Adding Falco
This commit adds falco daemonset of the node for behavioral activity monitor designed to detect anomalous activity. Change-Id: I783a2acc03592471c81a8a54e1dc0df140b34a42
This commit is contained in:
Gupta, Sangeet (sg774j)
Chris Wedgwood
parent
26e1b9cde6
commit
a34a7d8e50
33
falco/Chart.yaml
Normal file
33
falco/Chart.yaml
Normal file
@ -0,0 +1,33 @@
|
||||
|
||||
# Copyright 2017 The Openstack-Helm Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
apiVersion: v1
|
||||
name: falco
|
||||
version: 0.1.0
|
||||
appVersion: 0.11.1
|
||||
description: Sysdig Falco
|
||||
keywords:
|
||||
- monitoring
|
||||
- security
|
||||
- alerting
|
||||
- metric
|
||||
- troubleshooting
|
||||
- run-time
|
||||
home: https://www.sysdig.com/opensource/falco/
|
||||
icon: https://sysdig.com/wp-content/uploads/2016/08/falco_blog_480.jpg
|
||||
sources:
|
||||
- https://github.com/draios/falco
|
||||
maintainers:
|
||||
- name: OpenStack-Helm Authors
|
||||
18
falco/requirements.yaml
Normal file
18
falco/requirements.yaml
Normal file
@ -0,0 +1,18 @@
|
||||
# Copyright 2017 The Openstack-Helm Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
dependencies:
|
||||
- name: helm-toolkit
|
||||
repository: http://localhost:8879/charts
|
||||
version: 0.1.0
|
||||
20
falco/templates/bin/_falco.sh.tpl
Normal file
20
falco/templates/bin/_falco.sh.tpl
Normal file
@ -0,0 +1,20 @@
|
||||
#!/bin/sh
|
||||
{{/*
|
||||
Copyright 2017 The Openstack-Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
set -ex
|
||||
|
||||
exec /usr/bin/falco -K /var/run/secrets/kubernetes.io/serviceaccount/token -k https://kubernetes.default -pk
|
||||
27
falco/templates/configmap-bin.yaml
Normal file
27
falco/templates/configmap-bin.yaml
Normal file
@ -0,0 +1,27 @@
|
||||
{{/*
|
||||
Copyright 2017 The Openstack-Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.manifests.configmap_bin }}
|
||||
{{- $envAll := . }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: falco-bin
|
||||
data:
|
||||
falco.sh: |
|
||||
{{ tuple "bin/_falco.sh.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
|
||||
{{- end }}
|
||||
28
falco/templates/configmap-etc.yaml
Normal file
28
falco/templates/configmap-etc.yaml
Normal file
@ -0,0 +1,28 @@
|
||||
{{/*
|
||||
Copyright 2017 The Openstack-Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.manifests.configmap_etc }}
|
||||
{{- $envAll := . }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: falco
|
||||
data:
|
||||
falco.yaml: {{ toYaml .Values.conf.config | b64enc }}
|
||||
falco_rules.yaml: {{ .Values.conf.rules.falco_rules | b64enc }}
|
||||
falco_rules.local.yaml: {{ .Values.conf.rules.falco_rules_local | b64enc }}
|
||||
{{- end }}
|
||||
26
falco/templates/configmap-rules.yaml
Normal file
26
falco/templates/configmap-rules.yaml
Normal file
@ -0,0 +1,26 @@
|
||||
{{/*
|
||||
Copyright 2017 The Openstack-Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.conf.rules.custom_rules .Values.manifests.configmap_custom_rules }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: falco-rules
|
||||
data:
|
||||
{{- range $file, $content := .Values.conf.rules.custom_rules }}
|
||||
{{ $file }}: {{ $content | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
144
falco/templates/daemonset.yaml
Normal file
144
falco/templates/daemonset.yaml
Normal file
@ -0,0 +1,144 @@
|
||||
{{/*
|
||||
Copyright 2017 The Openstack-Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.manifests.daemonset }}
|
||||
{{- $envAll := . }}
|
||||
|
||||
{{- $serviceAccountName := "falcon-service" }}
|
||||
{{ tuple $envAll "falco" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ $serviceAccountName }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- extensions
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
- namespaces
|
||||
- pods
|
||||
- replicationcontrollers
|
||||
- services
|
||||
- events
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- nonResourceURLs:
|
||||
- /healthz
|
||||
- /healthz/*
|
||||
verbs:
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ $serviceAccountName }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ $serviceAccountName }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $serviceAccountName }}
