83 lines
2.1 KiB
YAML
83 lines
2.1 KiB
YAML
k8saudit:
|
|
enabled: false
|
|
|
|
fullnameOverride: falco-k8saudit
|
|
|
|
# -- Disable the drivers since we want to deploy only the k8saudit plugin.
|
|
driver:
|
|
enabled: false
|
|
|
|
# -- Disable the collectors, no syscall events to enrich with metadata.
|
|
collectors:
|
|
enabled: false
|
|
|
|
# falcoctl disabled so we can reduce resources quite a bit
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 1
|
|
memory: 512Mi
|
|
|
|
nodeSelector:
|
|
node-role.kubernetes.io/control-plane: ""
|
|
|
|
# -- Deploy Falco as a deployment. One instance of Falco is enough. Anyway the number of replicas is configurabale.
|
|
controller:
|
|
kind: deployment
|
|
deployment:
|
|
# -- Number of replicas when installing Falco using a deployment. Change it if you really know what you are doing.
|
|
# For more info check the section on Plugins in the README.md file.
|
|
replicas: 1
|
|
|
|
# This provides k8s-audit rules via custom CM
|
|
mounts:
|
|
volumeMounts:
|
|
- mountPath: /etc/falco/rules.d
|
|
name: rules-volume
|
|
volumes:
|
|
- name: rules-volume
|
|
configMap:
|
|
name: falco-k8saudit-rules
|
|
|
|
falcoctl:
|
|
artifact:
|
|
follow:
|
|
enabled: false
|
|
# Since 0.37 the plugins are not part of the image anymore
|
|
# but we provide our rules static via our CM
|
|
config:
|
|
artifact:
|
|
allowedTypes:
|
|
- plugin
|
|
install:
|
|
refs: [k8saudit:0.7.0,json:0.7.2]
|
|
|
|
services:
|
|
- name: webhook
|
|
ports:
|
|
- port: 9765 # See plugin open_params
|
|
protocol: TCP
|
|
|
|
falco:
|
|
rules_file:
|
|
- /etc/falco/rules.d
|
|
plugins:
|
|
- name: k8saudit
|
|
library_path: libk8saudit.so
|
|
init_config:
|
|
maxEventSize: 1048576
|
|
open_params: "http://:9765/k8s-audit"
|
|
- name: json
|
|
library_path: libjson.so
|
|
init_config: ""
|
|
# Plugins that Falco will load. Note: the same plugins are installed by the falcoctl-artifact-install init container.
|
|
load_plugins: [k8saudit, json]
|
|
|
|
json_output: true
|
|
buffered_outputs: true
|
|
log_syslog: false
|
|
syslog_output:
|
|
enabled: false
|