plugins
plugins copied to clipboard
falcosecurity
eks audit plugin shows events for system users.
Describe the bug
the eks audit plugin is emitting events for "disallowed k8s user" for system users. There are rules to exclude system users but they are apparently not being honored.
User is system:node:ip-10-30-63-166.ec2.internal
How to reproduce it
Deploy falco with only the eks k8s plugin enabled using the falco 4.2.4 helm chart.
Expected behaviour
Events done by system users should be ignored.
Screenshots
Environment
- Falco version: falco-no-driver:0.37.1
- System info:
{
"machine": "x86_64",
"nodename": "falco-audit-7f6dc75785-srq7t",
"release": "6.1.77",
"sysname": "Linux",
"version": "#1 SMP PREEMPT_DYNAMIC Fri Feb 23 02:26:25 UTC 2024"
}
- Cloud provider or hardware configuration: AWS EKS
- OS: Bottlerocket
- Kernel:
- Installation method: Helm
Additional context
The first should be to specify for each plugin, in the registry, the kind of expected deployment (daemonset, 1 replica deployment, multi-replicas deployment). This information could be part of the yaml to list the existing plugins.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
btw, it is already documented in the helm chart https://github.com/falcosecurity/charts/tree/master/charts/falco#deploying-falco-in-kubernetes It can be a source of inspiration to do the same in the official documentation.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale