github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-11 11:02:08 +00:00
Code Issues Projects Releases Wiki Activity

falco: add healthz endpoint

Browse Source 
Signed-off-by: Carlos Panato <ctadeu@gmail.com>
This commit is contained in:
Carlos Panato 2021-01-30 14:33:04 +01:00 committed by poiana
parent 6408270476
commit f140cdfd68
5 changed files with 35 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
falco.yaml
View File

@ -152,11 +152,14 @@ stdout_output:
# $ openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem # $ openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
# $ cat certificate.pem key.pem > falco.pem # $ cat certificate.pem key.pem > falco.pem
# $ sudo cp falco.pem /etc/falco/falco.pem # $ sudo cp falco.pem /etc/falco/falco.pem
#
# It also exposes a healthy endpoint that can be used to check if Falco is up and running
# By default the endpoint is /healthz
webserver: webserver:
enabled: true enabled: true
listen_port: 8765 listen_port: 8765
k8s_audit_endpoint: /k8s-audit k8s_audit_endpoint: /k8s-audit
k8s_healthz_endpoint: /healthz
ssl_enabled: false ssl_enabled: false
ssl_certificate: /etc/falco/falco.pem ssl_certificate: /etc/falco/falco.pem

2
userspace/falco/configuration.cpp
View File

@ -34,6 +34,7 @@ falco_configuration::falco_configuration():
m_webserver_enabled(false), m_webserver_enabled(false),
m_webserver_listen_port(8765), m_webserver_listen_port(8765),
m_webserver_k8s_audit_endpoint("/k8s-audit"), m_webserver_k8s_audit_endpoint("/k8s-audit"),
m_webserver_k8s_healthz_endpoint("/healthz"),
m_webserver_ssl_enabled(false), m_webserver_ssl_enabled(false),
m_config(NULL) m_config(NULL)
{ {
@ -193,6 +194,7 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio
m_webserver_enabled = m_config->get_scalar<bool>("webserver", "enabled", false); m_webserver_enabled = m_config->get_scalar<bool>("webserver", "enabled", false);
m_webserver_listen_port = m_config->get_scalar<uint32_t>("webserver", "listen_port", 8765); m_webserver_listen_port = m_config->get_scalar<uint32_t>("webserver", "listen_port", 8765);
m_webserver_k8s_audit_endpoint = m_config->get_scalar<string>("webserver", "k8s_audit_endpoint", "/k8s-audit"); m_webserver_k8s_audit_endpoint = m_config->get_scalar<string>("webserver", "k8s_audit_endpoint", "/k8s-audit");
m_webserver_k8s_healthz_endpoint = m_config->get_scalar<string>("webserver", "k8s_healthz_endpoint", "/healthz");
m_webserver_ssl_enabled = m_config->get_scalar<bool>("webserver", "ssl_enabled", false); m_webserver_ssl_enabled = m_config->get_scalar<bool>("webserver", "ssl_enabled", false);
m_webserver_ssl_certificate = m_config->get_scalar<string>("webserver", "ssl_certificate", "/etc/falco/falco.pem"); m_webserver_ssl_certificate = m_config->get_scalar<string>("webserver", "ssl_certificate", "/etc/falco/falco.pem");

1
userspace/falco/configuration.h
View File

@ -216,6 +216,7 @@ public:
bool m_webserver_enabled; bool m_webserver_enabled;
uint32_t m_webserver_listen_port; uint32_t m_webserver_listen_port;
std::string m_webserver_k8s_audit_endpoint; std::string m_webserver_k8s_audit_endpoint;
std::string m_webserver_k8s_healthz_endpoint;
bool m_webserver_ssl_enabled; bool m_webserver_ssl_enabled;
std::string m_webserver_ssl_certificate; std::string m_webserver_ssl_certificate;
std::set<syscall_evt_drop_mgr::action> m_syscall_evt_drop_actions; std::set<syscall_evt_drop_mgr::action> m_syscall_evt_drop_actions;

14
userspace/falco/webserver.cpp
View File

@ -34,6 +34,15 @@ k8s_audit_handler::~k8s_audit_handler()
{ {
} }
bool k8s_healthz_handler::handleGet(CivetServer *server, struct mg_connection *conn)
{
const std::string status_body = "{\"status\": \"ok\"}";
mg_send_http_ok(conn, "application/json", status_body.size());
mg_printf(conn, "%s", status_body.c_str());
return true;
}
bool k8s_audit_handler::accept_data(falco_engine *engine, bool k8s_audit_handler::accept_data(falco_engine *engine,
falco_outputs *outputs, falco_outputs *outputs,
std::string &data, std::string &data,
@ -148,7 +157,7 @@ bool k8s_audit_handler::handlePost(CivetServer *server, struct mg_connection *co
return true; return true;
} }
std::string ok_body = "<html><body>Ok</body></html>"; const std::string ok_body = "<html><body>Ok</body></html>";
mg_send_http_ok(conn, "text/html", ok_body.size()); mg_send_http_ok(conn, "text/html", ok_body.size());
mg_printf(conn, "%s", ok_body.c_str()); mg_printf(conn, "%s", ok_body.c_str());
@ -233,6 +242,8 @@ void falco_webserver::start()
m_k8s_audit_handler = make_unique<k8s_audit_handler>(m_engine, m_outputs); m_k8s_audit_handler = make_unique<k8s_audit_handler>(m_engine, m_outputs);
m_server->addHandler(m_config->m_webserver_k8s_audit_endpoint, *m_k8s_audit_handler); m_server->addHandler(m_config->m_webserver_k8s_audit_endpoint, *m_k8s_audit_handler);
m_k8s_healthz_handler = make_unique<k8s_healthz_handler>();
m_server->addHandler(m_config->m_webserver_k8s_healthz_endpoint, *m_k8s_healthz_handler);
} }
void falco_webserver::stop() void falco_webserver::stop()
@ -241,5 +252,6 @@ void falco_webserver::stop()
{ {
m_server = NULL; m_server = NULL;
m_k8s_audit_handler = NULL; m_k8s_audit_handler = NULL;
m_k8s_healthz_handler = NULL;
} }
} }

15
userspace/falco/webserver.h
View File

@ -41,6 +41,20 @@ private:
bool accept_uploaded_data(std::string &post_data, std::string &errstr); bool accept_uploaded_data(std::string &post_data, std::string &errstr);
}; };
class k8s_healthz_handler : public CivetHandler
{
public:
k8s_healthz_handler()
{
}
virtual ~k8s_healthz_handler()
{
}
bool handleGet(CivetServer *server, struct mg_connection *conn);
};
class falco_webserver class falco_webserver
{ {
public: public:
@ -60,4 +74,5 @@ private:
falco_outputs *m_outputs; falco_outputs *m_outputs;
unique_ptr<CivetServer> m_server; unique_ptr<CivetServer> m_server;
unique_ptr<k8s_audit_handler> m_k8s_audit_handler; unique_ptr<k8s_audit_handler> m_k8s_audit_handler;
unique_ptr<k8s_healthz_handler> m_k8s_healthz_handler;
}; };