search

falcosecurity / plugins

Falco plugins registry
Apache License 2.0
82 stars 73 forks source link

k8s audit plug-ins for AKS and GCP #243

Open alfredomagallon opened 1 year ago

alfredomagallon commented 1 year ago

Motivation

As today most projects are multi-cloud, we would need k8saudit plug-in for at least AKS and GCP

Feature

k8s audit plug-ins for AKS and GKE

Alternatives

Today's alternative is creating a messaging stack on each CSP to send logs to the falco Web service

jasondellaluce commented 1 year ago

Moving this into the plugins repository.

poiana commented 1 year ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

jasondellaluce commented 1 year ago

/remove-lifecycle stale

jasondellaluce commented 1 year ago

/help

poiana commented 1 year ago

@jasondellaluce: This request has been marked as needing help from a contributor.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed by commenting with the /remove-help command.

In response to [this](https://github.com/falcosecurity/plugins/issues/243): >/help > Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
jasondellaluce commented 1 year ago

cc @ahmedameenaim

poiana commented 11 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana commented 10 months ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

poiana commented 9 months ago

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

poiana commented 9 months ago

@poiana: Closing this issue.

In response to [this](https://github.com/falcosecurity/plugins/issues/243#issuecomment-1817542030): >Rotten issues close after 30d of inactivity. > >Reopen the issue with `/reopen`. > >Mark the issue as fresh with `/remove-lifecycle rotten`. > >Provide feedback via https://github.com/falcosecurity/community. >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
jasondellaluce commented 9 months ago

/remove-lifecycle rotten

/reopen

poiana commented 9 months ago

@jasondellaluce: Reopened this issue.

In response to [this](https://github.com/falcosecurity/plugins/issues/243#issuecomment-1818837022): >/remove-lifecycle rotten > >/reopen Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
poiana commented 6 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

Issif commented 5 months ago

A plugin for GKE is in progress https://github.com/falcosecurity/plugins/pull/424

poiana commented 4 months ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

jasondellaluce commented 4 months ago

@alfredomagallon for GKE I think we should be all set now: https://github.com/falcosecurity/plugins/tree/main/plugins/k8saudit-gke

So I guess the only one remaining among the requested ones is the AKS integration. cc @leogr

/remove-lifecycle rotten

jemag commented 3 months ago

Regarding the AKS plugin, this project was created a while ago by sysdig: https://github.com/sysdiglabs/aks-audit-log .

Since it wasn't too actively maintained and we wanted to be able to make modifications (and not too familiar with C#), we created our own version in Go here : https://github.com/dfo-mpo/aks-audit-log-go . It is still a fairly young project, but we are actively using it at the moment.

Not sure if our Go code fits the needs here, but if it does it could serve as a starting point or we could potentially consider giving out the codebase to the falcosecurity project (I would have to discuss this option internally first).

leogr commented 3 months ago

@jemag, have you considered transforming it into a plugin? :thinking: it would be the best option IMO, and in case you consider contributing it to falcosecurity org, we can help maintain it.

jemag commented 3 months ago

To be honest, we never thought of it. Initially there was only the sysdig code available and doing a rewrite in Go with the same approach was the fastest route for us.

I think it seems like the most reasonable route to go for in the future. The problem is we are already pretty overloaded on our side and don't really have the bandwidth to allocate to transforming it, especially since it already works for us (we are a very small team). I doubt we would be able to work on this until at least a couple of months.

If anyone wants to use it as inspiration for creating a plugin in the meantime, feel free to do so. Otherwise, individuals waiting for the plugin can also use it as is in the meantime (we'll likely publish official container images in the very near future).

If things change on our side and we have some time to allocate to a transformation, I'll provide an update in the issue.

leogr commented 3 months ago

Thank you @jemag

I believe transforming it into a plugin would not require too much for a developer already familiar with our plugin ecosystem. I totally understand your point about the bandwidth, and it's totally fair :+1: Likely, @Issif can help (as he commented here) without any significant effort from your side. Let's see what we can do :)

poiana commented 3 weeks ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

leogr commented 3 weeks ago

/remove-lifecycle stale

We only miss k8saudit for AKS. Although we don't have any estimation for that yet, I wanted to let you know that @alacuku , @Issif, and I are trying to make this happen. So stay tuned. Ofc, any help is welcome.