mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 19:44:57 +00:00
6a6342adc6
In K8s 1.13, there's a new mechanism for k8s audit logs using Audit Sinks, which can be created and managed like other k8s objects. Add instructions for enabling k8s audit logging for 1.13. The patching script is still required, as dynamic audit is not a GA feature and needs to be enabled. Also, the audit sink config is a template and needs to be filled in with the cluster ip address, like the webhook config for 1.11.
16 lines
310 B
YAML
16 lines
310 B
YAML
apiVersion: auditregistration.k8s.io/v1alpha1
|
|
kind: AuditSink
|
|
metadata:
|
|
name: falco-audit-sink
|
|
spec:
|
|
policy:
|
|
level: RequestResponse
|
|
stages:
|
|
- ResponseComplete
|
|
webhook:
|
|
throttle:
|
|
qps: 10
|
|
burst: 15
|
|
clientConfig:
|
|
url: "http://$FALCO_SERVICE_CLUSTERIP:8765/k8s_audit"
|