From c4f77eaefea2528591a4c72a2edc15b27ceca088 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=A9stor=20Salceda?= Date: Thu, 11 Jul 2019 12:16:55 +0200 Subject: [PATCH] [stable/falco] Add support for more options for `falco.yaml`: syscall_event_drops, time_format_iso8601 and httpOutput (#15361) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [stable/falco] Add a parameter to use ISO8601 formatted dates If true, the times displayed in log messages and output messages will be in ISO 8601. By default, times are displayed in the local time zone, as governed by /etc/localtime. Signed-off-by: Néstor Salceda * [stable/falco] Allow configuration for `syscall_event_drops` in falco.yaml Falco uses a shared buffer between the kernel and userspace to pass system call information. When falco detects that this buffer is full and system calls have been dropped, it can take one or more of the following actions: - "ignore": do nothing. If an empty list is provided, ignore is assumed. - "log": log a CRITICAL message noting that the buffer was full. - "alert": emit a falco alert noting that the buffer was full. - "exit": exit falco with a non-zero rc. The rate at which log/alert messages are emitted is governed by a token bucket. The rate corresponds to one message every 30 seconds with a burst of 10 messages. Signed-off-by: Néstor Salceda * [stable/falco] Enable httpOutput section from the configmap Signed-off-by: Néstor Salceda * [stable/falco] Add CHANGELOG entry for 0.8.0 This was not done in [its own PR](https://github.com/helm/charts/pull/14813#issuecomment-506821432) Signed-off-by: Néstor Salceda * [stable/falco] Bump version and add CHANGELOG entries Signed-off-by: Néstor Salceda --- stable/falco/CHANGELOG.md | 16 +++++++++++++++ stable/falco/Chart.yaml | 2 +- stable/falco/README.md | 14 +++++++++---- stable/falco/templates/configmap.yaml | 29 +++++++++++++++++++++++++++ stable/falco/values.yaml | 28 ++++++++++++++++++++++++++ 5 files changed, 84 insertions(+), 5 deletions(-) diff --git a/stable/falco/CHANGELOG.md b/stable/falco/CHANGELOG.md index 70d073c581..56006dc7e9 100644 --- a/stable/falco/CHANGELOG.md +++ b/stable/falco/CHANGELOG.md @@ -3,12 +3,28 @@ This file documents all notable changes to Sysdig Falco Helm Chart. The release numbering uses [semantic versioning](http://semver.org). +## v0.9.1 + +### Minor Changes + +* Allow configuration using values for `time_format_iso8601` setting +* Allow configuration using values for `syscall_event_drops` setting +* Allow configuration using values for `http_output` setting +* Add CHANGELOG entry for v0.8.0, [not present on its PR](https://github.com/helm/charts/pull/14813#issuecomment-506821432) + ## v0.9.0 ### Major Changes * Add nestorsalceda as an approver +## v0.8.0 + +### Major Changes + +* Allow configuration of Pod Security Policy. This is needed to get Falco + running when the Admission Controller is enabled. + ## v0.7.10 ### Minor Changes diff --git a/stable/falco/Chart.yaml b/stable/falco/Chart.yaml index 1b15659261..ab5049f293 100644 --- a/stable/falco/Chart.yaml +++ b/stable/falco/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: falco -version: 0.9.0 +version: 0.9.1 appVersion: 0.15.3 description: Falco keywords: diff --git a/stable/falco/README.md b/stable/falco/README.md index 0ae6e0703f..ae4dca48ff 100644 --- a/stable/falco/README.md +++ b/stable/falco/README.md @@ -63,14 +63,15 @@ The following table lists the configurable parameters of the Falco chart and the | `fakeEventGenerator.replicas` | How many replicas of falco-event-generator to run | `1` | | `daemonset.updateStrategy.type` | The updateStrategy for updating the daemonset | `RollingUpdate` | | `podSecurityPolicy.create` | If true, create & use podSecurityPolicy | `false` | -| `proxy.httpProxy` | Set the Proxy server if is behind a firewall | `` | -| `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | `` | -| `proxy.noProxy` | Set the Proxy server if is behind a firewall | `` | -| `timezone` | Set the daemonset's timezone | `` | +| `proxy.httpProxy` | Set the Proxy server if is behind a firewall | ` ` | +| `proxy.httpsProxy` | Set the Proxy server if is behind a firewall | ` ` | +| `proxy.noProxy` | Set the Proxy server if is behind a firewall | ` ` | +| `timezone` | Set the daemonset's timezone | ` ` | | `ebpf.enabled` | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false` | | `ebpf.settings.hostNetwork` | Needed to enable eBPF JIT at runtime for performance reasons | `true` | | `ebpf.settings.mountEtcVolume` | Needed to detect which kernel version are running in Google COS | `true` | | `falco.rulesFile` | The location of the rules files | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` | +| `falco.timeFormatISO8601` | Display times using ISO 8601 instead of local time zone | `false` | | `falco.jsonOutput` | Output events in json or text | `false` | | `falco.jsonIncludeOutputProperty` | Include output property in json output | `true` | | `falco.logStderr` | Send Falco debugging information logs to stderr | `true` | @@ -78,6 +79,9 @@ The following table lists the configurable parameters of the Falco chart and the | `falco.logLevel` | The minimum level of Falco debugging information to include in logs | `info` | | `falco.priority` | The minimum rule priority level to load and run | `debug` | | `falco.bufferedOutputs` | Use buffered outputs to channels | `false` | +| `falco.syscallEventDrops.actions` | Actions to be taken when system calls were dropped