Skip to content

Commit 92e439e

Browse files
mcbenjemaak8s-ci-robot
mcbenjemaa
authored and
k8s-ci-robot
committed
split falco section to a new page (#16011)
1 parent f600acf commit 92e439e

File tree

2 files changed

+124
-103
lines changed

2 files changed

+124
-103
lines changed

‎content/en/docs/tasks/debug-application-cluster/audit.md

Lines changed: 3 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -489,111 +489,11 @@ Note that in addition to file output plugin, logstash has a variety of outputs t
489489
let users route data where they want. For example, users can emit audit events to elasticsearch
490490
plugin which supports full-text search and analytics.
491491

492-
## Webhook Collector Examples
493492

494-
### Use Falco to collect audit events
495-
496-
[Falco][falco_website] is an open source project for intrusion and abnormality detection for Cloud Native platforms.
497-
This section describes how to set up Falco, how to send audit events to the Kubernetes Audit endpoint exposed by Falco, and how Falco applies a set of rules to automatically detect suspicious behavior.
498-
499-
#### Install Falco
500-
501-
Install Falco by using one of the following methods:
502-
503-
- [Standalone Falco][falco_installation]
504-
- [Kubernetes DaemonSet][falco_installation]
505-
- [Falco Helm Chart][falco_helm_chart]
506-
507-
Once Falco is installed make sure it is configured to expose the Audit webhook. To do so, use the following configuration:
508-
509-
```yaml
510-
webserver:
511-
enabled: true
512-
listen_port: 8765
513-
k8s_audit_endpoint: /k8s_audit
514-
ssl_enabled: false
515-
ssl_certificate: /etc/falco/falco.pem
516-
```
517-
518-
This configuration is typically found in the `/etc/falco/falco.yaml` file. If Falco is installed as a Kubernetes DaemonSet, edit the `falco-config` ConfigMap and add this configuration.
519-
520-
#### Configure Kubernetes Audit
521-
522-
1. Create a [kubeconfig file](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) for the [kube-apiserver][kube-apiserver] webhook audit backend.
523-
524-
cat <<EOF > /etc/kubernetes/audit-webhook-kubeconfig
525-
apiVersion: v1
526-
kind: Config
527-
clusters:
528-
- cluster:
529-
server: http://<ip_of_falco>:8765/k8s_audit
530-
name: falco
531-
contexts:
532-
- context:
533-
cluster: falco
534-
user: ""
535-
name: default-context
536-
current-context: default-context
537-
preferences: {}
538-
users: []
539-
EOF
540-
541-
1. Start [kube-apiserver][kube-apiserver] with the following options:
493+
{{% /capture %}}
542494

543-
```shell
544-
--audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-webhook-config-file=/etc/kubernetes/audit-webhook-kubeconfig
545-
```
495+
{{% capture whatsnext %}}
546496

