diff --git a/stable/falco/CHANGELOG.md b/stable/falco/CHANGELOG.md index 70d073c581..56006dc7e9 100644 --- a/stable/falco/CHANGELOG.md +++ b/stable/falco/CHANGELOG.md @@ -3,12 +3,28 @@ This file documents all notable changes to Sysdig Falco Helm Chart. The release numbering uses [semantic versioning](http://semver.org). +## v0.9.1 + +### Minor Changes + +* Allow configuration using values for `time_format_iso8601` setting +* Allow configuration using values for `syscall_event_drops` setting +* Allow configuration using values for `http_output` setting +* Add CHANGELOG entry for v0.8.0, [not present on its PR](https://github.com/helm/charts/pull/14813#issuecomment-506821432) + ## v0.9.0 ### Major Changes * Add nestorsalceda as an approver +## v0.8.0 + +### Major Changes + +* Allow configuration of Pod Security Policy. This is needed to get Falco + running when the Admission Controller is enabled. + ## v0.7.10 ### Minor Changes diff --git a/stable/falco/Chart.yaml b/stable/falco/Chart.yaml index 1b15659261..ab5049f293 100644 --- a/stable/falco/Chart.yaml +++ b/stable/falco/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: falco -version: 0.9.0 +version: 0.9.1 appVersion: 0.15.3 description: Falco keywords: diff --git a/stable/falco/README.md b/stable/falco/README.md index 0ae6e0703f..ae4dca48ff 100644 --- a/stable/falco/README.md +++ b/stable/falco/README.md @@ -63,14 +63,15 @@ The following table lists the configurable parameters of the Falco chart and the | `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` | | `daemonset.updateStrategy.type` | The updateStrategy for updating the daemonset | `RollingUpdate` | | `podSecurityPolicy.create` | If true, create & use podSecurityPolicy | `false` | -| `proxy.httpProxy` | Set the Proxy server if is behind a firewall | `` | -| `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | `` | -| `proxy.noProxy` | Set the Proxy server if is behind a firewall | `` | -| `timezone` | Set the daemonset's timezone | `` | +| `proxy.httpProxy` | Set the Proxy server if is behind a firewall | ` ` | +| `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | ` ` | +| `proxy.noProxy` | Set the Proxy server if is behind a firewall | ` ` | +| `timezone` | Set the daemonset's timezone | ` ` | | `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false` | | `ebpf.settings.hostNetwork` | Needed to enable eBPF JIT at runtime for performance reasons | `true` | | `ebpf.settings.mountEtcVolume` | Needed to detect which kernel version are running in Google COS | `true` | | `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` | +| `falco.timeFormatISO8601` | Display times using ISO 8601 instead of local time zone | `false` | | `falco.jsonOutput` | Output events in json or text | `false` | | `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` | | `falco.logStderr` | Send Falco debugging information logs to stderr | `true` | @@ -78,6 +79,9 @@ The following table lists the configurable parameters of the Falco chart and the | `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` | | `falco.priority` | The minimum rule priority level to load and run | `debug` | | `falco.bufferedOutputs` | Use buffered outputs to channels | `false` | +| `falco.syscallEventDrops.actions` | Actions to be taken when system calls were dropped from the circular buffer | `[log, alert]` | +| `falco.syscallEventDrops.rate` | Rate at which log/alert messages are emitted | `.03333` | +| `falco.syscallEventDrops.maxBurst` | Max burst of messages emitted | `10` | | `falco.outputs.rate` | Number of tokens gained per second | `1` | | `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` | | `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` | @@ -88,6 +92,8 @@ The following table lists the configurable parameters of the Falco chart and the | `falco.programOutput.enabled` | Enable program output for security notifications | `false` | | `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` | | `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` | +| `falco.httpOutput.enabled` | Enable http output for security notifications | `false` | +| `falco.httpOutput.url` | Url to notify using the http output when a notification arrives | `http://some.url` | | `customRules` | Third party rules enabled for Falco | `{}` | | `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` | | `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` | diff --git a/stable/falco/templates/configmap.yaml b/stable/falco/templates/configmap.yaml index 4849eed728..da7697d91e 100644 --- a/stable/falco/templates/configmap.yaml +++ b/stable/falco/templates/configmap.yaml @@ -26,6 +26,11 @@ data: - {{ . }} {{- end }} + # If true, the times displayed in log messages and output messages + # will be in ISO 8601. By default, times are displayed in the local + # time zone, as governed by /etc/localtime. + time_format_iso_8601: {{ .Values.falco.timeFormatISO8601 }} + # Whether to output events in json or text {{- if (or .Values.integrations.gcscc.enabled .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }} json_output: true @@ -64,6 +69,26 @@ data: # buffered. Defaults to false buffered_outputs: {{ .Values.falco.bufferedOutputs }} + # Falco uses a shared buffer between the kernel and userspace to pass + # system call information. When falco detects that this buffer is + # full and system calls have been dropped, it can take one or more of + # the following actions: + # - "ignore": do nothing. If an empty list is provided, ignore is assumed. + # - "log": log a CRITICAL message noting that the buffer was full. + # - "alert": emit a falco alert noting that the buffer was full. + # - "exit": exit falco with a non-zero rc. + # + # The rate at which log/alert messages are emitted is governed by a + # token bucket. The rate corresponds to one message every 30 seconds + # with a burst of 10 messages. + syscall_event_drops: + actions: + {{- range .Values.falco.syscallEventDrops.actions }} + - {{ . }} + {{- end }} + rate: {{ .Values.falco.syscallEventDrops.rate }} + max_burst: {{ .Values.falco.syscallEventDrops.maxBurst }} + # A throttling mechanism implemented as a token bucket limits the # rate of falco notifications. This throttling is controlled by the following configuration # options: @@ -135,6 +160,10 @@ data: program: {{ .Values.falco.programOutput.program }} {{- end }} + http_output: + enabled: {{ .Values.falco.httpOutput.enabled }} + url: {{ .Values.falco.httpOutput.url }} + {{- if .Values.integrations.snsOutput.enabled }} aws_default_region: {{ .Values.integrations.snsOutput.aws_default_region }} {{- end }} diff --git a/stable/falco/values.yaml b/stable/falco/values.yaml index 2dce33c221..2fb815015b 100644 --- a/stable/falco/values.yaml +++ b/stable/falco/values.yaml @@ -82,6 +82,11 @@ falco: - /etc/falco/falco_rules.local.yaml - /etc/falco/rules.d + # If true, the times displayed in log messages and output messages + # will be in ISO 8601. By default, times are displayed in the local + # time zone, as governed by /etc/localtime. + timeFormatISO8601: false + # Whether to output events in json or text jsonOutput: false @@ -111,6 +116,25 @@ falco: # buffered. bufferedOutputs: false + # Falco uses a shared buffer between the kernel and userspace to pass + # system call information. When falco detects that this buffer is + # full and system calls have been dropped, it can take one or more of + # the following actions: + # - "ignore": do nothing. If an empty list is provided, ignore is assumed. + # - "log": log a CRITICAL message noting that the buffer was full. + # - "alert": emit a falco alert noting that the buffer was full. + # - "exit": exit falco with a non-zero rc. + # + # The rate at which log/alert messages are emitted is governed by a + # token bucket. The rate corresponds to one message every 30 seconds + # with a burst of 10 messages. + syscallEventDrops: + actions: + - log + - alert + rate: .03333 + maxBurst: 10 + # A throttling mechanism implemented as a token bucket limits the # rate of falco notifications. This throttling is controlled by the following configuration # options: @@ -166,6 +190,10 @@ falco: keepAlive: false program: mail -s "Falco Notification" someone@example.com + httpOutput: + enabled: false + url: http://some.url + customRules: {} # Although Falco comes with a nice default rule set for detecting weird # behavior in containers, our users are going to customize the run-time