feat(integrations): add the falco integrations from the main falco repo #3

maxgio92 · 2020-04-18T16:22:47Z

start to move the non-official and community maintained integrations of falco from the main
repository.

start to move the non-official and community maintained integrations of falco from the main repository. Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

maxgio92 · 2020-04-18T16:35:28Z

/cc @leodido

leogr · 2020-04-18T19:08:35Z

LGTM!

leodido · 2020-04-18T20:07:04Z

/check-dco

leodido · 2020-04-18T20:07:52Z

integrations/anchore-falco/README.md

+### Build the image
+
+```
+docker build -t sysdig/anchore-falco .


Can we please fix such occurrences? :)

If it's what you mean, I didn't find a Docker hub repository in the falcosecurity organization as for the event-generator. It should still be created, right?

Since there are no other references to sysdig/anchore-falco besides these in the README, I would suggest to just rewrote the instruction in order to use a local image (eg. anchore-falco).

IMHO, it would be enough. If it was actively maintained and required a new repo, we will create it later.

integrations/anchore-falco/README.md

leodido · 2020-04-18T20:08:07Z

integrations/anchore-falco/README.md

+docker run --rm -e ANCHORE_CLI_USER=<user-for-custom-anchore-engine> \
+                -e ANCHORE_CLI_PASS=<password-for-user-for-custom-anchore-engine> \
+                -e ANCHORE_CLI_URL=http://<custom-anchore-engine-host>:8228/v1 \
+                sysdig/anchore-falco


The same as above

leodido · 2020-04-18T20:08:42Z

integrations/k8s-using-daemonset/falco-event-generator-deployment.yaml

+    spec:
+      containers:
+      - name: falco-event-generator
+        image: sysdig/falco-event-generator:latest


This needs probably to be:

renamed

coordinate with the new event-generator at https://github.com/falcosecurity/event-generator

I think that it can be considered done :)

Atm, falcosecurity/event-generator is not yet ready, although a test image already exists.

@leodido WDYT ?
We may keep this on hold until dependant issues are solved. Regarding the event-generator, I guess it will take another week or so.

Done 👉 https://github.com/falcosecurity/event-generator/releases/tag/v0.1.0

@leogr we'll keep the sysdig one for now? Or we can wait for a release of the Docker image v0.1.0? Thank you!

You are welcome!
It's released on Docker Hub too, see my review below

leodido · 2020-04-18T20:09:07Z

integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap-slim.yaml

+          #  - name: FALCOCTL_FALCO_PROBE_URL
+          #    value:
+          #  - name: FALCOCTL_FALCO_PROBE_REPO
+          #    value: "https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/"


This URL can be left as is for now (but it'll need to be updated soon :))

I'm not sure those are working, I propose to fix this later in another PR and unlock this now since we have everything else solved (once suggestions have been applied).
@leodido @maxgio92 WDYT?

I agree @leogr

leodido

Some changes about names, nothing serious :)

Thanks for helping us Max! 🤗

update integrations' version with that of falco's master branch. Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

maxgio92 · 2020-04-19T10:45:28Z

Sure @leodido ! I just replied to the specific reviews for clarifications and updated this branch because it was out-of-sync with the Falco repo's master branch.
Thank you

…itory replace the sysdig organization with the falcosecurity one Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

…odes sync kubernetes deployment and jobs specs from the event-generator git repository Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

leogr

Please, check out my suggestions!

Thank you!

integrations/anchore-falco/README.md

integrations/k8s-using-daemonset/README.md

remove references to remote image published on docker hub Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

remove references to sysdig remote repository Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

remove references to remote image published on docker hub Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

- run only syscall, otherwise also the k8saudit events collection will run - run inside loop Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

- run only syscall, otherwise also the k8saudit events collection will run Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

- run only syscall, otherwise also the k8saudit events collection will run - run inside loop Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

- run only syscall, otherwise also the k8saudit events collection will run Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

set the event-generator github repo https url Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

refer to the official documentation for samples, remove duplicates Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

remove references to local kubernetes config samples, instead refer to the official repo Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

remove kubernetes event-generator config samples from falco k8s deployment integration, instead refer to the official repo Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

remove kubernetes event-generator config samples from falco k8s daemonset integration, instead refer to the official repo Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

maxgio92 · 2020-04-25T14:44:00Z

Just minor fixes to the event-generator stuff.