547-
#### Audit Rules
548-
549-
Rules devoted to Kubernetes Audit Events can be found in [k8s_audit_rules.yaml][falco_k8s_audit_rules]. If Audit Rules is installed as a native package or using the official Docker images, Falco copies the rules file to `/etc/falco/`, so they are available for use.
550-
551-
There are three classes of rules.
552-
553-
The first class of rules looks for suspicious or exceptional activities, such as:
554-
555-
- Any activity by an unauthorized or anonymous user.
556-
- Creating a pod with an unknown or disallowed image.
557-
- Creating a privileged pod, a pod mounting a sensitive filesystem from the host, or a pod using host networking.
558-
- Creating a NodePort service.
559-
- Creating a ConfigMap containing private credentials, such as passwords and cloud provider secrets.
560-
- Attaching to or executing a command on a running pod.
561-
- Creating a namespace external to a set of allowed namespaces.
562-
- Creating a pod or service account in the kube-system or kube-public namespaces.
563-
- Trying to modify or delete a system ClusterRole.
564-
- Creating a ClusterRoleBinding to the cluster-admin role.
565-
- Creating a ClusterRole with wildcarded verbs or resources. For example, overly permissive.
566-
- Creating a ClusterRole with write permissions or a ClusterRole that can execute commands on pods.
567-
568-
A second class of rules tracks resources being created or destroyed, including:
569-
570-
- Deployments
571-
- Services
572-
- ConfigMaps
573-
- Namespaces
574-
- Service accounts
575-
- Role/ClusterRoles
576-
- Role/ClusterRoleBindings
577-
578-
The final class of rules simply displays any Audit Event received by Falco. This rule is disabled by default, as it can be quite noisy.
579-
580-
For further details, see [Kubernetes Audit Events][falco_ka_docs] in the Falco documentation.
581-
582-
[kube-apiserver]: /docs/admin/kube-apiserver
583-
[auditing-proposal]: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/auditing.md
584-
[auditing-api]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/staging/src/k8s.io/apiserver/pkg/apis/audit/v1/types.go
585-
[gce-audit-profile]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/cluster/gce/gci/configure-helper.sh#L735
586-
[kubeconfig]: /docs/tasks/access-application-cluster/configure-access-multiple-clusters/
587-
[fluentd]: http://www.fluentd.org/
588-
[fluentd_install_doc]: https://docs.fluentd.org/v1.0/articles/quickstart#step-1:-installing-fluentd
589-
[fluentd_plugin_management_doc]: https://docs.fluentd.org/v1.0/articles/plugin-management
590-
[logstash]: https://www.elastic.co/products/logstash
591-
[logstash_install_doc]: https://www.elastic.co/guide/en/logstash/current/installing-logstash.html
592-
[kube-aggregator]: /docs/concepts/api-extension/apiserver-aggregation
593-
[falco_website]: https://www.falco.org
594-
[falco_k8s_audit_rules]: https://github.com/falcosecurity/falco/blob/master/rules/k8s_audit_rules.yaml
595-
[falco_ka_docs]: https://falco.org/docs/event-sources/kubernetes-audit
596-
[falco_installation]: https://falco.org/docs/installation
597-
[falco_helm_chart]: https://github.com/helm/charts/tree/master/stable/falco
497+
Visit [Auditing with Falco](/docs/tasks/debug-application-cluster/falco)
598498

