mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 03:49:36 +00:00
6a6342adc6
In K8s 1.13, there's a new mechanism for k8s audit logs using Audit Sinks, which can be created and managed like other k8s objects. Add instructions for enabling k8s audit logging for 1.13. The patching script is still required, as dynamic audit is not a GA feature and needs to be enabled. Also, the audit sink config is a template and needs to be filled in with the cluster ip address, like the webhook config for 1.11.
42 lines
1.3 KiB
Bash
42 lines
1.3 KiB
Bash
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
VARIANT=${1:-minikube}
|
|
AUDIT_TYPE=${2:-static}
|
|
|
|
if [ $VARIANT == "minikube" ]; then
|
|
APISERVER_HOST=$(minikube ip)
|
|
SSH_KEY=$(minikube ssh-key)
|
|
SSH_USER=docker
|
|
MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
|
|
fi
|
|
|
|
if [ $VARIANT == "kops" ]; then
|
|
# APISERVER_HOST=api.your-kops-cluster-name.com
|
|
SSH_KEY=~/.ssh/id_rsa
|
|
SSH_USER=admin
|
|
MANIFEST=/etc/kubernetes/manifests/kube-apiserver.manifest
|
|
|
|
if [ -z "${APISERVER_HOST+xxx}" ]; then
|
|
echo "***You must specify APISERVER_HOST with the name of your kops api server"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
echo "***Copying apiserver config patch script to apiserver..."
|
|
ssh -i $SSH_KEY $SSH_USER@$APISERVER_HOST "sudo mkdir -p /var/lib/k8s_audit && sudo chown $SSH_USER /var/lib/k8s_audit"
|
|
scp -i $SSH_KEY apiserver-config.patch.sh $SSH_USER@$APISERVER_HOST:/var/lib/k8s_audit
|
|
|
|
if [ $AUDIT_TYPE == "static" ]; then
|
|
echo "***Copying audit policy/webhook files to apiserver..."
|
|
scp -i $SSH_KEY audit-policy.yaml $SSH_USER@$APISERVER_HOST:/var/lib/k8s_audit
|
|
scp -i $SSH_KEY webhook-config.yaml $SSH_USER@$APISERVER_HOST:/var/lib/k8s_audit
|
|
fi
|
|
|
|
echo "***Modifying k8s apiserver config (will result in apiserver restarting)..."
|
|
|
|
ssh -i $SSH_KEY $SSH_USER@$APISERVER_HOST "sudo bash /var/lib/k8s_audit/apiserver-config.patch.sh $MANIFEST $VARIANT $AUDIT_TYPE"
|
|
|
|
echo "***Done!"
|