Btw, I think we could move the event-generator related files to the new event-generator repo and just link them in the documentation here. That would help with the maintenance.

Please, feel free to open a new PR in the new event-generator repo and clean them up from here.

Thanks again!

Hi @leogr, I implemented the suggestions and then cleaned the event-generator sample configurations for consistency; updated the documentation to refer to the new official event-generator's repo.

leogr

LGTM now

thanks @maxgio92

poiana · 2020-04-26T12:56:12Z

LGTM label has been added.

Git tree hash: 6c0e736ff8c61472b935c1592f08ba12148ea2c1

leodido

Approving to unblock and merge it.

FYI the initcontainer in the k8s examples should be updated.

poiana · 2020-04-27T09:50:57Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leodido, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [leodido,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

maxgio92 linked an issue Apr 18, 2020 that may be closed by this pull request

Move here the existing integrations from the main Falco repository #2

Closed

maxgio92 self-assigned this Apr 18, 2020

feat(integrations): add the falco integrations from the main falco repo

b64b152

start to move the non-official and community maintained integrations of falco from the main repository. Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

maxgio92 force-pushed the feature/integrations branch from 3e74b64 to b64b152 Compare April 18, 2020 16:28

maxgio92 requested review from leodido, fntlnz, krisnova and leogr April 18, 2020 16:29

maxgio92 mentioned this pull request Apr 18, 2020

Move here the existing integrations from the main Falco repository #2

Closed

leodido reviewed Apr 18, 2020

View reviewed changes

integrations/anchore-falco/README.md Outdated Show resolved Hide resolved

leodido reviewed Apr 18, 2020

View reviewed changes

leodido suggested changes Apr 18, 2020

View reviewed changes

poiana assigned leodido Apr 18, 2020

fix(version): alling integrations to master

f0df730

update integrations' version with that of falco's master branch. Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

poiana added dco-signoff: yes size/XXL labels Apr 19, 2020

improvement(event-generator): rename the event generator docker repos…

4ee173a

…itory replace the sysdig organization with the falcosecurity one Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

poiana added dco-signoff: no and removed dco-signoff: yes labels Apr 19, 2020

improvement(event-generator): update the event-generator deployment m…

d461daf

…odes sync kubernetes deployment and jobs specs from the event-generator git repository Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

maxgio92 force-pushed the feature/integrations branch from fed9743 to d461daf Compare April 19, 2020 12:36

poiana added dco-signoff: yes and removed dco-signoff: no labels Apr 19, 2020

leogr requested changes Apr 23, 2020

View reviewed changes

maxgio92 and others added 4 commits April 25, 2020 15:33

docs(anchore-falco): update docker image name

e030c47

remove references to remote image published on docker hub Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

docs(anchore-falco): update docker image name

10c70f3

remove references to sysdig remote repository Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

docs(anchore-falco): update docker image name

787a591

remove references to remote image published on docker hub Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

improvement(event-generator): update deploy run arguments

be6eb63

- run only syscall, otherwise also the k8saudit events collection will run - run inside loop Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

maxgio92 force-pushed the feature/integrations branch from 6a739f0 to be6eb63 Compare April 25, 2020 13:51

maxgio92 and others added 10 commits April 25, 2020 15:52

improvement(event-generator): update job run arguments

2837acb

- run only syscall, otherwise also the k8saudit events collection will run Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

improvement(event-generator): update delpoy run arguments

7df50f1

- run only syscall, otherwise also the k8saudit events collection will run - run inside loop Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

improvement(event-generator): update job run arguments

863630e

- run only syscall, otherwise also the k8saudit events collection will run Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

