Tracee PolicyReport Adapter

Can be used as webhook for tracee, to convert events into the unified PolicyReport and ClusterPolicyReport from the Kubernetes Policy Working Group. This makes it possible to use tooling like Policy Reporter for tracee as well.

Pre Requirements

PolicyReport CRDs are installed in your Cluster

Installation via Helm

helm repo add tracee-polr-adapter https://fjogeleit.github.io/tracee-polr-adapter
helm install tracee-polr-adapter tracee-polr-adapter/tracee-polr-adapter -n tracee --create-namespace

Configuration

Results

• By default each report contains a maximum of 200 results, it can be changed by setting the value results.maxPerReport to any number > 0
• By default only violations with a severity > 0 (information) will processed, it can be changed by setting the value results.minumumSeverity to a number between 0 and 5

Rules

It is possible to exclude rules by ID

rules:
    exclude: ["TCR-1"]

Tracee

Currently the adapter requires the v0.8.0 of tracee or above, with the experimental containers enrichment enabled, to have the Pod information into tracee events.

It is possible to also install tracee with this Helm Chart with --set tracee.enabled=true. In this case the adapter will be preconfigured as tracee webhook.

Otherwise you need to configure the adapter as webhook yourself:

...
    spec:
      containers:
        - name: tracee
          args:
            - --webhook http://tracee-polr-adapter:8080/webhook
            - --webhook-template ./templates/rawjson.tmpl
            - --webhook-content-type application/json
...

Screenshots