k8s_audit_rules: kube-apiserver-healthcheck user whitelist #1286
Conversation
|
Welcome @antoinedeschenes! It looks like this is your first PR to falcosecurity/falco 🎉 |
antoinedeschenes
force-pushed
the
patch-1
branch
from
a27ebb1 to
8571499
Compare
kops 1.17 adds a kube-apiserver-healthcheck user: https://github.com/kubernetes/kops/tree/master/cmd/kube-apiserver-healthcheck Logs are currently spammed with: ``` {"output":"18:02:15.466580992: Warning K8s Operation performed by user not in allowed list of users (user=kube-apiserver-healthcheck target=<NA>/<NA> verb=get uri=/healthz resp=200)","priority":"Warning","rule":"Disallowed K8s User","time":"2020-06-29T18:02:15.466580992Z", "output_fields": {"jevt.time":"18:02:15.466580992","ka.response.code":"200","ka.target.name":"<NA>","ka.target.resource":"<NA>","ka.uri":"/healthz","ka.user.name":"kube-apiserver-healthcheck","ka.verb":"get"}} ``` Signed-off-by: Antoine Deschênes <[email protected]>
antoinedeschenes
force-pushed
the
patch-1
branch
from
8571499 to
9e93251
Compare
|
/lgtm |
|
LGTM label has been added. Git tree hash: fde094bc20583e607f6174b67b6c2dfda7fca0c8
|
|
@antoinedeschenes thank you for the contribution! |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fntlnz, Kaizhe, leodido The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fntlnz, Kaizhe, leodido The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What type of PR is this?
/kind bug
/kind rule-update
Any specific area of the project related to this PR?
/area rules
What this PR does / why we need it:
kops 1.17 adds a kube-apiserver-healthcheck user: https://github.com/kubernetes/kops/tree/master/cmd/kube-apiserver-healthcheck
Logs are currently spammed with:
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?:
NONE