The falco-cluster-role ClusterRole is missing the watch privileges on resources in the apps API group #1064
Labels
Comments
JPLachance
added a commit
to JPLachance/falco
that referenced
this issue
Apr 8, 2020
…es API group Fixes falcosecurity#1064 Signed-off-by: Jean-Philippe Lachance <jplachance@coveo.com>
poiana
pushed a commit
that referenced
this issue
Apr 16, 2020
…es API group Fixes #1064 Signed-off-by: Jean-Philippe Lachance <jplachance@coveo.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
In falco/integrations/k8s-using-daemonset/k8s-with-rbac/falco-account.yaml, we create a ClusterRole for the Falco ServiceAccount. I reviewed our kube audit logs and saw that Falco was getting an access denied on:
watch/apis/apps/v1/watch/deployments?pretty=falsewatch/apis/apps/v1/watch/replicasets?pretty=falsewatch/apis/apps/v1/watch/daemonsets?pretty=falseFalco tries those call over and over again which floods audit logs and I'm quite sure Falco is not working as expected without that privilege.
How to reproduce it
Expected behaviour
Falco should not receive a 403.
Environment
Additional context
Please note that we also need to update the Helm chart.
The text was updated successfully, but these errors were encountered: