[stable/falco] Add Falco chart #5853

nestorsalceda · 2018-05-31T15:58:51Z

What this PR does / why we need it:
This PR adds a chart for installing Sysdig Falco in Kubernetes.
Sysdig Falco is a behavioral activity monitor designed to detect anomalous activity in your applications.

You can use Falco to monitor run-time security of your Kubernetes applications and internal components.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #

None, because this is a new chart.

Special notes for your reviewer:

k8s-ci-robot · 2018-05-31T15:58:54Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please email the CNCF helpdesk: [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

nestorsalceda · 2018-06-01T13:44:24Z

/check-cla

nestorsalceda · 2018-06-01T13:47:26Z

/assign @lachie83

unguiculus · 2018-06-17T20:30:59Z

Please have a look at our RBAC best practices.

https://github.com/kubernetes/helm/blob/master/docs/chart_best_practices/rbac.md

unguiculus · 2018-06-17T20:31:03Z

/assign

unguiculus · 2018-06-18T18:26:15Z

stable/falco/README.md

@@ -50,7 +50,8 @@ The following table lists the configurable parameters of the Falco chart and the
 | `image.pullPolicy`                              | The image pull policy                                               | `Always`                                                                               |
 | `resources`                                     | Specify container resources                                         | `{}`                                                                                   |
 | `rbac.create`                                   | If true, create & use RBAC resources                                | `true`                                                                                 |
-| `rbac.serviceAccountName`                       | If rbac.create is false, use this value as serviceAccountName       | `default`                                                                              |
+| `serviceAccount.create`                         | Create serviceAccount                                               | `default`                                                                              |


default -> true

unguiculus · 2018-06-18T18:27:38Z

stable/falco/templates/clusterrolebinding.yaml

+subjects:
+  - kind: ServiceAccount
+    name: {{ template "falco.serviceAccountName" .}}
+    namespace: default


default -> {{ .Release.Namespace }}

unguiculus · 2018-06-18T18:28:16Z

stable/falco/templates/clusterrolebinding.yaml

+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: {{ template "falco.fullname" .}}
+  namespace: default


Remove namespace

unguiculus · 2018-06-18T18:31:44Z

stable/falco/templates/configmap-rules.yaml

+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+data: {}


Why do you create an empty configmap. The above rules file is not used by the chart. Resources created by Helm should not be edited manually as you suggest in the readme. This would get you in trouble when updating a release.

Because we want to allow that chart users adds its own rules. Let me to explain a bit more the context.

Although Falco comes with a nice default rule set for detecting weird behavior in containers, our users are going to customize the run-time security rule sets or policies for the specific container images and applications they run. In Falco we provide an /etc/falco/rules.d directory for dropping new files with rules and we want to allow our users to upload its rules to that directory, so our idea was to mount the /etc/falco/rules.d directory as a configMap and allow users to add rules to that configMap.

For us, the ideal situation would be allowing to pass rules files when installing the helm but
I have been reading about this problem helm/helm#3276 or in Accessing files inside templates and looks like this is not supported. Perhaps you have some tips or guidance or a workaround for this issue?

Thanks!

If you use Helm you should use it exclusively. Manipulating file installed by Helm will get you in trouble. Why don't you make the configmap configurable via values.yaml?

Done! We load custom rules via values.yaml file :)

Thanks!

bencer · 2018-06-25T22:19:39Z

@unguiculus can you have a look at the changes @nestorsalceda pushed?

lachie83 · 2018-06-27T18:52:03Z

circle is failing on some changes that have been fixed in master. Can you rebase on master?

We can correlate falco.* keys for falco related settings, and refer them in Falco Wiki

First one is too generic

Follow RBAC best practices: https://github.com/kubernetes/helm/blob/master/docs/chart_best_practices/rbac.md

…by hand

nestorsalceda · 2018-06-28T21:49:26Z

@lachie83 I have rebased and right now CircleCI build is passing :)

https://circleci.com/gh/kubernetes/charts/tree/pull%2F5853

Thanks!

