rules update: expand list allowed_k8s_users

Signed-off-by: kaizhe <derek0405@gmail.com> add comments Signed-off-by: kaizhe <derek0405@gmail.com>
falcosecurity · Oct 23, 2019 · 7d96db5 · 7d96db5
1 parent 3fafac3
commit 7d96db5
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rules/k8s_audit_rules.yaml b/rules/k8s_audit_rules.yaml
@@ -39,8 +39,9 @@
   condition: (jevt.value[/stage]=ResponseStarted)
 
 # If you wish to restrict activity to a specific set of users, override/append to this list.
+# users created by kops are included
 - list: allowed_k8s_users
-  items: ["minikube", "minikube-user", "kubelet", "kops"]
+  items: ["minikube", "minikube-user", "kubelet", "kops", "admin", "kube", "kube-proxy"]
 
 - rule: Disallowed K8s User
   desc: Detect any k8s operation by users outside of an allowed set of users.