github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-25 12:19:56 +00:00
Code Issues Projects Releases Wiki Activity

add known k8s service accounts

Browse Source 
Signed-off-by: Sverre Boschman <1142569+sboschman@users.noreply.github.com>
This commit is contained in:
Sverre Boschman
2021-10-19 14:35:49 +02:00
committed by poiana
parent 8563af8a79
commit 762500a361
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
rules/k8s_audit_rules.yaml
View File

@@ -303,17 +303,28 @@
- list: known_sa_list - list: known_sa_list
items: [ items: [
coredns,
coredns-autoscaler,
cronjob-controller, cronjob-controller,
daemon-set-controller, daemon-set-controller,
deployment-controller, deployment-controller,
disruption-controller, disruption-controller,
endpoint-controller, endpoint-controller,
endpointslice-controller, endpointslice-controller,
endpointslicemirroring-controller,
generic-garbage-collector, generic-garbage-collector,
horizontal-pod-autoscaler,
job-controller,
namespace-controller, namespace-controller,
node-controller,
persistent-volume-binder,
pod-garbage-collector, pod-garbage-collector,
pv-protection-controller,
pvc-protection-controller,
replicaset-controller, replicaset-controller,
resourcequota-controller, resourcequota-controller,
root-ca-cert-publisher,
service-account-controller,
statefulset-controller statefulset-controller
] ]