mirror of
https://github.com/helm/charts.git
synced 2026-09-05 12:27:30 +00:00
282 lines
8.7 KiB
YAML
282 lines
8.7 KiB
YAML
# Default values for falco.
|
|
|
|
image:
|
|
registry: docker.io
|
|
repository: falcosecurity/falco
|
|
tag: 0.17.1
|
|
pullPolicy: IfNotPresent
|
|
|
|
docker:
|
|
enabled: true
|
|
socket: /var/run/docker.sock
|
|
|
|
cri:
|
|
enabled: true
|
|
socket: /run/containerd/containerd.sock
|
|
|
|
resources:
|
|
# Although resources needed are subjective on the actual workload we provide
|
|
# a sane defaults ones. If you have more questions or concerns, please refer
|
|
# to Sysdig Support for more info about it
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 1024Mi
|
|
|
|
extraArgs: []
|
|
|
|
rbac:
|
|
# Create and use rbac resources
|
|
create: true
|
|
|
|
podSecurityPolicy:
|
|
# Create a podSecurityPolicy
|
|
create: false
|
|
|
|
serviceAccount:
|
|
# Create and use serviceAccount resources
|
|
create: true
|
|
# Use this value as serviceAccountName
|
|
name:
|
|
|
|
fakeEventGenerator:
|
|
enabled: false
|
|
replicas: 1
|
|
|
|
daemonset:
|
|
# Perform rolling updates by default in the DaemonSet agent
|
|
# ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/
|
|
updateStrategy:
|
|
# You can also customize maxUnavailable, maxSurge or minReadySeconds if you
|
|
# need it
|
|
type: RollingUpdate
|
|
|
|
## Extra environment variables that will be pass onto deployment pods
|
|
env: {}
|
|
|
|
# If is behind a proxy you can set the proxy server
|
|
proxy:
|
|
httpProxy:
|
|
httpsProxy:
|
|
noProxy:
|
|
|
|
# Set daemonset timezone
|
|
timezone:
|
|
|
|
# Set daemonset priorityClassName
|
|
priorityClassName:
|
|
|
|
ebpf:
|
|
# Enable eBPF support for Falco
|
|
enabled: false
|
|
|
|
settings:
|
|
# Needed to enable eBPF JIT at runtime for performance reasons.
|
|
# Can be skipped if eBPF JIT is enabled from outside the container
|
|
hostNetwork: true
|
|
# Needed to correctly detect the kernel version for the eBPF program
|
|
# Set to false if not running on Google COS
|
|
mountEtcVolume: true
|
|
|
|
falco:
|
|
# The location of the rules file(s). This can contain one or more paths to
|
|
# separate rules files.
|
|
rulesFile:
