Falco：在使用 k8saudit 插件部署 falco 后，无法在 Falcosidekick UI 中进入数据源 k8s-audit答案

【问题标题】：Falco: couldn't get in datasource k8s-audit in Falcosidekick UI after deploy falco with k8saudit pluginFalco：在使用 k8saudit 插件部署 falco 后，无法在 Falcosidekick UI 中进入数据源 k8s-audit
【发布时间】：2022-10-09 00:28:46
【问题描述】：

我的测试环境： Kubernetes：1.20.15 猎鹰：0.32.1 falco 舵图：falco-2.0.7

我的部署过程。

使用 helm 和 k8saudit 插件部署 falco

$helm repo add falcosecurity https://falcosecurity.github.io/charts
$helm install falco falcosecurity/falco --namespace falco -f ./falco-values-k8saudit.yaml \
  --set falco.grpc.enabled=true \
  --set falco.grpc_output.enabled=true \
  --set falcosidekick.enabled=true \
  --set falcosidekick.webui.enabled=true \
  --set falcosidekick.webui.redis.storageClass="rbd" \
  --set falcosidekick.webui.redis.storageSize="5Gi"

falco-value-k8saudit.yaml is identical to: https://github.com/falcosecurity/charts/blob/master/falco/values-k8saudit.yaml

$ kubectl get all -n falco
NAME                                          READY   STATUS    RESTARTS   AGE
pod/falco-774d78d77-bccdt                     1/1     Running   0          20m
pod/falco-falcosidekick-9957d4fcd-td4b4       1/1     Running   0          20m
pod/falco-falcosidekick-9957d4fcd-v5wxq       1/1     Running   0          20m
pod/falco-falcosidekick-ui-7d6b97856d-jjdcw   1/1     Running   2          20m
pod/falco-falcosidekick-ui-7d6b97856d-s5xj6   1/1     Running   1          20m
pod/falco-falcosidekick-ui-redis-0            1/1     Running   0          20m

NAME                                   TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE
service/falco-falcosidekick            ClusterIP   10.104.198.200   <none>        2801/TCP         20m
service/falco-falcosidekick-ui         ClusterIP   10.109.144.99    <none>        2802/TCP         20m
service/falco-falcosidekick-ui-redis   ClusterIP   10.97.32.201     <none>        6379/TCP         20m
service/falco-k8saudit-webhook         NodePort    10.103.65.15     <none>        9765:30007/TCP   20m

NAME                                     READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/falco                    1/1     1            1           20m
deployment.apps/falco-falcosidekick      2/2     2            2           20m
deployment.apps/falco-falcosidekick-ui   2/2     2            2           20m

NAME                                                DESIRED   CURRENT   READY   AGE
replicaset.apps/falco-774d78d77                     1         1         1       20m
replicaset.apps/falco-falcosidekick-9957d4fcd       2         2         2       20m
replicaset.apps/falco-falcosidekick-ui-7d6b97856d   2         2         2       20m

NAME                                            READY   AGE
statefulset.apps/falco-falcosidekick-ui-redis   1/1     20m

创建 webhook 配置，参考https://github.com/falcosecurity/evolution/blob/master/examples/k8s_audit_config/webhook-config.yaml.in

$cat falco-webhook-config.yaml
---
apiVersion: v1
kind: Config
clusters:
- name: falco
  cluster:
    server: http://10.103.65.15:8765/k8s-audit
contexts:
- context:
    cluster: falco
    user: ""
  name: default-context
current-context: default-context
preferences: {}
users: []

启用审计日志并在 kube-apiserver.yaml 中设置 webhook 配置文件

kubectl logs falco-774d78d77-bccdt -n falco
Wed Aug 10 05:47:20 2022: Falco version 0.32.1
Wed Aug 10 05:47:20 2022: Falco initialized with configuration file /etc/falco/falco.yaml
Wed Aug 10 05:47:20 2022: Loading plugin (k8saudit) from file /usr/share/falco/plugins/libk8saudit.so
Wed Aug 10 05:47:20 2022: Loading plugin (json) from file /usr/share/falco/plugins/libjson.so
Wed Aug 10 05:47:20 2022: Loading rules from file /etc/falco/k8s_audit_rules.yaml:
Wed Aug 10 05:47:20 2022: gRPC server threadiness equals to 4
Wed Aug 10 05:47:20 2022: Starting internal webserver, listening on port 8765
Wed Aug 10 05:47:20 2022: Starting gRPC server at unix:///var/run/falco/falco.sock

但我无法在 falcosidekick ui 中获取任何数据

问题：

谁能帮忙检查我是否遗漏了什么？
falcosidekick ui 是否支持 k8saudit 插件？
非常感谢任何支持。

【问题讨论】：

标签： kubernetes falco

【解决方案1】：

In version 0.32.0，Kubernetes 审计事件功能变成了 plugin，因此插件不会通过 Falco 内部 Web 服务器 8765 接收流量，而是在不同的端口（您可以在服务 falco-k8saudit 中看到的 9765）上侦听事件-webhook 如上所示。

因此，在 falco-webhook-config.yaml 配置中将端口替换为 9765 并重新启动 API，您应该开始在 Falco 中看到 K8s 事件，因此也在 Falcosidekick UI 中。

【讨论】：