The Falco community has decided to adopt the chart and has migrated the code and it's history [here](https://github.com/falcosecurity/charts).
So long, and thanks for all the fish.
Signed-off-by: Kris Nova <kris@nivenly.com>
* [stable/falco] Sync with falcosecurity/falco/integrations manifests
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Upgrade to latest Falco release 0.18.0
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Rename cri with containerD
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Separate AuditLog feature from webserver config
This also allows to deploy the Falco Service to analyze K8s audit events
without the need of deploying the AuditSink. It is more flexible.
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Prepare new chart release
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Remove clusterIP dependency when using AuditSink
We can rely on K8s DNS mechanism to send logs
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Remove clusterIP references from README
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
This basic support of priorityClassName should allow setting higher priority for falco than the default one. This is useful when we want to ensure falco runs on every node.
Signed-off-by: David Guerrero <david.guerrero@prezi.com>
* [stable/falco] Allow audit logging with Falco
You can enable it on minikube with the following command:
`helm install --name falco --set falco.webserver.enabled=true --set
falco.webserver.clusterIP=10.96.0.100 stable/falco`
The main problem is that minikube doesn't resolve the service from apiserver,
so that you need to specify the clusterIP.
https://github.com/falcosecurity/falco/blob/dev/examples/k8s_audit_config/README.md
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Apiserver don't resolve internal services
That would be a layering violation so we are going to rely only con
clusterIP and that parameter is required if we enable the webserver
features.
https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#url
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Document values and upgrade chart version
This is an 1.0.0 version, which means that Helm chart is feature
complete in terms of we provide same functionality that daemonset
provides.
It's time to celebrate!
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Add a section in README for explaining K8s audit event support
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Write the README in a more actionable way
Telling all the history about the Falco implementation of Audit Event
rules is a bit useless here. It can be found on the awesome Falco
documentation.
Here I would like to focus a bit more on chart users and show them how
to enable Falco with the audit events feature.
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Add instructions for choosing the clusterIP address
And another option for not recognized resource is that we were using a
K8s version previous to v1.13
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Add a parameter to use ISO8601 formatted dates
If true, the times displayed in log messages and output messages
will be in ISO 8601. By default, times are displayed in the local
time zone, as governed by /etc/localtime.
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Allow configuration for `syscall_event_drops` in falco.yaml
Falco uses a shared buffer between the kernel and userspace to pass
system call information. When falco detects that this buffer is
full and system calls have been dropped, it can take one or more of
the following actions:
- "ignore": do nothing. If an empty list is provided, ignore is assumed.
- "log": log a CRITICAL message noting that the buffer was full.
- "alert": emit a falco alert noting that the buffer was full.
- "exit": exit falco with a non-zero rc.
The rate at which log/alert messages are emitted is governed by a
token bucket. The rate corresponds to one message every 30 seconds
with a burst of 10 messages.
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Enable httpOutput section from the configmap
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Add CHANGELOG entry for 0.8.0
This was not done in [its own PR](https://github.com/helm/charts/pull/14813#issuecomment-506821432)
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] Bump version and add CHANGELOG entries
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* [stable/falco] make the container runtime socket configurable
Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
* [stable/falco]: update to falco 0.15.0 with cri-o and containerd support
Signed-off-by: Lorenzo Fontana <lo@linux.com>
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
* [stable/falco]: update changelog
Signed-off-by: Lorenzo Fontana <lo@linux.com>
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
* [stable/falco]: bump chart release to 0.7.6
Signed-off-by: Lorenzo Fontana <lo@linux.com>
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
* [stable/falco] Add GCloud PubSub integration
* Add GCloud PubSub integration
This allows Falco to publish alerts to a PubSub topic
Signed-off-by: Federico Barcelona <fede_rico_94@hotmail.com>
* [stable/falco] Fix values to follow naming conventions
Signed-off-by: Federico Barcelona <fede_rico_94@hotmail.com>
* [stable/falco] Changes requested in the PR
- Follow naming conventions
- Use only one secret instead of two different ones
Signed-off-by: Federico Barcelona <fede_rico_94@hotmail.com>
* Disable ebpf by default
This reverts the change made on 0.6.0
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Specify in CHANGELOG that we are reverting the previous change.
The vast majority of our users are using the kernel module approach and
we can cause some troubles with this change.
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Explain WHY we activated the ebpf module by default
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Upgrade to Falco 0.14.0
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Enable eBPF by default on Falco builds
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Allow to specify images from different registries than `docker.io`
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Upgrade Chart version to a minor one because eBPF default value
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Use RollingUpgrade strategy by default
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Provide a sane defaults for resources
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Update CHANGELOG entries
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Add minor / major categorization to changelog
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Add Amazon SNS integration
This allows Falco to publish alerts to a SNS topic
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
* Fix build and add entry to the CHANGELOG
Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
Scott Rigby
Kris Nova
Usama Ahmad
Cameron Attard
Leonardo Grasso
Salvatore Mazzarino
Néstor Salceda
Naoki Oketani
Ryo Sakamoto
farshad-hobsons
adel-s
Ryota
Fede Barcelona
David Guerrero
Billy Shambrook
Maxime VISONNEAU
Lorenzo FontanaandLeonardo Di Donato
Néstor Salceda
Cameron Attard
Beruben Daniel
Carlos Tadeu Panato Junior
Diego Lendoiro