-
Notifications
You must be signed in to change notification settings - Fork 905
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Update the Puppet module: * Apply puppet-lint recommendations * Update the README since the project moved from draios to falcosecurity in GitHub * Move parameters in their own file + Add the DEB repository automatically + Add the EPEL repository automatically + Add a logrotate configuration * Update the configuration file with all the latest updates falco-CLA-1.0-contributing-entity: Coveo Solutions Inc. falco-CLA-1.0-signed-off-by: Jean-Philippe Lachance <jplachance@coveo.com> * * Set required modules versions properly * Set dependencies between classes * Set the class order * Apply mstemm's code review * * Drop the Puppet 3 support * Use a working version of puppetlabs-apt * Use dependencies to be compatible with Puppet 4.7 and above
- Loading branch information
1 parent
0b29b12
commit 9c57473
Showing
10 changed files
with
294 additions
and
76 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,13 +1,12 @@ | ||
| # == Class: falco::config | ||
| class falco::config inherits falco { | ||
|
|
||
| file { '/etc/falco/falco.yaml': | ||
| notify => Service['falco'], | ||
| ensure => file, | ||
| require => Class['falco::install'], | ||
| notify => Service['falco'], | ||
| owner => 'root', | ||
| group => 'root', | ||
| mode => '0644', | ||
| content => template('falco/falco.yaml.erb'), | ||
| } | ||
|
|
||
| } | ||
| } |
66 changes: 37 additions & 29 deletions
66
integrations/puppet-module/sysdig-falco/manifests/init.pp
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,31 +1,39 @@ | ||
| # == Class: falco | ||
| class falco ( | ||
| $rules_file = [ | ||
| '/etc/falco/falco_rules.yaml', | ||
| '/etc/falco/falco_rules.local.yaml' | ||
| ], | ||
| $json_output = 'false', | ||
| $log_stderr = 'false', | ||
| $log_syslog = 'true', | ||
| $log_level = 'info', | ||
| $priority = 'debug', | ||
| $buffered_outputs = 'true', | ||
| $outputs_rate = 1, | ||
| $outputs_max_burst = 1000, | ||
| $syslog_output = { | ||
| 'enabled' => 'true' | ||
| }, | ||
| $file_output = { | ||
| 'enabled' => 'false', | ||
| 'keep_alive' => 'false', | ||
| 'filename' => '/tmp/falco_events.txt' | ||
| }, | ||
| $program_output = { | ||
| 'enabled' => 'false', | ||
| 'keep_alive' => 'false', | ||
| 'program' => 'curl http://some-webhook.com' | ||
| }, | ||
| ) { | ||
| include falco::install | ||
| include falco::config | ||
| include falco::service | ||
| # Configuration parameters | ||
| $rules_file = $falco::params::rules_file, | ||
| $json_output = $falco::params::json_output, | ||
| $json_include_output_property = $falco::params::json_include_output_property, | ||
|
|
||
| $log_stderr = $falco::params::log_stderr, | ||
| $log_syslog = $falco::params::log_syslog, | ||
| $log_level = $falco::params::log_level, | ||
| $priority = $falco::params::priority, | ||
|
|
||
| $buffered_outputs = $falco::params::buffered_outputs, | ||
| $outputs_rate = $falco::params::outputs_rate, | ||
| $outputs_max_burst = $falco::params::outputs_max_burst, | ||
|
|
||
| $syslog_output = $falco::params::syslog_output, | ||
| $file_output = $falco::params::file_output, | ||
| $stdout_output = $falco::params::stdout_output, | ||
| $webserver = $falco::params::webserver, | ||
| $program_output = $falco::params::program_output, | ||
| $http_output = $falco::params::http_output, | ||
|
|
||
| # Installation parameters | ||
| $package_ensure = $falco::params::package_ensure, | ||
|
|
||
| # Service parameters | ||
| $service_ensure = $falco::params::service_ensure, | ||
| $service_enable = $falco::params::service_enable, | ||
| $service_restart = $falco::params::service_restart, | ||
| ) inherits falco::params { | ||
| contain falco::install | ||
| contain falco::config | ||
| contain falco::service | ||
|
|
||
| Class['::falco::install'] | ||
| -> Class['::falco::config'] | ||
| ~> Class['::falco::service'] | ||
| } |
59 changes: 57 additions & 2 deletions
59
integrations/puppet-module/sysdig-falco/manifests/install.pp
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,61 @@ | ||
| # == Class: falco::install | ||
