plugins
plugins copied to clipboard
falcosecurity
k8s audit plug-ins for AKS and GCP
Motivation
As today most projects are multi-cloud, we would need k8saudit plug-in for at least AKS and GCP
Feature
k8s audit plug-ins for AKS and GKE
Alternatives
Today's alternative is creating a messaging stack on each CSP to send logs to the falco Web service
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
@jasondellaluce: This request has been marked as needing help from a contributor.
Please ensure the request meets the requirements listed here.
If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.
In response to this:
/help
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Provide feedback via https://github.com/falcosecurity/community. /close
@poiana: Closing this issue.
In response to this:
Rotten issues close after 30d of inactivity.
Reopen the issue with
/reopen.Mark the issue as fresh with
/remove-lifecycle rotten.Provide feedback via https://github.com/falcosecurity/community. /close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
@jasondellaluce: Reopened this issue.
In response to this:
/remove-lifecycle rotten
/reopen
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
A plugin for GKE is in progress https://github.com/falcosecurity/plugins/pull/424
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
@alfredomagallon for GKE I think we should be all set now: https://github.com/falcosecurity/plugins/tree/main/plugins/k8saudit-gke
So I guess the only one remaining among the requested ones is the AKS integration. cc @leogr
/remove-lifecycle rotten
Regarding the AKS plugin, this project was created a while ago by sysdig: https://github.com/sysdiglabs/aks-audit-log .
Since it wasn't too actively maintained and we wanted to be able to make modifications (and not too familiar with C#), we created our own version in Go here : https://github.com/dfo-mpo/aks-audit-log-go . It is still a fairly young project, but we are actively using it at the moment.
Not sure if our Go code fits the needs here, but if it does it could serve as a starting point or we could potentially consider giving out the codebase to the falcosecurity project (I would have to discuss this option internally first).
@jemag, have you considered transforming it into a plugin? :thinking: it would be the best option IMO, and in case you consider contributing it to falcosecurity org, we can help maintain it.
To be honest, we never thought of it. Initially there was only the sysdig code available and doing a rewrite in Go with the same approach was the fastest route for us.
I think it seems like the most reasonable route to go for in the future. The problem is we are already pretty overloaded on our side and don't really have the bandwidth to allocate to transforming it, especially since it already works for us (we are a very small team). I doubt we would be able to work on this until at least a couple of months.
If anyone wants to use it as inspiration for creating a plugin in the meantime, feel free to do so. Otherwise, individuals waiting for the plugin can also use it as is in the meantime (we'll likely publish official container images in the very near future).
If things change on our side and we have some time to allocate to a transformation, I'll provide an update in the issue.
Thank you @jemag
I believe transforming it into a plugin would not require too much for a developer already familiar with our plugin ecosystem. I totally understand your point about the bandwidth, and it's totally fair :+1: Likely, @Issif can help (as he commented here) without any significant effort from your side. Let's see what we can do :)
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
/remove-lifecycle stale
We only miss k8saudit for AKS. Although we don't have any estimation for that yet, I wanted to let you know that @alacuku , @Issif, and I are trying to make this happen. So stay tuned. Ofc, any help is welcome.