github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-29 16:17:32 +00:00
Code Issues Projects Releases Wiki Activity

rule(Disallowed K8s User): add known users

Browse Source 
Seen when using K8s cluster autoscaling or addon manager.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
Mark Stemm 2020-08-27 18:00:53 -07:00 committed by poiana
parent 702d989cd0
commit 3fd4464dee
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/k8s_audit_rules.yaml
View File

@ -48,6 +48,8 @@
"minikube", "minikube-user", "kubelet", "kops", "admin", "kube", "kube-proxy", "kube-apiserver-healthcheck", "minikube", "minikube-user", "kubelet", "kops", "admin", "kube", "kube-proxy", "kube-apiserver-healthcheck",
"kubernetes-admin", "kubernetes-admin",
vertical_pod_autoscaler_users, vertical_pod_autoscaler_users,
cluster-autoscaler,
system:addon-manager
] ]
- rule: Disallowed K8s User - rule: Disallowed K8s User