Commit Graph

31 Commits

Author SHA1 Message Date
Néstor Salceda
1308d7fc35 Put RBAC configuration together
Although it duplicates some code, we prefer duplicate some code and
place this files together.
2018-11-12 17:34:21 +01:00
Néstor Salceda
c24fa324d2 Use a newly created system account instead of my personal one
This restricts attack surface, and work better in term of automation.
2018-11-12 11:49:07 +01:00
Néstor Salceda
e15ee1d28d Use deploy as target instead of name
Maintain consistency between deployments
2018-11-12 11:49:07 +01:00
Néstor Salceda
1da02bf3ff Honor the principle of least privilege for CNCF deployment
Instead of giving a lot of permissions set only the needed ones
2018-11-12 11:49:07 +01:00
Néstor Salceda
4696519deb Honor the principle of least privilege for AWS deployment
Configure needed permisssions instead of using one too permissive.
2018-11-12 11:49:07 +01:00
Néstor Salceda
e321d7c8de Fix script documentation and parameters 2018-11-12 11:49:07 +01:00
Néstor Salceda
071e8de075 Port Kubernetes Response Engine to AWS Technology (#460)
* Add a falco-sns utility which publishes to an AWS SNS topic

* Add an script for deploying function in AWS Lambda

* Bump dependencies

* Use an empty topic and pass AWS_DEFAULT_REGION environment variable

* Add gitignore

* Install ca-certificates.

Are used when we publish to a SNS topic.

* Add myself as a maintainer

* Decode events from SNS based messages

* Add Terraform manifests for getting an EKS up and running

Please, take attention to setup kubectl  and how to join workers:

https://www.terraform.io/docs/providers/aws/guides/eks-getting-started.html#obtaining-kubectl-configuration-from-terraform
https://www.terraform.io/docs/providers/aws/guides/eks-getting-started.html#required-kubernetes-configuration-to-join-worker-nodes

* Ignore terraform generated files

* Remove autogenerated files

* Also publish MessageAttributes which allows to use Filter Policies

This allows to subscribe only to errors, or warnings or several
priorities or by rule names.

It covers same funcionality than NATS publishe does.

* Add kubeconfig and aws-iam-authenticator from heptio to Lambda environment

* Add role trust from cluster creator to lambda role

* Enable CloudWatch for Lambda stuff

* Generate kubeconfig, kubeconfig for lambdas and the lambda arn

This is used by deployment script

* Just a cosmetic change

* Add a Makefile which creates the cluster and configures it

* Use terraform and artifacts which belongs to this repository for deploying

* Move CNCF related deployment to its own directory

* Create only SNS and Lambda stuff.

Assume that the EKS cluster will be created outside

* Bridge IAM with RBAC

This allows to use the role for lambdas for authenticating against
Kubernetes

* Do not rely on terraform for deploying a playbook in lambda

* Clean whitespace

* Move rebased playbooks to functions

* Fix rebase issues with deployment and rbac stuff

* Add a clean target to Makefile

* Inject sys.path modification to Kubeless function deployment

* Add documentation and instructions
2018-11-07 08:34:13 -08:00
Jorge Salamero Sanz
774046d57e Merge pull request #448 from nestorsalceda/capturer-use-volumes
Allow that sysdig/capturer used in Kubernetes Response Engine uses volumes
2018-11-05 10:19:29 +01:00
Kaizhe Huang
438f647984 fix deply_playbook option issue (#452) 2018-11-02 17:20:24 -07:00
Néstor Salceda
c531d91493 Only upload file to S3 if we have credentials and target bucket 2018-10-26 12:49:23 +02:00
Néstor Salceda
48d01203ef Add a makefile for automating docker image building and pushing 2018-10-25 18:07:21 +02:00
Néstor Salceda
43126362c3 Use /captures and allow to be mounted as a volume for placing files on host 2018-10-25 18:07:21 +02:00
Jorge Salamero Sanz
ef9c4ee6ab Merge pull request #442 from nestorsalceda/falco-new-organization
Pull image from falcosecurity
2018-10-22 15:56:31 +02:00
Néstor Salceda
5b060d2c0f Remove the description fields
These can cause conflict with kubeadm k8s clusters
2018-10-19 13:08:20 +02:00
Néstor Salceda
47828f259f Revert "Update Kubeless version"
This reverts commit e614e64331.
2018-10-19 13:06:40 +02:00
Néstor Salceda
e614e64331 Update Kubeless version
We had to remove a couple of lines in the YAML's in order to make it
work.
2018-10-19 12:57:14 +02:00
Néstor Salceda
a3e336f782 Add permissions for functions run in Kubeless 2018-10-19 12:38:02 +02:00
Néstor Salceda
7d24eba1b6 Make playbooks compatible with Python 2.7 2018-10-19 12:36:31 +02:00
Néstor Salceda
a2319d2b8a Pull image from falcosecurity 2018-10-17 18:10:33 +02:00
Néstor Salceda
8d60d374f7 Add an integration with Phantom (#411)
* Add a Phantom Client which creates containers in Phantom server