| class falco::install inherits falco { | ||
| case $::osfamily { | ||
| 'Debian': { | ||
| apt::source { 'sysdig': | ||
| location => 'http://download.draios.com/stable/deb', | ||
| release => 'stable-$(ARCH)/', | ||
| repos => '', | ||
| key => { | ||
| source => 'https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public', | ||
| id => 'D27A72F32D867DF9300A241574490FD6EC51E8C4' | ||
| }, | ||
| } | ||
|
|
||
| ensure_packages(["linux-headers-${::kernelrelease}"]) | ||
|
|
||
| $dependencies = [ | ||
| Apt::Source['sysdig'], | ||
| Package["linux-headers-${::kernelrelease}"], | ||
| ] | ||
| } | ||
| 'RedHat': { | ||
| include 'epel' | ||
|
|
||
| yumrepo { 'sysdig': | ||
| baseurl => 'http://download.draios.com/stable/rpm/$basearch', | ||
| descr => 'Sysdig repository by Draios', | ||
| enabled => 1, | ||
| gpgcheck => 0, | ||
| } | ||
|
|
||
| ensure_packages(["kernel-devel-${::kernelrelease}"]) | ||
|
|
||
| $dependencies = [ | ||
| Yumrepo['sysdig'], | ||
| Class['epel'] | ||
| ] | ||
| } | ||
| default: { | ||
| $dependencies = [] | ||
| } | ||
| } | ||
|
|
||
| package { 'falco': | ||
| ensure => installed, | ||
| ensure => $::falco::package_ensure, | ||
| require => $dependencies, | ||
| } | ||
|
|
||
| if ($::falco::file_output != undef) { | ||
| logrotate::rule { 'falco_output': | ||
| path => $::falco::file_output[filename], | ||
| rotate => 5, | ||
| rotate_every => 'day', | ||
| size => '1M', | ||
| missingok => true, | ||
| compress => true, | ||
| sharedscripts => true, | ||
| postrotate => '/usr/bin/killall -USR1 falco' | ||
| } | ||
| } | ||
| } | ||
| } |
59 changes: 59 additions & 0 deletions
59
integrations/puppet-module/sysdig-falco/manifests/params.pp
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| # == Class falco::params | ||
| # | ||
| class falco::params { | ||
| # Configuration parameters | ||
| $rules_file = [ | ||
| '/etc/falco/falco_rules.yaml', | ||
| '/etc/falco/falco_rules.local.yaml', | ||
| '/etc/falco/k8s_audit_rules.yaml', | ||
| '/etc/falco/rules.d', | ||
| ] | ||
|
|
||
| $json_output = false | ||
| $json_include_output_property = true | ||
|
|
||
| $log_stderr = true | ||
| $log_syslog = true | ||
| $log_level = 'info' | ||
| $priority = 'debug' | ||
|
|
||
| $buffered_outputs = false | ||
| $outputs_rate = 1 | ||
| $outputs_max_burst = 1000 | ||
|
|
||
| $syslog_output = { | ||
| 'enabled' => true | ||
| } | ||
| $file_output = { | ||
| 'enabled' => false, | ||
| 'keep_alive' => false, | ||
| 'filename' => '/var/log/falco-events.log' | ||
| } | ||
| $stdout_output = { | ||
| 'enabled' => true | ||
| } | ||
| $webserver = { | ||
| 'enabled' => false, | ||
| 'listen_port' => 8765, | ||
| 'k8s_audit_endpoint' => '/k8s_audit', | ||
| 'ssl_enabled' => false, | ||
| 'ssl_certificate' => '/etc/falco/falco.pem' | ||
| } | ||
| $program_output = { | ||
| 'enabled' => false, | ||
| 'keep_alive' => false, | ||
| 'program' => 'curl http://some-webhook.com' | ||
| } | ||
| $http_output = { | ||
| 'enabled' => false, | ||
| 'url' => 'http://some.url' | ||
| } | ||
|
|
||
| # Installation parameters | ||
| $package_ensure = 'installed' | ||
|
|
||
| # Service parameters | ||
| $service_ensure = 'running' | ||
| $service_enable = true | ||
| $service_restart = true | ||
| } |
21 changes: 17 additions & 4 deletions
21
integrations/puppet-module/sysdig-falco/manifests/service.pp
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,24 @@ | ||
| # == Class: falco::service | ||
| class falco::service inherits falco { | ||
| validate_bool($falco::service_enable) | ||
|
|
||
| case $falco::service_ensure { | ||
| true, false, 'running', 'stopped': { | ||
| $_service_ensure = $falco::service_ensure | ||
| } | ||
| default: { | ||
| $_service_ensure = undef | ||
| } | ||
| } | ||
|
|
||
| service { 'falco': | ||
| ensure => running, | ||
| enable => true, | ||
| ensure => $_service_ensure, | ||
| enable => $falco::service_enable, | ||
| hasstatus => true, | ||
| hasrestart => true, | ||
| require => Package['falco'], | ||
| hasrestart => $falco::service_restart, | ||
| require => [ | ||
| Class['falco::install'], | ||
| Class['falco::config'], | ||
| ] | ||
| } | ||
| } |
Oops, something went wrong.