docs(event-generator): fix project reference link

ece7e84

set the event-generator github repo https url Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

docs(event-generator): remove duplicated sample configs

2816ee0

refer to the official documentation for samples, remove duplicates Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

docs(event-generator): remove duplicated sample configs

337adb9

refer to the official documentation for samples, remove duplicates Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

docs(event-generator): remove duplicated sample configs

664f3a8

refer to the official documentation for samples, remove duplicates Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com> Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>

docs(event-generator): refer to official documentation

e9ec752

remove references to local kubernetes config samples, instead refer to the official repo Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

docs(event-generator): refer to official documentation

f6eb86a

remove references to local kubernetes config samples, instead refer to the official repo Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

revert(event-generator): refer to official documentation

4c35201

remove kubernetes event-generator config samples from falco k8s deployment integration, instead refer to the official repo Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

maxgio92 force-pushed the feature/integrations branch from 054d1cf to 4c35201 Compare April 25, 2020 14:37

revert(event-generator): refer to official documentation

91851c2

remove kubernetes event-generator config samples from falco k8s daemonset integration, instead refer to the official repo Signed-off-by: maxgio92 <massimiliano.giovagnoli.1992@gmail.com>

leogr approved these changes Apr 26, 2020

View reviewed changes

poiana added the lgtm label Apr 26, 2020

poiana added the approved label Apr 26, 2020

leodido self-requested a review April 27, 2020 09:49

leodido approved these changes Apr 27, 2020

View reviewed changes

poiana merged commit 64ee514 into master Apr 27, 2020

poiana deleted the feature/integrations branch April 27, 2020 09:52

leogr mentioned this pull request Apr 27, 2020

initcontainer in the k8s examples should be updated #5

Closed

maxgio92 mentioned this pull request May 3, 2020

Manage falco config and rules dependency #10

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(integrations): add the falco integrations from the main falco repo #3

feat(integrations): add the falco integrations from the main falco repo #3

maxgio92 commented Apr 18, 2020

maxgio92 commented Apr 18, 2020

leogr commented Apr 18, 2020

leodido commented Apr 18, 2020

leodido Apr 18, 2020

maxgio92 Apr 19, 2020 •

edited

Loading

leogr Apr 21, 2020

leodido Apr 18, 2020

maxgio92 Apr 19, 2020

leodido Apr 18, 2020

maxgio92 Apr 19, 2020 •

edited

Loading

leogr Apr 19, 2020

leogr Apr 22, 2020

maxgio92 Apr 22, 2020

leogr Apr 23, 2020 •

edited

Loading

leodido Apr 18, 2020

leogr Apr 24, 2020

maxgio92 Apr 25, 2020

leodido left a comment

maxgio92 commented Apr 19, 2020

leogr left a comment

maxgio92 commented Apr 25, 2020

leogr left a comment

poiana commented Apr 26, 2020

leodido left a comment

poiana commented Apr 27, 2020

feat(integrations): add the falco integrations from the main falco repo #3

feat(integrations): add the falco integrations from the main falco repo #3

Conversation

maxgio92 commented Apr 18, 2020

maxgio92 commented Apr 18, 2020

leogr commented Apr 18, 2020

leodido commented Apr 18, 2020

Choose a reason for hiding this comment

maxgio92 Apr 19, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maxgio92 Apr 19, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leogr Apr 23, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leodido left a comment

Choose a reason for hiding this comment

maxgio92 commented Apr 19, 2020

leogr left a comment

Choose a reason for hiding this comment

maxgio92 commented Apr 25, 2020

leogr left a comment

Choose a reason for hiding this comment

poiana commented Apr 26, 2020

leodido left a comment

Choose a reason for hiding this comment

poiana commented Apr 27, 2020

maxgio92 Apr 19, 2020 •

edited

Loading

maxgio92 Apr 19, 2020 •

edited

Loading

leogr Apr 23, 2020 •

edited

Loading