* Add a playbook for creating events in Phantom using a Falco alert

* Add a flag for configuring SSL checking

* Add a deployable playbook with Kubeless for integrating with Phantom

* Add a README for Phantom integration

* Use named argument as real parameters.

Just cosmetic for clarification

* Call to lower() before checking for case insensitive comparison

* Add the playbook which creates a container in Phantom

I lose it when rebase the branch :P
2018-10-15 13:37:37 -07:00
Néstor Salceda
e4ffa55d58 Add a playbook which starts to capturing data using Sysdig and uploads capture to a s3 bucket (#414)
* Fix spec name

* Add a playbook for capturing stuff using sysdig in a container

* Add event-name to job name for avoid collisions among captures

* Implement job for starting container in Pod in Kubernetes Client

We are going to pick data for all Pod, not limited to one container

* Use sysdig/capturer image for capture and upload to s3 the capture

* There is a bug with environment string splitting in kubeless

https://github.com/kubeless/kubeless/issues/824

So here is a workaround which uses multiple --env flags, one for each
environment.

* Use shorter job name. Kubernetes limit is 64 characters.

* Add a deployable playbook with Kubeless for capturing stuff with Sysdig

* Document the integration with Sysdig capture

* Add Dockerfile for creating sysdig-capturer
2018-10-11 16:55:40 -07:00
Néstor Salceda
f746c4cd57 Add a integration with Demisto (#408)
* Create a DemistoClient for publishing Falco alerts to Demisto

* Extract a function for extracting description from Falco output

* Add a playbook which creates a Falco alert as a Demisto incident

* Add a Kubeless Demisto Handler for Demisto integration

* Document the integration with Demisto

* Allow changing SSL certificate verification

* Fix naming for playbook specs

* Call to lower() before checking value of VERIFY_SSL. Allow case insensitive.
2018-10-10 10:28:35 -07:00
Mark Stemm
2352b96d6b Change license to Apache 2.0 (#419)
Replace references to GNU Public License to Apache license in:

 - COPYING file
 - README
 - all source code below falco
 - rules files
 - rules and code below test directory
 - code below falco directory
 - entrypoint for docker containers (but not the Dockerfiles)

I didn't generally add copyright notices to all the examples files, as
they aren't core falco. If they did refer to the gpl I changed them to
apache.
2018-09-20 11:47:10 -07:00
Néstor Salceda
8bc4a5e38f Move puppet module from examples to integrations 2018-07-13 13:09:13 +02:00
Néstor Salceda
c05319927a Move kubernetes manifests from examples to integrations 2018-07-13 13:08:38 +02:00
Néstor Salceda
1e32d637b2 Move logrotate from examples to integrations 2018-07-13 13:02:26 +02:00
Jorge Salamero Sanz
ccf35552dd Merge pull request #389 from nestorsalceda/kubernetes-response-engine
Add Kubernetes response engine
2018-07-12 18:55:07 +02:00
Néstor Salceda
46b0fd833c Add a README 2018-07-12 17:56:59 +02:00
Néstor Salceda
bed5993500 Create Falco rule from Anchore policy result
When we are trying to run an image with negative policy result from
Anchore, Falco will alert us.
2018-07-12 17:15:21 +02:00
Néstor Salceda
bed360497e Remove repeated configurations and other stuff
As long as this PR merged, this is not needed:

https://github.com/kubernetes/charts/pull/6600
2018-07-11 17:52:11 +02:00
Néstor Salceda
3afe04629a Move kubernetes_response_engine under integrations
A top level directory for this integration could led to confussion.
2018-07-11 17:49:25 +02:00