rules of k8saudit-eks plugin use lists defined in falco_rules.yaml, not possible to overwrite

[jtl-novatec]

Describe the bug

When I looked at the k8s_audit_rules.yaml of my falco deployment (uses the k8saudit-eks plugin), I noticed that there are rules that use variables which aren't defined anywhere. For example:

• falco_privileged_images -> only exists inside falco_rules.yaml
• falco_sensitive_mount_images -> doesn't get defined anywhere (there is only a comment about it in falco_rules.yaml)

The rules_file example of the plugin's documentation suggest that you don't mount falco_rules.yaml in the deployment. Therefore, users cannot specify an overwrite to append items to that list.

Expected behaviour

The following commit seems to related to this problem as it tries to introduce / rename lists from falco_ to k8s_audit_. The current version of the rules files already addresses this problem (see). However, it looks like the k8saudit-eks plugin hasn't been updated accordingly.

Environment

Kubernetes via Helm Chart falco-4.3.0

[sboschman]

Hopefully #468 fixes this as well, as this seems to be related to the standard k8saudit rules.

[jtl-novatec]

https://github.com/falcosecurity/plugins/blob/4494313fc7a2d0272f5f865da0734b84303f4a2e/plugins/k8saudit-eks/pkg/k8sauditeks/k8sauditeks.go#L66

The EKS audit plugin has a similar version property, does this have to be bumped as well?

[sboschman]

I don't think so, as the k8saudit-eks plugin itself defines no rules. It uses the default k8saudit rules (from the k8saudit plugin).

falcosecurity   k8saudit                plugin      ghcr.io     falcosecurity/plugins/plugin/k8saudit
falcosecurity   k8saudit-eks            plugin      ghcr.io     falcosecurity/plugins/plugin/k8saudit-eks
falcosecurity   k8saudit-gke            plugin      ghcr.io     falcosecurity/plugins/plugin/k8saudit-gke
falcosecurity   k8saudit-gke-rules      rulesfile   ghcr.io     falcosecurity/plugins/ruleset/k8saudit-gke
falcosecurity   k8saudit-rules          rulesfile   ghcr.io     falcosecurity/plugins/ruleset/k8saudit

[Issif]

Exactly, the k8saudit-eks plugin relies on the k8saudit-rules. By installing the latest version, it should be ok thanks to @sboschman.