599499
{{% /capture %}}

‎content/en/docs/tasks/debug-application-cluster/falco.md

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
---
2+
reviewers:
3+
- soltysh
4+
- sttts
5+
- ericchiang
6+
content_template: templates/concept
7+
title: Auditing with Falco
8+
---
9+
10+
{{% capture overview %}}
11+
### Use Falco to collect audit events
12+
13+
[Falco](https://falco.org/) is an open source project for intrusion and abnormality detection for Cloud Native platforms.
14+
This section describes how to set up Falco, how to send audit events to the Kubernetes Audit endpoint exposed by Falco, and how Falco applies a set of rules to automatically detect suspicious behavior.
15+
16+
{{% /capture %}}
17+
18+
{{% capture body %}}
19+
20+
21+
#### Install Falco
22+
23+
Install Falco by using one of the following methods:
24+
25+
- [Standalone Falco][falco_installation]
26+
- [Kubernetes DaemonSet][falco_installation]
27+
- [Falco Helm Chart][falco_helm_chart]
28+
29+
Once Falco is installed make sure it is configured to expose the Audit webhook. To do so, use the following configuration:
30+
31+
```yaml
32+
webserver:
33+
enabled: true
34+
listen_port: 8765
35+
k8s_audit_endpoint: /k8s_audit
36+
ssl_enabled: false
37+
ssl_certificate: /etc/falco/falco.pem
38+
```
39+
40+
This configuration is typically found in the `/etc/falco/falco.yaml` file. If Falco is installed as a Kubernetes DaemonSet, edit the `falco-config` ConfigMap and add this configuration.
41+
42+
#### Configure Kubernetes Audit
43+
44+
1. Create a [kubeconfig file](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) for the [kube-apiserver][kube-apiserver] webhook audit backend.
45+
46+
cat <<EOF > /etc/kubernetes/audit-webhook-kubeconfig
47+
apiVersion: v1
48+
kind: Config
49+
clusters:
50+
- cluster:
51+
server: http://<ip_of_falco>:8765/k8s_audit
52+
name: falco
53+
contexts:
54+
- context:
55+
cluster: falco
56+
user: ""
57+
name: default-context
58+
current-context: default-context
59+
preferences: {}
60+
users: []
61+
EOF
62+
63+
1. Start [kube-apiserver][kube-apiserver] with the following options:
64+
65+
```shell
66+
--audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-webhook-config-file=/etc/kubernetes/audit-webhook-kubeconfig
67+
```
68+
69+
#### Audit Rules
70+
71+
Rules devoted to Kubernetes Audit Events can be found in [k8s_audit_rules.yaml][falco_k8s_audit_rules]. If Audit Rules is installed as a native package or using the official Docker images, Falco copies the rules file to `/etc/falco/`, so they are available for use.
72+
73+
There are three classes of rules.
74+
75+
The first class of rules looks for suspicious or exceptional activities, such as:
76+
77+
- Any activity by an unauthorized or anonymous user.
78+
- Creating a pod with an unknown or disallowed image.
79+
- Creating a privileged pod, a pod mounting a sensitive filesystem from the host, or a pod using host networking.
80+
- Creating a NodePort service.
81+
- Creating a ConfigMap containing private credentials, such as passwords and cloud provider secrets.
82+
- Attaching to or executing a command on a running pod.
83+
- Creating a namespace external to a set of allowed namespaces.
84+
- Creating a pod or service account in the kube-system or kube-public namespaces.
85+
- Trying to modify or delete a system ClusterRole.
86+
- Creating a ClusterRoleBinding to the cluster-admin role.
87+
- Creating a ClusterRole with wildcarded verbs or resources. For example, overly permissive.
88+
- Creating a ClusterRole with write permissions or a ClusterRole that can execute commands on pods.
89+
90+
A second class of rules tracks resources being created or destroyed, including:
91+
92+
- Deployments
93+
- Services
94+
- ConfigMaps
95+
- Namespaces
96+
- Service accounts
97+
- Role/ClusterRoles
98+
- Role/ClusterRoleBindings
99+
100+
The final class of rules simply displays any Audit Event received by Falco. This rule is disabled by default, as it can be quite noisy.
101+
102+
For further details, see [Kubernetes Audit Events][falco_ka_docs] in the Falco documentation.
103+
104+
[kube-apiserver]: /docs/admin/kube-apiserver
105+
[auditing-proposal]: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/auditing.md
106+
[auditing-api]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/staging/src/k8s.io/apiserver/pkg/apis/audit/v1/types.go
107+
[gce-audit-profile]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/cluster/gce/gci/configure-helper.sh#L735
108+
[kubeconfig]: /docs/tasks/access-application-cluster/configure-access-multiple-clusters/
109+
[fluentd]: http://www.fluentd.org/
110+
[fluentd_install_doc]: https://docs.fluentd.org/v1.0/articles/quickstart#step-1:-installing-fluentd
111+
[fluentd_plugin_management_doc]: https://docs.fluentd.org/v1.0/articles/plugin-management
112+
[logstash]: https://www.elastic.co/products/logstash
113+
[logstash_install_doc]: https://www.elastic.co/guide/en/logstash/current/installing-logstash.html
114+
[kube-aggregator]: /docs/concepts/api-extension/apiserver-aggregation
115+
[falco_website]: https://www.falco.org
116+
[falco_k8s_audit_rules]: https://github.com/falcosecurity/falco/blob/master/rules/k8s_audit_rules.yaml
117+
[falco_ka_docs]: https://falco.org/docs/event-sources/kubernetes-audit
118+
[falco_installation]: https://falco.org/docs/installation
119+
[falco_helm_chart]: https://github.com/helm/charts/tree/master/stable/falco
120+
121+
{{% /capture %}}

0 commit comments

Comments
 (0)