From 5c61276695f09f1cf9dada8bb8e8b0ae1143ecac Mon Sep 17 00:00:00 2001 From: kaizhe Date: Wed, 23 Oct 2019 14:17:18 -0700 Subject: [PATCH] rules update: expand list allowed_k8s_users Signed-off-by: kaizhe add comments Signed-off-by: kaizhe --- rules/k8s_audit_rules.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/k8s_audit_rules.yaml b/rules/k8s_audit_rules.yaml index 08f18f57..a783dcf6 100644 --- a/rules/k8s_audit_rules.yaml +++ b/rules/k8s_audit_rules.yaml @@ -39,8 +39,9 @@ condition: (jevt.value[/stage]=ResponseStarted) # If you wish to restrict activity to a specific set of users, override/append to this list. +# users created by kops are included - list: allowed_k8s_users - items: ["minikube", "minikube-user", "kubelet", "kops"] + items: ["minikube", "minikube-user", "kubelet", "kops", "admin", "kube", "kube-proxy"] - rule: Disallowed K8s User desc: Detect any k8s operation by users outside of an allowed set of users.