From 0b516b7d424fa42b16b965384d44fa5e2ebd78be Mon Sep 17 00:00:00 2001 From: DingGGu Date: Tue, 10 Nov 2020 16:12:01 +0900 Subject: [PATCH] rule(macro user_known_k8s_ns_kube_system_images): add new macro image name inside kube-system namespace Signed-off-by: DingGGu --- rules/falco_rules.yaml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 1b2c2669..0fdddcd5 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -2872,14 +2872,19 @@ - list: k8s_client_binaries items: [docker, kubectl, crictl] +- macro: user_known_k8s_ns_kube_system_images + condition: > + ( + container.image.repository=k8s.gcr.io/fluentd-gcp-scaler or + container.image.repository=k8s.gcr.io/node-problem-detector/node-problem-detector + ) + + # Whitelist for known docker client binaries run inside container # - k8s.gcr.io/fluentd-gcp-scaler in GCP/GKE - macro: user_known_k8s_client_container condition: > - (k8s.ns.name="kube-system" and ( - container.image.repository=k8s.gcr.io/fluentd-gcp-scaler or - container.image.repository=k8s.gcr.io/node-problem-detector/node-problem-detector - )) or + (k8s.ns.name="kube-system" and user_known_k8s_ns_kube_system_images) or container.image.repository=mcr.microsoft.com/aks/hcp/hcp-tunnel-front - macro: user_known_k8s_client_container_parens