All comments resolved

lachie83 · 2018-07-02T16:50:54Z

stable/falco/Chart.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+name: falco
+version: '0.1'


Remove single quotes

I'm not sure if this break lint stage in CircleCI

nestorsalceda · 2018-07-02T17:32:48Z

I did remove the quotes, but @lachie83 I think the build is failing because that quotes:

https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/charts/5853/pull-charts-e2e/11289/

lachie83 · 2018-07-03T23:06:17Z

Was not symverv2 compliant.

lachie83 · 2018-07-03T23:06:24Z

/lgtm

k8s-ci-robot · 2018-07-03T23:06:32Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lachie83, nestorsalceda

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [lachie83]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

lachie83 · 2018-07-04T03:33:45Z

/ok-to-test

* [stable/falco] Add Falco chart * Fix indentation and other stuff reported by CI * Add appVersion to Chart.yaml * Specify container resources * Allow to load external Falco rules * Move GCSCC integrations to a top level integrations section We can correlate falco.* keys for falco related settings, and refer them in Falco Wiki * Rename deployment to fakeEventGenerator First one is too generic * Add OWNERS file * Separate rbac and serviceAccount Follow RBAC best practices: https://github.com/kubernetes/helm/blob/master/docs/chart_best_practices/rbac.md * Use falco.serviceAccount name template for cluster role binding * Fixes required from reviewer * Allow passing rules in an external file instead of editing configMap by hand * Remove quotes from Chart version I'm not sure if this break lint stage in CircleCI * Update Chart.yaml

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels May 31, 2018

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jun 1, 2018

k8s-ci-robot assigned lachie83 Jun 1, 2018

k8s-ci-robot assigned unguiculus Jun 17, 2018

unguiculus previously requested changes Jun 18, 2018

View reviewed changes

Néstor Salceda added 12 commits June 28, 2018 23:42

[stable/falco] Add Falco chart

0cff5bf

Fix indentation and other stuff reported by CI

71f7b3f

Add appVersion to Chart.yaml

6a54359

Specify container resources

9721844

Allow to load external Falco rules

e79e38f

Move GCSCC integrations to a top level integrations section

25d98c3

We can correlate falco.* keys for falco related settings, and refer them in Falco Wiki

Rename deployment to fakeEventGenerator

1587e7b

First one is too generic

Add OWNERS file

a17b0e8

Separate rbac and serviceAccount

986b74e

Follow RBAC best practices: https://github.com/kubernetes/helm/blob/master/docs/chart_best_practices/rbac.md

Use falco.serviceAccount name template for cluster role binding

a100d55

Fixes required from reviewer

dbf0ae1

Allow passing rules in an external file instead of editing configMap …

b9158a5

…by hand

lachie83 reviewed Jul 2, 2018

View reviewed changes

stable/falco/Chart.yaml Outdated

@@ -0,0 +1,19 @@

apiVersion: v1

name: falco

version: '0.1'

Copy link

Contributor

lachie83 Jul 2, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove single quotes

Remove quotes from Chart version

d759a0d

I'm not sure if this break lint stage in CircleCI

Update Chart.yaml

98eb0d6

k8s-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 3, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 3, 2018

k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 4, 2018

k8s-ci-robot merged commit 48f8a87 into helm:master Jul 4, 2018

mattfarina unassigned lachie83 Jul 19, 2018

nibalizer mentioned this pull request May 7, 2020

wip: add helm chart falcosecurity/evolution#15

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[stable/falco] Add Falco chart #5853

[stable/falco] Add Falco chart #5853

nestorsalceda commented May 31, 2018

k8s-ci-robot commented May 31, 2018

nestorsalceda commented Jun 1, 2018

nestorsalceda commented Jun 1, 2018

unguiculus commented Jun 17, 2018

unguiculus commented Jun 17, 2018

unguiculus Jun 18, 2018

unguiculus Jun 18, 2018

unguiculus Jun 18, 2018

unguiculus Jun 18, 2018

nestorsalceda Jun 19, 2018

unguiculus Jun 22, 2018

nestorsalceda Jun 25, 2018

bencer commented Jun 25, 2018

lachie83 commented Jun 27, 2018

nestorsalceda commented Jun 28, 2018

lachie83 Jul 2, 2018

nestorsalceda commented Jul 2, 2018 •

edited

Loading

lachie83 commented Jul 3, 2018

lachie83 commented Jul 3, 2018

k8s-ci-robot commented Jul 3, 2018

lachie83 commented Jul 4, 2018

[stable/falco] Add Falco chart #5853

[stable/falco] Add Falco chart #5853

Conversation

nestorsalceda commented May 31, 2018

k8s-ci-robot commented May 31, 2018

nestorsalceda commented Jun 1, 2018

nestorsalceda commented Jun 1, 2018

unguiculus commented Jun 17, 2018

unguiculus commented Jun 17, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bencer commented Jun 25, 2018

lachie83 commented Jun 27, 2018

nestorsalceda commented Jun 28, 2018

Choose a reason for hiding this comment

nestorsalceda commented Jul 2, 2018 • edited Loading

lachie83 commented Jul 3, 2018

lachie83 commented Jul 3, 2018

k8s-ci-robot commented Jul 3, 2018

lachie83 commented Jul 4, 2018

nestorsalceda commented Jul 2, 2018 •

edited

Loading