|
|
- /etc/falco/falco_rules.yaml
|
|
- /etc/falco/falco_rules.local.yaml
|
|
- /etc/falco/k8s_audit_rules.yaml
|
|
- /etc/falco/rules.d
|
|
|
|
# If true, the times displayed in log messages and output messages
|
|
# will be in ISO 8601. By default, times are displayed in the local
|
|
# time zone, as governed by /etc/localtime.
|
|
timeFormatISO8601: false
|
|
|
|
# Whether to output events in json or text
|
|
jsonOutput: false
|
|
|
|
# When using json output, whether or not to include the "output" property
|
|
# itself (e.g. "File below a known binary directory opened for writing
|
|
# (user=root ....") in the json output.
|
|
jsonIncludeOutputProperty: true
|
|
|
|
# Send information logs to stderr and/or syslog Note these are *not* security
|
|
# notification logs! These are just Falco lifecycle (and possibly error) logs.
|
|
logStderr: true
|
|
logSyslog: true
|
|
|
|
# Minimum log level to include in logs. Note: these levels are
|
|
# separate from the priority field of rules. This refers only to the
|
|
# log level of falco's internal logging. Can be one of "emergency",
|
|
# "alert", "critical", "error", "warning", "notice", "info", "debug".
|
|
logLevel: info
|
|
|
|
# Minimum rule priority level to load and run. All rules having a
|
|
# priority more severe than this level will be loaded/run. Can be one
|
|
# of "emergency", "alert", "critical", "error", "warning", "notice",
|
|
# "info", "debug".
|
|
priority: debug
|
|
|
|
# Whether or not output to any of the output channels below is
|
|
# buffered.
|
|
bufferedOutputs: false
|
|
|
|
# Falco uses a shared buffer between the kernel and userspace to pass
|
|
# system call information. When falco detects that this buffer is
|
|
# full and system calls have been dropped, it can take one or more of
|
|
# the following actions:
|
|
# - "ignore": do nothing. If an empty list is provided, ignore is assumed.
|
|
# - "log": log a CRITICAL message noting that the buffer was full.
|
|
# - "alert": emit a falco alert noting that the buffer was full.
|
|
# - "exit": exit falco with a non-zero rc.
|
|
#
|
|
# The rate at which log/alert messages are emitted is governed by a
|
|
# token bucket. The rate corresponds to one message every 30 seconds
|
|
# with a burst of 10 messages.
|
|
syscallEventDrops:
|
|
actions:
|
|
- log
|
|
- alert
|
|
rate: .03333
|
|
maxBurst: 10
|
|
|
|
# A throttling mechanism implemented as a token bucket limits the
|
|
# rate of falco notifications. This throttling is controlled by the following configuration
|
|
# options:
|
|
# - rate: the number of tokens (i.e. right to send a notification)
|
|
# gained per second. Defaults to 1.
|
|
# - max_burst: the maximum number of tokens outstanding. Defaults to 1000.
|
|
#
|
|
# With these defaults, falco could send up to 1000 notifications after
|
|
# an initial quiet period, and then up to 1 notification per second
|
|
# afterward. It would gain the full burst back after 1000 seconds of
|
|
# no activity.
|
|
outputs:
|
|
rate: 1
|
|
maxBurst: 1000
|
|
|
|
# Where security notifications should go.
|
|
# Multiple outputs can be enabled.
|
|
syslogOutput:
|
|
enabled: true
|
|
|
|
# If keep_alive is set to true, the file will be opened once and
|
|
# continuously written to, with each output message on its own
|
|
# line. If keep_alive is set to false, the file will be re-opened
|
|
# for each output message.
|
|
#
|
|
# Also, the file will be closed and reopened if falco is signaled with
|
|
# SIGUSR1.
|
|
fileOutput:
|
|
enabled: false
|
|
keepAlive: false
|
|
filename: ./events.txt
|
|
|
|
stdoutOutput:
|
|
enabled: true
|
|
|
|
# Falco contains an embedded webserver that can be used to accept K8s
|
|
# Audit Events. These config options control the behavior of that
|
|
# webserver. (By default, the webserver is disabled).
|
|
webserver:
|
|
enabled: false
|
|
listenPort: 8765
|
|
k8sAuditEndpoint: /k8s-audit
|
|
clusterIP:
|
|
|
|
# Possible additional things you might want to do with program output:
|
|
# - send to a slack webhook:
|
|
# program: "\"jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX\""
|
|
# - logging (alternate method than syslog):
|
|
# program: logger -t falco-test
|
|
# - send over a network connection:
|
|
# program: nc host.example.com 80
|
|
|
|
# If keep_alive is set to true, the program will be started once and
|
|
# continuously written to, with each output message on its own
|
|
# line. If keep_alive is set to false, the program will be re-spawned
|
|
# for each output message.
|
|
#
|
|
# Also, the program will be closed and reopened if falco is signaled with
|
|
# SIGUSR1.
|
|
programOutput:
|
|
enabled: false
|
|
keepAlive: false
|
|
program: mail -s "Falco Notification" someone@example.com
|
|
|
|
httpOutput:
|
|
enabled: false
|
|
url: http://some.url
|
|
|
|
customRules: {}
|
|
# Although Falco comes with a nice default rule set for detecting weird
|
|
# behavior in containers, our users are going to customize the run-time
|
|
# security rule sets or policies for the specific container images and
|
|
# applications they run. This feature can be handled in this section.
|
|
#
|
|
# Example:
|
|
#
|
|
# rules-traefik.yaml: |-
|
|
# [ rule body ]
|
|
|
|
integrations:
|
|
# If Google Cloud Security Command Center integration is enabled, falco will
|
|
# be configured to use this integration as program_output and sets the following values:
|
|
# * json_output: true
|
|
# * program_output:
|
|
# enabled: true
|
|
# keep_alive: false
|
|
# program: "curl -d @- -X POST --header 'Content-Type: application/json' --header 'Authorization: authentication_token' url"
|
|
gcscc:
|
|
enabled: false
|
|
webhookUrl: http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events
|
|
webhookAuthenticationToken: b27511f86e911f20b9e0f9c8104b4ec4
|
|
# If Nats Output integration is enabled, falco will be configured to use this
|
|
# integration as file_output and sets the following values:
|
|
# * json_output: true
|
|
# * json_include_output_property: true
|
|
# * file_output:
|
|
# enabled: true
|
|
# keep_alive: true
|
|
# filename: /var/run/falco/nats
|
|
natsOutput:
|
|
enabled: false
|
|
natsUrl: "nats://nats.nats-io.svc.cluster.local:4222"
|
|
# If SNS Output integration is enabled, falco will be configured to use this
|
|
# integration as file_output and sets the following values:
|
|
# * json_output: true
|
|
# * json_include_output_property: true
|
|
# * file_output:
|
|
# enabled: true
|
|
# keep_alive: true
|
|
# filename: /var/run/falco/nats
|
|
snsOutput:
|
|
enabled: false
|
|
topic: ""
|
|
aws_access_key_id: ""
|
|
aws_secret_access_key: ""
|
|
aws_default_region: ""
|
|
|
|
|
|
# If GCloud Pub/Sub integration is enabled, falco will be configured to use this
|
|
# integration as file_output and sets the following values:
|
|
# * json_output: true
|
|
# * json_include_output_property: true
|
|
# * file_output:
|
|
# enabled: true
|
|
# keep_alive: true
|
|
# filename: /var/run/falco/nats
|
|
pubsubOutput:
|
|
enabled: false
|
|
topic: ""
|
|
credentialsData: ""
|
|
projectID: ""
|
|
|
|
|
|
# Allow falco to run on Kubernetes 1.6 masters.
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
key: node-role.kubernetes.io/master
|