github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 08:32:12 +00:00
Code Issues Projects Releases Wiki Activity

Introduce missing allowed_full_admin_users macro so its corresponding rule is disabled by default

Browse Source 
Signed-off-by: Vicente Herrera <vicenteherrera@vicenteherrera.com>
This commit is contained in:
Vicente Herrera 2020-04-07 19:19:18 +02:00 committed by poiana
parent 3ce11f093f
commit 9fd08ce3e4
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rules/k8s_audit_rules.yaml
View File

@ -420,6 +420,10 @@
tags: [k8s]
# This macro disables following rule, change to k8s_audit_never_true to enable it
- macro: allowed_full_admin_users
condition: (k8s_audit_always_true)
# This list includes some of the default user names for an administrator in several K8s installations
- list: full_admin_k8s_users
items: ["admin", "kubernetes-admin", "kubernetes-admin@kubernetes", "kubernetes-admin@cluster.local", "minikube-user"]