|
||||
| `integrations.natsOutput.natsUrl` | The NATS' URL where Falco is going to publish security alerts | `nats://nats.nats-io.svc.cluster.local:4222` |
|
||||
| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` |
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
|
||||
@@ -16,6 +16,9 @@ spec:
|
||||
role: security
|
||||
spec:
|
||||
serviceAccountName: {{ template "falco.serviceAccountName" .}}
|
||||
{{- if (and .Values.ebpf.enabled .Values.ebpf.settings.hostNetwork) }}
|
||||
hostNetwork: true
|
||||
{{- end }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
containers:
|
||||
@@ -27,6 +30,11 @@ spec:
|
||||
securityContext:
|
||||
privileged: true
|
||||
args: [ "/usr/bin/falco", "-K", "/var/run/secrets/kubernetes.io/serviceaccount/token", "-k", "https://kubernetes.default", "-pk"]
|
||||
{{- if .Values.ebpf.enabled }}
|
||||
env:
|
||||
- name: SYSDIG_BPF_PROBE
|
||||
value:
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /host/var/run/docker.sock
|
||||
name: docker-socket
|
||||
@@ -44,6 +52,11 @@ spec:
|
||||
- mountPath: /host/usr
|
||||
name: usr-fs
|
||||
readOnly: true
|
||||
{{- if (and .Values.ebpf.enabled .Values.ebpf.settings.mountEtcVolume) }}
|
||||
- mountPath: /host/etc
|
||||
name: etc-fs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- mountPath: /etc/falco
|
||||
name: config-volume
|
||||
{{- if .Values.customRules }}
|
||||
@@ -94,6 +107,11 @@ spec:
|
||||
- name: usr-fs
|
||||
hostPath:
|
||||
path: /usr
|
||||
{{- if (and .Values.ebpf.enabled .Values.ebpf.settings.mountEtcVolume) }}
|
||||
- name: etc-fs
|
||||
hostPath:
|
||||
path: /etc
|
||||
{{- end }}
|
||||
- name: config-volume
|
||||
configMap:
|
||||
name: {{ template "falco.fullname" . }}
|
||||
|
||||
@@ -38,6 +38,18 @@ daemonset: {}
|
||||
# them as necessary, and remove the curly braces after 'resources:'.
|
||||
# updateStrategy: RollingUpdate
|
||||
|
||||
ebpf:
|
||||
# Enable eBPF support for Falco
|
||||
enabled: false
|
||||
|
||||
settings:
|
||||
# Needed to enable eBPF JIT at runtime for performance reasons.
|
||||
# Can be skipped if eBPF JIT is enabled from outside the container
|
||||
hostNetwork: true
|
||||
# Needed to correctly detect the kernel version for the eBPF program
|
||||
# Set to false if not running on Google COS
|
||||
mountEtcVolume: true
|
||||
|
||||
falco:
|
||||
# The location of the rules file(s). This can contain one or more paths to
|
||||
# separate rules files.
|
||||
|
||||
Reference in New Issue
Block a user