mirror of
https://github.com/helm/charts.git
synced 2026-08-23 14:27:18 +00:00
[stable/falco] Add support for more options for falco.yaml: syscall_event_drops, time_format_iso8601 and httpOutput (#15361)
* [stable/falco] Add a parameter to use ISO8601 formatted dates If true, the times displayed in log messages and output messages will be in ISO 8601. By default, times are displayed in the local time zone, as governed by /etc/localtime. Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * [stable/falco] Allow configuration for `syscall_event_drops` in falco.yaml Falco uses a shared buffer between the kernel and userspace to pass system call information. When falco detects that this buffer is full and system calls have been dropped, it can take one or more of the following actions: - "ignore": do nothing. If an empty list is provided, ignore is assumed. - "log": log a CRITICAL message noting that the buffer was full. - "alert": emit a falco alert noting that the buffer was full. - "exit": exit falco with a non-zero rc. The rate at which log/alert messages are emitted is governed by a token bucket. The rate corresponds to one message every 30 seconds with a burst of 10 messages. Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * [stable/falco] Enable httpOutput section from the configmap Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * [stable/falco] Add CHANGELOG entry for 0.8.0 This was not done in [its own PR](https://github.com/helm/charts/pull/14813#issuecomment-506821432) Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * [stable/falco] Bump version and add CHANGELOG entries Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
This commit is contained in:
Néstor Salceda
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
5a38f82abd
commit
c4f77eaefe
@@ -3,12 +3,28 @@
|
||||
This file documents all notable changes to Sysdig Falco Helm Chart. The release
|
||||
numbering uses [semantic versioning](http://semver.org).
|
||||
|
||||
## v0.9.1
|
||||
|
||||
### Minor Changes
|
||||
|
||||
* Allow configuration using values for `time_format_iso8601` setting
|
||||
* Allow configuration using values for `syscall_event_drops` setting
|
||||
* Allow configuration using values for `http_output` setting
|
||||
* Add CHANGELOG entry for v0.8.0, [not present on its PR](https://github.com/helm/charts/pull/14813#issuecomment-506821432)
|
||||
|
||||
## v0.9.0
|
||||
|
||||
### Major Changes
|
||||
|
||||
* Add nestorsalceda as an approver
|
||||
|
||||
## v0.8.0
|
||||
|
||||
### Major Changes
|
||||
|
||||
* Allow configuration of Pod Security Policy. This is needed to get Falco
|
||||
running when the Admission Controller is enabled.
|
||||
|
||||
## v0.7.10
|
||||
|
||||
### Minor Changes
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
name: falco
|
||||
version: 0.9.0
|
||||
version: 0.9.1
|
||||
appVersion: 0.15.3
|
||||
description: Falco
|
||||
keywords:
|
||||
|
||||
+10
-4
@@ -63,14 +63,15 @@ The following table lists the configurable parameters of the Falco chart and the
|
||||
| `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` |
|
||||
| `daemonset.updateStrategy.type` | The updateStrategy for updating the daemonset | `RollingUpdate` |
|
||||
| `podSecurityPolicy.create` | If true, create & use podSecurityPolicy | `false` |
|
||||
| `proxy.httpProxy` | Set the Proxy server if is behind a firewall | `` |
|
||||
| `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | `` |
|
||||
| `proxy.noProxy` | Set the Proxy server if is behind a firewall | `` |
|
||||
| `timezone` | Set the daemonset's timezone | `` |
|
||||
| `proxy.httpProxy` | Set the Proxy server if is behind a firewall | ` ` |
|
||||
| `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | ` ` |
|
||||
| `proxy.noProxy` | Set the Proxy server if is behind a firewall | ` ` |
|
||||
| `timezone` | Set the daemonset's timezone | ` ` |
|
||||
| `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false` |
|
||||
| `ebpf.settings.hostNetwork` | Needed to enable eBPF JIT at runtime for performance reasons | `true` |
|
||||
| `ebpf.settings.mountEtcVolume` | Needed to detect which kernel version are running in Google COS | `true` |
|
||||
| `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` |
|
||||
| `falco.timeFormatISO8601` | Display times using ISO 8601 instead of local time zone | `false` |
|
||||
| `falco.jsonOutput` | Output events in json or text | `false` |
|
||||
| `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` |
|
||||
| `falco.logStderr` | Send Falco debugging information logs to stderr | `true` |
|
||||
@@ -78,6 +79,9 @@ The following table lists the configurable parameters of the Falco chart and the
|
||||
| `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` |
|
||||
| `falco.priority` | The minimum rule priority level to load and run | `debug` |
|
||||
| `falco.bufferedOutputs` | Use buffered outputs to channels | `false` |
|
||||
| `falco.syscallEventDrops.actions` | Actions to be taken when system calls were dropped from the circular buffer | `[log, alert]` |
|
||||
| `falco.syscallEventDrops.rate` | Rate at which log/alert messages are emitted | `.03333` |
|
||||
| `falco.syscallEventDrops.maxBurst` | Max burst of messages emitted | `10` |
|
||||
| `falco.outputs.rate` | Number of tokens gained per second | `1` |
|
||||
| `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` |
|
||||
| `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` |
|
||||
@@ -88,6 +92,8 @@ The following table lists the configurable parameters of the Falco chart and the
|
||||
| `falco.programOutput.enabled` | Enable program output for security notifications | `false` |
|
||||
| `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` |
|
||||
| `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` |
|
||||
| `falco.httpOutput.enabled` | Enable http output for security notifications | `false` |
|
||||
| `falco.httpOutput.url` | Url to notify using the http output when a notification arrives | `http://some.url` |
|
||||
| `customRules` | Third party rules enabled for Falco | `{}` |
|
||||
| `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` |
|
||||
| `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` |
|
||||
|
||||
@@ -26,6 +26,11 @@ data:
