github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-01 22:47:46 +00:00
Code Issues Projects Releases Wiki Activity

reformat known_sa_list

Browse Source 
Signed-off-by: Sverre Boschman <1142569+sboschman@users.noreply.github.com>
This commit is contained in:
Sverre Boschman 2021-10-19 14:25:41 +02:00 committed by poiana
parent f7893fbd14
commit 8563af8a79
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
rules/k8s_audit_rules.yaml
View File

@ -302,9 +302,20 @@
items: []
- list: known_sa_list
items: ["pod-garbage-collector","resourcequota-controller","cronjob-controller","generic-garbage-collector",
"daemon-set-controller","endpointslice-controller","deployment-controller", "replicaset-controller",
"endpoint-controller", "namespace-controller", "statefulset-controller", "disruption-controller"]
items: [
cronjob-controller,
daemon-set-controller,
deployment-controller,
disruption-controller,
endpoint-controller,
endpointslice-controller,
generic-garbage-collector,
namespace-controller,
pod-garbage-collector,
replicaset-controller,
resourcequota-controller,
statefulset-controller
]
- macro: trusted_sa
condition: (ka.target.name in (known_sa_list, user_known_sa_list))