event-generator icon indicating copy to clipboard operation
event-generator copied to clipboard

Add Rule Contact K8s API Server from container

Open ashu8912 opened this issue 1 year ago • 9 comments

Motivation

One of the falco default stable rule is Detecting communication attempt from a container to the K8s api server, it would be great if event-generator supported this rule as well Feature

Having an event that takes care of Contacting K8s API Server from a container rule Alternatives

Additional context

ashu8912 avatar Mar 06 '24 17:03 ashu8912

Hey @ashu8912 . I am interested in this issue. Am starting my work on adding this event to falco. /assign

h4l0gen avatar Mar 11 '24 19:03 h4l0gen

Awesome @h4l0gen I think this is a big one to tackle and if you need help with anything please reach out, I am learning about the project myself but I have made some progress in understanding the codebase now so feel free to bring in new question and we always have @leogr

ashu8912 avatar Mar 12 '24 12:03 ashu8912

Thank you so much for providing me with your assistance, @ashu8912. I have started working on this and will reach out to you or @leogr if I need any help. I'll soon come up with a new event for Falco ❤️

h4l0gen avatar Mar 12 '24 12:03 h4l0gen

Hey @ashu8912 , what would be the best way to connect with you?

h4l0gen avatar Mar 13 '24 06:03 h4l0gen

I am available on the cncf slack

ashu8912 avatar Mar 13 '24 11:03 ashu8912

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana avatar Jun 11 '24 15:06 poiana

/remove-lifecycle stale

h4l0gen avatar Jun 12 '24 02:06 h4l0gen

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana avatar Sep 10 '24 04:09 poiana

/remove-lifecycle stale

leogr avatar Sep 10 '24 08:09 leogr