History

Renovate Bot 2441a12dc8 chore(deps): update helm release falco to v4.12.0		2024-11-04 16:06:25 +00:00
..
files/rules	feat: Falco version upgrade	2024-04-03 13:11:07 +00:00
templates	Kube v1.27.8, Falco module	2023-11-15 22:35:53 +00:00
Chart.yaml	chore(deps): update helm release falco to v4.12.0	2024-11-04 16:06:25 +00:00
README.md	docs: update all chart READMEs	2024-10-16 13:37:57 +00:00
update.sh	Kube v1.27.8, Falco module	2023-11-15 22:35:53 +00:00
values.yaml	feat: Falco version upgrade	2024-04-03 13:11:07 +00:00

README.md

kubezero-falco

Falco Container Security and Audit components

Homepage: https://kubezero.com

Maintainers

Name	Email	Url
Stefan Reimer	stefan@zero-downtime.net

Requirements

Kubernetes: >= 1.26.0

Repository	Name	Version
https://cdn.zero-downtime.net/charts/	kubezero-lib	>= 0.1.6
https://falcosecurity.github.io/charts	k8saudit(falco)	4.2.5

Values

Key	Type	Default	Description
k8saudit.collectors	object	`{"enabled":false}`	Disable the collectors, no syscall events to enrich with metadata.
k8saudit.controller	object	`{"deployment":{"replicas":1},"kind":"deployment"}`	Deploy Falco as a deployment. One instance of Falco is enough. Anyway the number of replicas is configurabale.
k8saudit.controller.deployment.replicas	int	`1`	Number of replicas when installing Falco using a deployment. Change it if you really know what you are doing. For more info check the section on Plugins in the README.md file.
k8saudit.driver	object	`{"enabled":false}`	Disable the drivers since we want to deploy only the k8saudit plugin.
k8saudit.enabled	bool	`false`
k8saudit.falco.buffered_outputs	bool	`true`
k8saudit.falco.json_output	bool	`true`
k8saudit.falco.load_plugins[0]	string	`"k8saudit"`
k8saudit.falco.load_plugins[1]	string	`"json"`
k8saudit.falco.log_syslog	bool	`false`
k8saudit.falco.plugins[0].init_config.maxEventSize	int	`1048576`
k8saudit.falco.plugins[0].library_path	string	`"libk8saudit.so"`
k8saudit.falco.plugins[0].name	string	`"k8saudit"`
k8saudit.falco.plugins[0].open_params	string	`"http://:9765/k8s-audit"`
k8saudit.falco.plugins[1].init_config	string	`""`
k8saudit.falco.plugins[1].library_path	string	`"libjson.so"`
k8saudit.falco.plugins[1].name	string	`"json"`
k8saudit.falco.rules_file[0]	string	`"/etc/falco/rules.d"`
k8saudit.falco.syslog_output.enabled	bool	`false`
k8saudit.falcoctl.artifact.follow.enabled	bool	`false`
k8saudit.falcoctl.config.artifact.allowedTypes[0]	string	`"plugin"`
k8saudit.falcoctl.config.artifact.install.refs[0]	string	`"k8saudit:0.7.0"`
k8saudit.falcoctl.config.artifact.install.refs[1]	string	`"json:0.7.2"`
k8saudit.fullnameOverride	string	`"falco-k8saudit"`
k8saudit.mounts.volumeMounts[0].mountPath	string	`"/etc/falco/rules.d"`
k8saudit.mounts.volumeMounts[0].name	string	`"rules-volume"`
k8saudit.mounts.volumes[0].configMap.name	string	`"falco-k8saudit-rules"`
k8saudit.mounts.volumes[0].name	string	`"rules-volume"`
k8saudit.nodeSelector."node-role.kubernetes.io/control-plane"	string	`""`
k8saudit.resources.limits.cpu	int	`1`
k8saudit.resources.limits.memory	string	`"512Mi"`
k8saudit.resources.requests.cpu	string	`"100m"`
k8saudit.resources.requests.memory	string	`"64Mi"`
k8saudit.services[0].name	string	`"webhook"`
k8saudit.services[0].ports[0].port	int	`9765`
k8saudit.services[0].ports[0].protocol	string	`"TCP"`