From 0a66bc554a61d7ba5af10909d845fe7618330d1b Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Tue, 20 Feb 2018 12:57:59 -0500
Subject: [PATCH] Improvements to falco daemonset configuration (#325)

* Use kubernetes.default to reach k8s api server

Originally raised in #296, but since then we documented rbac and
without-rbac methods, so mirroring the change here.

* Mount docker socket/dev read-write

This matches the direct docker run commands, which also mount those
resources read-write.
---
 .../k8s-with-rbac/falco-daemonset-configmap.yaml              | 4 +---
 .../k8s-using-daemonset/k8s-without-rbac/falco-daemonset.yaml | 4 +---
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/examples/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap.yaml b/examples/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap.yaml
index 4b979f05..2787c5ec 100644
--- a/examples/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap.yaml
+++ b/examples/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap.yaml
@@ -19,14 +19,12 @@ spec:
           image: sysdig/falco:latest
           securityContext:
             privileged: true
-          args: [ "/usr/bin/falco", "-K", "/var/run/secrets/kubernetes.io/serviceaccount/token", "-k", "https://kubernetes", "-pk"]
+          args: [ "/usr/bin/falco", "-K", "/var/run/secrets/kubernetes.io/serviceaccount/token", "-k", "https://kubernetes.default", "-pk"]
           volumeMounts:
             - mountPath: /host/var/run/docker.sock
               name: docker-socket
-              readOnly: true
             - mountPath: /host/dev
               name: dev-fs
-              readOnly: true
             - mountPath: /host/proc
               name: proc-fs
               readOnly: true
diff --git a/examples/k8s-using-daemonset/k8s-without-rbac/falco-daemonset.yaml b/examples/k8s-using-daemonset/k8s-without-rbac/falco-daemonset.yaml
index 8e8d75e5..b70d9784 100644
--- a/examples/k8s-using-daemonset/k8s-without-rbac/falco-daemonset.yaml
+++ b/examples/k8s-using-daemonset/k8s-without-rbac/falco-daemonset.yaml
@@ -18,14 +18,12 @@ spec:
           image: sysdig/falco:latest
           securityContext:
             privileged: true
-          args: [ "/usr/bin/falco", "-K", "/var/run/secrets/kubernetes.io/serviceaccount/token", "-k", "https://kubernetes", "-pk", "-o", "json_output=true", "-o", "program_output.enabled=true", "-o",  "program_output.program=jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/see_your_slack_team/apps_settings_for/a_webhook_url"]
+          args: [ "/usr/bin/falco", "-K", "/var/run/secrets/kubernetes.io/serviceaccount/token", "-k", "https://kubernetes.default", "-pk", "-o", "json_output=true", "-o", "program_output.enabled=true", "-o",  "program_output.program=jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/see_your_slack_team/apps_settings_for/a_webhook_url"]
           volumeMounts:
             - mountPath: /host/var/run/docker.sock
               name: docker-socket
-              readOnly: true
             - mountPath: /host/dev
               name: dev-fs
-              readOnly: true
             - mountPath: /host/proc
               name: proc-fs
               readOnly: true