Files
falco/examples/k8s_audit_config/audit-sink.yaml.in
Mark Stemm f2adedec2f Also include ResponseStarted
Required to grab pod exec actions.
2019-05-24 18:42:26 +02:00

17 lines
334 B
YAML

apiVersion: auditregistration.k8s.io/v1alpha1
kind: AuditSink
metadata:
name: falco-audit-sink
spec:
policy:
level: RequestResponse
stages:
- ResponseComplete
- ResponseStarted
webhook:
throttle:
qps: 10
burst: 15
clientConfig:
url: "http://$FALCO_SERVICE_CLUSTERIP:8765/k8s_audit"