|
||||
namespace: {{ $envAll.Release.Namespace }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: falco-agent
|
||||
labels:
|
||||
{{ tuple $envAll "falco" "falco-agent" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{ tuple $envAll "falco" "falco-agent" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }}
|
||||
{{ tuple $envAll "falco" | include "helm-toolkit.snippets.kubernetes_upgrades_daemonset" | indent 2 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{ tuple $envAll "falco" "falco-agent" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
||||
spec:
|
||||
serviceAccountName: {{ $serviceAccountName }}
|
||||
{{ tuple $envAll "falco" | include "helm-toolkit.snippets.kubernetes_tolerations" | indent 6 }}
|
||||
containers:
|
||||
- name: falco
|
||||
{{ tuple $envAll "falco" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||
{{ tuple $envAll $envAll.Values.pod.resources.falco | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||
securityContext:
|
||||
privileged: true
|
||||
args:
|
||||
- /tmp/falco.sh
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/falco.sh
|
||||
name: falco-bin
|
||||
subPath: falco.sh
|
||||
readOnly: true
|
||||
- mountPath: /host/dev
|
||||
name: dev-fs
|
||||
- mountPath: /host/proc
|
||||
name: proc-fs
|
||||
readOnly: true
|
||||
- mountPath: /host/boot
|
||||
name: boot-fs
|
||||
readOnly: true
|
||||
- mountPath: /host/lib/modules
|
||||
name: lib-modules
|
||||
readOnly: true
|
||||
- mountPath: /host/usr
|
||||
name: usr-fs
|
||||
readOnly: true
|
||||
- mountPath: /etc/falco
|
||||
name: config-volume
|
||||
{{- if .Values.conf.rules.custom_rules }}
|
||||
- mountPath: /etc/falco/rules.d
|
||||
name: rules-volume
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: falco-bin
|
||||
configMap:
|
||||
name: falco-bin
|
||||
defaultMode: 0555
|
||||
- name: dshm
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
- name: dev-fs
|
||||
hostPath:
|
||||
path: /dev
|
||||
- name: proc-fs
|
||||
hostPath:
|
||||
path: /proc
|
||||
- name: boot-fs
|
||||
hostPath:
|
||||
path: /boot
|
||||
- name: lib-modules
|
||||
hostPath:
|
||||
path: /lib/modules
|
||||
- name: usr-fs
|
||||
hostPath:
|
||||
path: /usr
|
||||
- name: config-volume
|
||||
secret:
|
||||
secretName: falco
|
||||
{{- if .Values.conf.rules.custom_rules }}
|
||||
- name: rules-volume
|
||||
secret:
|
||||
secretName: falco-rules
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
20
falco/templates/job-image-repo-sync.yaml
Normal file
20
falco/templates/job-image-repo-sync.yaml
Normal file
@ -0,0 +1,20 @@
|
||||
{{/*
|
||||
Copyright 2017 The Openstack-Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.manifests.job_image_repo_sync .Values.images.local_registry.active }}
|
||||
{{- $imageRepoSyncJob := dict "envAll" . "serviceName" "falco" -}}
|
||||
{{ $imageRepoSyncJob | include "helm-toolkit.manifests.job_image_repo_sync" }}
|
||||
{{- end }}
|
||||
1370
falco/values.yaml
Normal file
1370
falco/values.yaml
Normal file
File diff suppressed because it is too large
Load Diff
@ -14,6 +14,12 @@
|
||||
|
||||
- hosts: primary
|
||||
tasks:
|
||||
- name: Deploy Falco
|
||||
shell: |
|
||||
set -xe;
|
||||
./tools/deployment/multinode/150-falco.sh
|
||||
args:
|
||||
chdir: "{{ zuul.project.src_dir }}"
|
||||
- name: Deploy Registry NFS, Redis, and Docker Registry
|
||||
shell: |
|
||||
set -xe;
|
||||
|
||||
30
tools/deployment/common/150-falco.sh
Executable file
30
tools/deployment/common/150-falco.sh
Executable file
@ -0,0 +1,30 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2017 The Openstack-Helm Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
set -xe
|
||||
|
||||
#NOTE: Lint and package chart
|
||||
make falco
|
||||
|
||||
#NOTE: Deploy command
|
||||
helm upgrade --install falco ./falco \
|
||||
--namespace=kube-system
|
||||
|
||||
#NOTE: Wait for deploy
|
||||
./tools/deployment/common/wait-for-pods.sh kube-system
|
||||
|
||||
#NOTE: Validate Deployment info
|
||||
helm status falco
|
||||
1
tools/deployment/multinode/150-falco.sh
Symbolic link
1
tools/deployment/multinode/150-falco.sh
Symbolic link
@ -0,0 +1 @@
|
||||
../common/150-falco.sh
|
||||
Loading…
Reference in New Issue
Block a user