falco-addon #1922

balasu · 2021-01-21T08:57:03Z

Thank you for making MicroK8s better

Please reference the issue this PR is fixing, or provide a description of the problem addressed.

Also verify you have:

Read the contributions page.
Submitted the CLA form, if you are a first time contributor.

balchua · 2021-01-26T11:12:59Z

microk8s-resources/actions/enable.falco.sh

+refresh_opt_in_config "audit-webhook-config-file" "${SNAP_DATA}/args/auditlogging/webhook-config-falco.yaml" kube-apiserver
+refresh_opt_in_config "audit-webhook-batch-max-wait" "5s" kube-apiserver
+AGENT_SERVICE_CLUSTERIP="$($KUBECTL get svc sysdig-agent -o=jsonpath={.spec.clusterIP} -n sysdig-agent)" envsubst < "${SNAP_DATA}/args/auditlogging/webhook-config.yaml" > "${SNAP_DATA}/args/auditlogging/webhook-config-falco.yaml"
+run_with_sudo preserve_env snapctl restart "${SNAP_NAME}.daemon-apiserver"


This may not work on multi nodes. It will only restart the apiserver on the node where the addon is enabled.
Need to use the helper function restart_service apiserver

yes changed to helper function

balchua · 2021-01-26T11:14:49Z

microk8s-resources/actions/kube-api-audit

@@ -0,0 +1,69 @@
+apiVersion: audit.k8s.io/v1 # This is required.


Can we rename this file to have yaml extension?

yes, included as yaml

balchua · 2021-01-26T11:25:13Z

tests/test-addons.py

+        print("Enabling falco")
+        microk8s_enable("falco")
+        print("Validating falco")
+        validate_keda()


There's some mistake on what is validating here. I guess its should be validate_falco
This can be reason why build is failing.

Sorry, got it, changed the same

balchua · 2021-01-26T22:00:44Z

Hi @balasu
Can yoi check why the falco test is failing? Can you try running the test-addon pytests on yoir environment?

This shows how you can run your test in your environment. https://github.com/ubuntu/microk8s/blob/master/docs/build.md#running-the-tests-locally

microk8s-resources/actions/enable.falco.sh

balchua · 2021-01-28T10:58:02Z

tests/templates/ingress.yaml

@@ -18,7 +18,7 @@ spec:
        app: microbot
    spec:
      containers:
-      - image: cdkbot/microbot-$ARCH
+      - image: cdkbot/microbot-amd64


You accidentally committed the amd64

yes its from the test template,did a correction for it

ktsakalozos · 2021-02-25T07:25:37Z

@balasu is this still a WIP? Let me know when you want a review.

balasu · 2021-02-25T08:24:06Z

@balasu is this still a WIP? Let me know when you want a review.

Hi please review:)

ktsakalozos · 2021-04-02T07:05:08Z

microk8s-resources/actions/kube-api-audit.yaml

@@ -0,0 +1,69 @@
+apiVersion: audit.k8s.io/v1 # This is required.


Do not place yaml files under actions because they are considered addons. In this case for example you have created a microk8s enable kube-api-audit addon.

What you should do is to create a falco directory under actions and put all your yamls inside there.

ktsakalozos · 2021-04-02T07:06:14Z

microk8s-resources/actions/values.yaml

@@ -0,0 +1,344 @@
+# Default values for Falco.


Same here, create a directory named falco under actions and place the manifest there.

ktsakalozos · 2021-04-02T07:07:51Z

microk8s-resources/actions/values.yaml

+
+containerd:
+  enabled: true
+  socket: /run/containerd/containerd.sock


How is this used? I am asking because the containerd socket in MicroK8s is not in this path.

ktsakalozos · 2021-04-02T07:15:34Z

microk8s-resources/actions/enable.falco.sh

+refresh_opt_in_config "audit-log-maxbackup" "3" kube-apiserver
+refresh_opt_in_config "audit-log-maxsize" "1024" kube-apiserver
+refresh_opt_in_config "audit-log-maxage" "30" kube-apiserver
+refresh_opt_in_config "audit-log-path" "/var/log/kube-apiserver-audit.log" kube-apiserver


Let's not polute the host filesystem. Should we keep the MicroK8s logs under SNAP_COMON.

ktsakalozos · 2021-04-02T07:23:43Z

microk8s-resources/actions/enable.falco.sh

+
+NAMESPACE_PTR="sysdig-agent"
+
+MANIFEST_PTR="https://raw.githubusercontent.com/draios/sysdig-cloud-scripts/master/agent_deploy/kubernetes/sysdig-agent-service.yaml"


I think getting the manifest from the master will be a problem.

Are you certain the master will always work? It is not a release so there might be a commit that temporarily breaks the master causing microk8s.enable falco to fail.

It makes it really hard for us to have reproducible deployments. Let's say someone opens a issue saying 'falco did not work for me', how would you know what did the user deploy?

You pair a manifest with the default values that lives in the snap with the manifests in the master branch. How can you be sure that the default values manifest will stay exactly the same as falco evolves?

Are you sure that the falco master branch will deploy correctly on kubernetes v1.21 after 2 year? I am not.

Please select a specific release to deploy from https://github.com/falcosecurity/falco/releases

ktsakalozos · 2021-04-02T07:27:09Z

microk8s-resources/actions/values.yaml

+  pullPolicy: IfNotPresent
+  pullSecrets: []
+
+docker:


Not sure how this variable is used, but in MicroK8s there is no docker.

ktsakalozos · 2021-04-02T07:33:12Z

microk8s-resources/wrappers/addon-lists.yaml

+      version: "0.26.2"
+      check_status: "pod/falco"
+      supported_architectures:
+      - arm64


Is deployments on ARM64 tested enough? Looking at [1, 2,3] it is not clear to me what the state of ARM64 builds/configurations is.

Maybe we should have this addon for amd64 for now?

[1] falcosecurity/falco#520
[2] falcosecurity/falco#1442
[3] xunholy/k8s-gitops#152

ktsakalozos

Please see the comments in the PR. Also I do not think tests/backupfile.tar.gz is needed.

balasu marked this pull request as ready for review January 26, 2021 05:42

balasu requested a review from ktsakalozos as a code owner January 26, 2021 05:42

balchua reviewed Jan 26, 2021

View reviewed changes

wqchanged audit file location

1888c46

deepskyblue86 reviewed Jan 27, 2021

View reviewed changes

microk8s-resources/actions/enable.falco.sh Outdated Show resolved Hide resolved

balasu added 2 commits January 28, 2021 10:35

changed files based on suggestions

e4f64c6

formatted file

f550741

balasu force-pushed the wip-falco branch from 68c3ecc to f550741 Compare January 28, 2021 10:41

balchua reviewed Jan 28, 2021

View reviewed changes

balasu added 6 commits January 28, 2021 10:58

changed files based on suggestions

e29abf0

changed ingress yaml in test templates

66660ec

added test-addons.py

56e09af

changed test-addons.py

e403fcb

changed test-addons.py

5486136

using falco namespace & argument can be passed while enabling falco

3aac46c

balasu changed the title ~~Wip falco~~ falco-addon Feb 25, 2021

ktsakalozos reviewed Apr 2, 2021

View reviewed changes

ktsakalozos requested changes Apr 2, 2021

View reviewed changes

balasu closed this Jan 14, 2022

balasu deleted the wip-falco branch January 14, 2022 13:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

falco-addon #1922

falco-addon #1922

balasu commented Jan 21, 2021

balchua Jan 26, 2021

balasu Jan 26, 2021

balchua Jan 26, 2021

balasu Jan 26, 2021

balchua Jan 26, 2021 •

edited

Loading

balasu Jan 26, 2021

balchua commented Jan 26, 2021

balchua Jan 28, 2021

balasu Jan 28, 2021

ktsakalozos commented Feb 25, 2021

balasu commented Feb 25, 2021

ktsakalozos Apr 2, 2021 •

edited

Loading

ktsakalozos Apr 2, 2021

ktsakalozos Apr 2, 2021

ktsakalozos Apr 2, 2021

ktsakalozos Apr 2, 2021

ktsakalozos Apr 2, 2021

ktsakalozos Apr 2, 2021

ktsakalozos left a comment

		@@ -0,0 +1,69 @@
		apiVersion: audit.k8s.io/v1 # This is required.


		NAMESPACE_PTR="sysdig-agent"

		MANIFEST_PTR="https://raw.githubusercontent.com/draios/sysdig-cloud-scripts/master/agent_deploy/kubernetes/sysdig-agent-service.yaml"

falco-addon #1922

falco-addon #1922

Conversation

balasu commented Jan 21, 2021

Thank you for making MicroK8s better

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

balchua Jan 26, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

balchua commented Jan 26, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ktsakalozos commented Feb 25, 2021

balasu commented Feb 25, 2021

ktsakalozos Apr 2, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ktsakalozos left a comment

Choose a reason for hiding this comment

balchua Jan 26, 2021 •

edited

Loading

ktsakalozos Apr 2, 2021 •

edited

Loading