from the circular buffer | `[log, alert]` | +| `falco.syscallEventDrops.rate` | Rate at which log/alert messages are emitted | `.03333` | +| `falco.syscallEventDrops.maxBurst` | Max burst of messages emitted | `10` | | `falco.outputs.rate` | Number of tokens gained per second | `1` | | `falco.outputs.maxBurst` | Maximum number of tokens outstanding | `1000` | | `falco.syslogOutput.enabled` | Enable syslog output for security notifications | `true` | @@ -88,6 +92,8 @@ The following table lists the configurable parameters of the Falco chart and the | `falco.programOutput.enabled` | Enable program output for security notifications | `false` | | `falco.programOutput.keepAlive` | Start the program once or re-spawn when a notification arrives | `false` | | `falco.programOutput.program` | Command to execute for program output | `mail -s "Falco Notification" someone@example.com` | +| `falco.httpOutput.enabled` | Enable http output for security notifications | `false` | +| `falco.httpOutput.url` | Url to notify using the http output when a notification arrives | `http://some.url` | | `customRules` | Third party rules enabled for Falco | `{}` | | `integrations.gcscc.enabled` | Enable Google Cloud Security Command Center integration | `false` | | `integrations.gcscc.webhookUrl` | The URL where sysdig-gcscc-connector webhook is listening | `http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events` | diff --git a/stable/falco/templates/configmap.yaml b/stable/falco/templates/configmap.yaml index 4849eed728..da7697d91e 100644 --- a/stable/falco/templates/configmap.yaml +++ b/stable/falco/templates/configmap.yaml @@ -26,6 +26,11 @@ data: - {{ . }} {{- end }} + # If true, the times displayed in log messages and output messages + # will be in ISO 8601. By default, times are displayed in the local + # time zone, as governed by /etc/localtime. + time_format_iso_8601: {{ .Values.falco.timeFormatISO8601 }} + # Whether to output events in json or text {{- if (or .Values.integrations.gcscc.enabled .Values.integrations.natsOutput.enabled .Values.integrations.snsOutput.enabled .Values.integrations.pubsubOutput.enabled) }} json_output: true @@ -64,6 +69,26 @@ data: # buffered. Defaults to false buffered_outputs: {{ .Values.falco.bufferedOutputs }} + # Falco uses a shared buffer between the kernel and userspace to pass + # system call information. When falco detects that this buffer is + # full and system calls have been dropped, it can take one or more of + # the following actions: + # - "ignore": do nothing. If an empty list is provided, ignore is assumed. + # - "log": log a CRITICAL message noting that the buffer was full. + # - "alert": emit a falco alert noting that the buffer was full. + # - "exit": exit falco with a non-zero rc. + # + # The rate at which log/alert messages are emitted is governed by a + # token bucket. The rate corresponds to one message every 30 seconds + # with a burst of 10 messages. + syscall_event_drops: + actions: + {{- range .Values.falco.syscallEventDrops.actions }} + - {{ . }} + {{- end }} + rate: {{ .Values.falco.syscallEventDrops.rate }} + max_burst: {{ .Values.falco.syscallEventDrops.maxBurst }} + # A throttling mechanism implemented as a token bucket limits the # rate of falco notifications. This throttling is controlled by the following configuration # options: @@ -135,6 +160,10 @@ data: program: {{ .Values.falco.programOutput.program }} {{- end }} + http_output: + enabled: {{ .Values.falco.httpOutput.enabled }} + url: {{ .Values.falco.httpOutput.url }} + {{- if .Values.integrations.snsOutput.enabled }} aws_default_region: {{ .Values.integrations.snsOutput.aws_default_region }} {{- end }} diff --git a/stable/falco/values.yaml b/stable/falco/values.yaml index 2dce33c221..2fb815015b 100644 --- a/stable/falco/values.yaml +++ b/stable/falco/values.yaml @@ -82,6 +82,11 @@ falco: - /etc/falco/falco_rules.local.yaml - /etc/falco/rules.d + # If true, the times displayed in log messages and output messages + # will be in ISO 8601. By default, times are displayed in the local + # time zone, as governed by /etc/localtime. + timeFormatISO8601: false + # Whether to output events in json or text jsonOutput: false @@ -111,6 +116,25 @@ falco: # buffered. bufferedOutputs: false + # Falco uses a shared buffer between the kernel and userspace to pass + # system call information. When falco detects that this buffer is + # full and system calls have been dropped, it can take one or more of + # the following actions: + # - "ignore": do nothing. If an empty list is provided, ignore is assumed. + # - "log": log a CRITICAL message noting that the buffer was full. + # - "alert": emit a falco alert noting that the buffer was full. + # - "exit": exit falco with a non-zero rc. + # + # The rate at which log/alert messages are emitted is governed by a + # token bucket. The rate corresponds to one message every 30 seconds + # with a burst of 10 messages. + syscallEventDrops: + actions: + - log + - alert + rate: .03333 + maxBurst: 10 + # A throttling mechanism implemented as a token bucket limits the # rate of falco notifications. This throttling is controlled by the following configuration # options: @@ -166,6 +190,10 @@ falco: keepAlive: false program: mail -s "Falco Notification" someone@example.com + httpOutput: + enabled: false + url: http://some.url + customRules: {} # Although Falco comes with a nice default rule set for detecting weird # behavior in containers, our users are going to customize the run-time