Files
falco/rules
Mark Stemm d1c9aae881 rule(list allowed_k8s_users): Add vertical pod autoscaler as known k8s users
https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler

Example alert:
---
K8s Operation performed by user not in allowed list of
users (user=vpa-recommender target=vpa-recommender/endpoints verb=update
uri=core/v1/namespaces/kube-system/endpoints/vpa-recommender resp=200)

K8s Operation performed by user not in allowed list of
users (user=vpa-updater target=vpa-updater/endpoints verb=update
uri=core/v1/namespaces/kube-system/endpoints/vpa-updater resp=200)
---

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2020-05-21 10:57:42 +02:00
..
2019-10-08 16:02:26 +02:00
2019-10-08 16:02:26 +02:00