github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-11 11:02:08 +00:00
Code Issues Projects Releases Wiki Activity

reformat known_sa_list

Browse Source 
Signed-off-by: Sverre Boschman <1142569+sboschman@users.noreply.github.com>
This commit is contained in:
Sverre Boschman 2021-10-19 14:25:41 +02:00 committed by poiana
parent f7893fbd14
commit 8563af8a79
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
rules/k8s_audit_rules.yaml
View File

@ -302,9 +302,20 @@
items: [] items: []
- list: known_sa_list - list: known_sa_list
items: ["pod-garbage-collector","resourcequota-controller","cronjob-controller","generic-garbage-collector", items: [
"daemon-set-controller","endpointslice-controller","deployment-controller", "replicaset-controller", cronjob-controller,
"endpoint-controller", "namespace-controller", "statefulset-controller", "disruption-controller"] daemon-set-controller,
deployment-controller,
disruption-controller,
endpoint-controller,
endpointslice-controller,
generic-garbage-collector,
namespace-controller,
pod-garbage-collector,
replicaset-controller,
resourcequota-controller,
statefulset-controller
]
- macro: trusted_sa - macro: trusted_sa
condition: (ka.target.name in (known_sa_list, user_known_sa_list)) condition: (ka.target.name in (known_sa_list, user_known_sa_list))