Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add k8s event generator #997

Merged
merged 2 commits into from
Jan 15, 2020
Merged

Add k8s event generator #997

merged 2 commits into from
Jan 15, 2020

Commits on Jan 15, 2020

  1. Add k8s audit support to falco event generator 

    Currently, the falco event generator only generates system call
activity. This adds support for k8s_audit events by adding a script +
supporting k8s object files that generate activity that matches the k8s
audit event ruleset.

The main script is k8s_event_generator.sh, which loops over the files in
the yaml subdirectory, running kubectl apply -f for each.

In the interests of keeping things self-contained, all objects are
created in a `falco-event-generator` namespace. This means that some
activity related with cluster roles/cluster role bindings is not
performed.

Each k8s object has annotations that note:

1. The specific falco rules that should trigger.
2. A user-friendly message to print when apply-ing the file.

You can provide a specific rule name to the script. If provided, only
those objects related to that rule will trigger. The default is "all",
meaning that all objects are created.

The script loops forever, deleting the falco-event-generator namespace
after each iteration.

Additionally, the docker image has been updated to also copy the script
+ supporting files, as well as fetching the latest available `kubectl`
binary. The entrypoint is now a script that allows choosing between:
 - syscall activity: run with .... "syscall"
 - k8s_audit activity: run with .... "k8s_audit"
 - spawn a shell: run with .... "bash"

The default is "syscall" to preserve existing behavior.

In most cases, you'll need to provide kube config
files/directories that allow access to your cluster. A
command like the following will work:

```
docker run -v $HOME/.kube:/root/.kube -it falcosecurity/falco-event-generator
k8s_audit
```

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
    @mstemm
    mstemm committed Jan 15, 2020
    Configuration menu
    Copy the full SHA
    4a88ca6 View commit details
    Browse the repository at this point in the history

  2. Fix compile warnings 

    Noticed these while compiling in the latest alpine image.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
    @mstemm
    mstemm committed Jan 15, 2020
    Configuration menu
    Copy the full SHA
    bfccd75 View commit details
    Browse the repository at this point in the history