Puppet module fixes

[JPLachance]

Greetings,

We created a simple class that calls the falco class:

# == Class: profile::security::falco::install
#
# Installs Falco with some custom configuration
#
class profile::security::falco::install (
  $log_level       = 'info',
  $package_ensure  = 'installed',
  $service_ensure  = 'running',
  $service_enable  = true,
  $service_restart = true,
) {
  $falco_config_folder = '/etc/falco'

  Class [ '::falco' ]
  -> File [ "$falco_config_folder/falco_rules.local.yaml" ]
  ~> Service['falco']

  class { '::falco':
    log_level       => $log_level,
    log_stderr      => false,
    json_output     => true,
    syslog_output   => {
      'enabled' => false
    },
    file_output     => {
      'enabled'    => true,
      'keep_alive' => true,
      'filename'   => '/var/log/falco-events.log'
    },
    stdout_output   => {
      'enabled' => false
    },
    package_ensure  => $package_ensure,
    service_ensure  => $service_ensure,
    service_enable  => $service_enable,
    service_restart => $service_restart,
  }

  file { "$falco_config_folder/falco_rules.local.yaml":
    ensure  => file,
    owner   => 'root',
    group   => 'root',
    mode    => '0644',
    content => template('profile/security/falco/falco_rules.local.yaml.erb')
  }

  filebeat::prospector { 'falco':
    paths             => [
      '/var/log/falco-events.log'
    ],
    doc_type          => 'json',
    fields            => {
      'ES_INDEX' => 'falco'
    },
    json              => {
      keys_under_root => true,
      message_key     => 'output'
    },
    max_bytes         => 524288,
    fields_under_root => true,
  }
}

We then encoutered multiple bugs and this PR fixes them!

Changes:
! Make sure we add the Sysdig repo and call an update before trying to install Falco
! Remove the require in the service class to fix a dependencies loop
* Bump the version to 0.4.0

The module now installs Falco on dozens of Ubuntu hosts without any issue! :famouslastwords: 😄

falco-CLA-1.0-contributing-entity: Coveo Solutions Inc.
falco-CLA-1.0-signed-off-by: Jean-Philippe Lachance jplachance@coveo.com