From 6ef865b5bbfc84cd78ff2c6451b5edb382a013dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=A9stor=20Salceda?= Date: Wed, 15 Aug 2018 12:58:00 +0200 Subject: [PATCH] [stable/falco] Enable eBPF support for Sysdig Falco helm chart (#7191) * Add eBPF support for Falco in Helm Chart * Add a more fine grained settings for eBPF stuff --- stable/falco/CHANGELOG.md | 7 +++ stable/falco/Chart.yaml | 2 +- stable/falco/README.md | 75 ++++++++++++++------------- stable/falco/templates/daemonset.yaml | 18 +++++++ stable/falco/values.yaml | 12 +++++ 5 files changed, 77 insertions(+), 37 deletions(-) diff --git a/stable/falco/CHANGELOG.md b/stable/falco/CHANGELOG.md index 826a8a1b1e..f1abbeae67 100644 --- a/stable/falco/CHANGELOG.md +++ b/stable/falco/CHANGELOG.md @@ -3,6 +3,13 @@ This file documents all notable changes to Sysdig Falco Helm Chart. The release numbering uses [semantic versioning](http://semver.org). +## v0.3.0 + +### Major Changes + +* Add eBPF support for Falco. Falco can now read events via an eBPF program + loaded into the kernel instead of the `falco-probe` kernel module. + ## v0.2.1 ### Minor Changes diff --git a/stable/falco/Chart.yaml b/stable/falco/Chart.yaml index d05142663d..b0c0a7b0eb 100644 --- a/stable/falco/Chart.yaml +++ b/stable/falco/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: falco -version: 0.2.1 +version: 0.3.0 appVersion: 0.11.1 description: Sysdig Falco keywords: diff --git a/stable/falco/README.md b/stable/falco/README.md index f888ea049c..fccda9192f 100644 --- a/stable/falco/README.md +++ b/stable/falco/README.md @@ -43,42 +43,45 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the Falco chart and their default values. -| Parameter | Description | Default | -| --- | --- | --- | -| `image.repository` | The image repository to pull from | `sysdig/falco` | -| `image.tag` | The image tag to pull | `latest` | -| `image.pullPolicy` | The image pull policy | `Always` | -| `resources` | Specify container resources | `{}` | -| `rbac.create` | If true, create & use RBAC resources | `true` | -| `serviceAccount.create` | Create serviceAccount | `true` | -| `serviceAccount.name` | Use this value as serviceAccountName | ` ` | -| `fakeEventGenerator.enabled` | Run falco-event-generator for sample events | `false` | -| `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` | -| `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` | -| `falco.jsonOutput` | Output events in json or text | `false` | -| `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` | -| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` | -| `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` | -| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` | -| `falco.priority` | The minimum rule priority level to load and run | `debug` | -| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` | -| `falco.outputs.rate` | Number of tokens gained per second | `1` | -| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` | -| `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` | -| `falco.fileOutput.enabled` | Enable file output for security notifications | `false` | -| `falco.fileOutput.keepAlive` | Open file once or every time a new notification arrives | `false` | -| `falco.fileOutput.filename` | The filename for logging notifications | `./events.txt` | -| `falco.stdoutOutput.enabled` | Enable stdout output for security notifications | `true` | -| `falco.programOutput.enabled` | Enable program output for security notifications | `false` | -| `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` | -| `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` | -| `customRules` | Third party rules enabled for Falco | `{}` | -| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` | -| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` | -| `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` | -| `integrations.natsOutput.enabled` | Enable NATS Output integration | `false` | -| `integrations.natsOutput.natsUrl` | The NATS' URL where Falco is going to publish security alerts | `nats://nats.nats-io.svc.cluster.local:4222` | -| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` | +| Parameter | Description | Default | +| --- | --- | --- | +| `image.repository` | The image repository to pull from | `sysdig/falco` | +| `image.tag` | The image tag to pull | `latest` | +| `image.pullPolicy` | The image pull policy | `Always` | +| `resources` | Specify container resources | `{}` | +| `rbac.create` | If true, create & use RBAC resources | `true` | +| `serviceAccount.create` | Create serviceAccount | `true` | +| `serviceAccount.name` | Use this value as serviceAccountName | ` ` | +| `fakeEventGenerator.enabled` | Run falco-event-generator for sample events | `false` | +| `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` | +| `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false` | +| `ebpf.settings.hostNetwork` | Needed to enable eBPF JIT at runtime for performance reasons | `true` | +| `ebpf.settings.mountEtcVolume` | Needed to detect which kernel version are running in Google COS | `true` | +| `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` | +| `falco.jsonOutput` | Output events in json or text | `false` | +| `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` | +| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` | +| `falco.logSyslog` | Send Falco debugging information logs to syslog | `true` | +| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` | +| `falco.priority` | The minimum rule priority level to load and run | `debug` | +| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` | +| `falco.outputs.rate` | Number of tokens gained per second | `1` | +| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` | +| `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` | +| `falco.fileOutput.enabled` | Enable file output for security notifications | `false` | +| `falco.fileOutput.keepAlive` | Open file once or every time a new notification arrives | `false` | +| `falco.fileOutput.filename` | The filename for logging notifications | `./events.txt` | +| `falco.stdoutOutput.enabled` | Enable stdout output for security notifications | `true` | +| `falco.programOutput.enabled` | Enable program output for security notifications | `false` | +| `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` | +| `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` | +| `customRules` | Third party rules enabled for Falco | `{}` | +| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` | +| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` | +| `integrations.gcscc.webhookAuthenticationToken` | Token used for authentication and webhook | `b27511f86e911f20b9e0f9c8104b4ec4` | +| `integrations.natsOutput.enabled` | Enable NATS Output integration | `false` | +| `integrations.natsOutput.natsUrl` | The NATS' URL where Falco is going to publish security alerts | `nats://nats.nats-io.svc.cluster.local:4222` | +| `tolerations` | The tolerations for scheduling | `node-role.kubernetes.io/master:NoSchedule` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/stable/falco/templates/daemonset.yaml b/stable/falco/templates/daemonset.yaml index 16e7dc5f7d..ca2f133d5d 100644 --- a/stable/falco/templates/daemonset.yaml +++ b/stable/falco/templates/daemonset.yaml @@ -16,6 +16,9 @@ spec: role: security spec: serviceAccountName: {{ template "falco.serviceAccountName" .}} + {{- if (and .Values.ebpf.enabled .Values.ebpf.settings.hostNetwork) }} + hostNetwork: true + {{- end }} tolerations: {{ toYaml .Values.tolerations | indent 8 }} containers: @@ -27,6 +30,11 @@ spec: securityContext: privileged: true args: [ "/usr/bin/falco", "-K", "/var/run/secrets/kubernetes.io/serviceaccount/token", "-k", "https://kubernetes.default", "-pk"] + {{- if .Values.ebpf.enabled }} + env: + - name: SYSDIG_BPF_PROBE + value: + {{- end }} volumeMounts: - mountPath: /host/var/run/docker.sock name: docker-socket @@ -44,6 +52,11 @@ spec: - mountPath: /host/usr name: usr-fs readOnly: true + {{- if (and .Values.ebpf.enabled .Values.ebpf.settings.mountEtcVolume) }} + - mountPath: /host/etc + name: etc-fs + readOnly: true + {{- end }} - mountPath: /etc/falco name: config-volume {{- if .Values.customRules }} @@ -94,6 +107,11 @@ spec: - name: usr-fs hostPath: path: /usr + {{- if (and .Values.ebpf.enabled .Values.ebpf.settings.mountEtcVolume) }} + - name: etc-fs + hostPath: + path: /etc + {{- end }} - name: config-volume configMap: name: {{ template "falco.fullname" . }} diff --git a/stable/falco/values.yaml b/stable/falco/values.yaml index f4f017c7c5..3ebc9f4602 100644 --- a/stable/falco/values.yaml +++ b/stable/falco/values.yaml @@ -38,6 +38,18 @@ daemonset: {} # them as necessary, and remove the curly braces after 'resources:'. # updateStrategy: RollingUpdate +ebpf: + # Enable eBPF support for Falco + enabled: false + + settings: + # Needed to enable eBPF JIT at runtime for performance reasons. + # Can be skipped if eBPF JIT is enabled from outside the container + hostNetwork: true + # Needed to correctly detect the kernel version for the eBPF program + # Set to false if not running on Google COS + mountEtcVolume: true + falco: # The location of the rules file(s). This can contain one or more paths to # separate rules files.