github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-01 17:12:21 +00:00
Code Issues Projects Releases Wiki Activity

rules update: expand list allowed_k8s_users

Browse Source 
Signed-off-by: kaizhe <derek0405@gmail.com>

add comments

Signed-off-by: kaizhe <derek0405@gmail.com>
This commit is contained in:
kaizhe 2019-10-23 14:17:18 -07:00 committed by Lorenzo Fontana
parent d21e69cf9a
commit 5c61276695
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
rules/k8s_audit_rules.yaml
View File

@ -39,8 +39,9 @@
condition: (jevt.value[/stage]=ResponseStarted) condition: (jevt.value[/stage]=ResponseStarted)
# If you wish to restrict activity to a specific set of users, override/append to this list. # If you wish to restrict activity to a specific set of users, override/append to this list.
# users created by kops are included
- list: allowed_k8s_users - list: allowed_k8s_users
items: ["minikube", "minikube-user", "kubelet", "kops"] items: ["minikube", "minikube-user", "kubelet", "kops", "admin", "kube", "kube-proxy"]
- rule: Disallowed K8s User - rule: Disallowed K8s User
desc: Detect any k8s operation by users outside of an allowed set of users. desc: Detect any k8s operation by users outside of an allowed set of users.