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
|
||||
# If true, the times displayed in log messages and output messages
|
||||
# will be in ISO 8601. By default, times are displayed in the local
|
||||
# time zone, as governed by /etc/localtime.
|
||||
time_format_iso_8601: {{ .Values.falco.timeFormatISO8601 }}
|
||||
|
||||
# Whether to output events in json or text
|
||||
{{- if (or .Values.integrations.gcscc.enabled .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }}
|
||||
json_output: true
|
||||
@@ -64,6 +69,26 @@ data:
|
||||
# buffered. Defaults to false
|
||||
buffered_outputs: {{ .Values.falco.bufferedOutputs }}
|
||||
|
||||
# Falco uses a shared buffer between the kernel and userspace to pass
|
||||
# system call information. When falco detects that this buffer is
|
||||
# full and system calls have been dropped, it can take one or more of
|
||||
# the following actions:
|
||||
# - "ignore": do nothing. If an empty list is provided, ignore is assumed.
|
||||
# - "log": log a CRITICAL message noting that the buffer was full.
|
||||
# - "alert": emit a falco alert noting that the buffer was full.
|
||||
# - "exit": exit falco with a non-zero rc.
|
||||
#
|
||||
# The rate at which log/alert messages are emitted is governed by a
|
||||
# token bucket. The rate corresponds to one message every 30 seconds
|
||||
# with a burst of 10 messages.
|
||||
syscall_event_drops:
|
||||
actions:
|
||||
{{- range .Values.falco.syscallEventDrops.actions }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
rate: {{ .Values.falco.syscallEventDrops.rate }}
|
||||
max_burst: {{ .Values.falco.syscallEventDrops.maxBurst }}
|
||||
|
||||
# A throttling mechanism implemented as a token bucket limits the
|
||||
# rate of falco notifications. This throttling is controlled by the following configuration
|
||||
# options:
|
||||
@@ -135,6 +160,10 @@ data:
|
||||
program: {{ .Values.falco.programOutput.program }}
|
||||
{{- end }}
|
||||
|
||||
http_output:
|
||||
enabled: {{ .Values.falco.httpOutput.enabled }}
|
||||
url: {{ .Values.falco.httpOutput.url }}
|
||||
|
||||
{{- if .Values.integrations.snsOutput.enabled }}
|
||||
aws_default_region: {{ .Values.integrations.snsOutput.aws_default_region }}
|
||||
{{- end }}
|
||||
|
||||
@@ -82,6 +82,11 @@ falco:
|
||||
- /etc/falco/falco_rules.local.yaml
|
||||
- /etc/falco/rules.d
|
||||
|
||||
# If true, the times displayed in log messages and output messages
|
||||
# will be in ISO 8601. By default, times are displayed in the local
|
||||
# time zone, as governed by /etc/localtime.
|
||||
timeFormatISO8601: false
|
||||
|
||||
# Whether to output events in json or text
|
||||
jsonOutput: false
|
||||
|
||||
@@ -111,6 +116,25 @@ falco:
|
||||
# buffered.
|
||||
bufferedOutputs: false
|
||||
|
||||
# Falco uses a shared buffer between the kernel and userspace to pass
|
||||
# system call information. When falco detects that this buffer is
|
||||
# full and system calls have been dropped, it can take one or more of
|
||||
# the following actions:
|
||||
# - "ignore": do nothing. If an empty list is provided, ignore is assumed.
|
||||
# - "log": log a CRITICAL message noting that the buffer was full.
|
||||
# - "alert": emit a falco alert noting that the buffer was full.
|
||||
# - "exit": exit falco with a non-zero rc.
|
||||
#
|
||||
# The rate at which log/alert messages are emitted is governed by a
|
||||
# token bucket. The rate corresponds to one message every 30 seconds
|
||||
# with a burst of 10 messages.
|
||||
syscallEventDrops:
|
||||
actions:
|
||||
- log
|
||||
- alert
|
||||
rate: .03333
|
||||
maxBurst: 10
|
||||
|
||||
# A throttling mechanism implemented as a token bucket limits the
|
||||
# rate of falco notifications. This throttling is controlled by the following configuration
|
||||
# options:
|
||||
@@ -166,6 +190,10 @@ falco:
|
||||
keepAlive: false
|
||||
program: mail -s "Falco Notification" someone@example.com
|
||||
|
||||
httpOutput:
|
||||
enabled: false
|
||||
url: http://some.url
|
||||
|
||||
customRules: {}
|
||||
# Although Falco comes with a nice default rule set for detecting weird
|
||||
# behavior in containers, our users are going to customize the run-time
|
||||
|
||||
Reference in New Issue
Block a user