rule(list allowed_k8s_users): add "kubernetes-admin" user

[leogr]

What type of PR is this?

/kind rule-update

Any specific area of the project related to this PR?

/area rules

What this PR does / why we need it:

Since kubernetes-admin user is included in some k8s distribution by (it is also used by kubadm and kind), I believe it should be included in the allowed k8s users' list.

Which issue(s) this PR fixes:

Fixes #1186

Special notes for your reviewer:

I've noticed that using kind. Without kubernetes-admin, Falco is triggering an alert for any activity performed by kind.

/milestone 0.25.0

Does this PR introduce a user-facing change?:

rule(list allowed_k8s_users): add "kubernetes-admin" user

[fntlnz]

Can we use the list full_admin_k8s_users here?

[leogr]

Can we use the list full_admin_k8s_users here?

TBH, I'm not sure about that. allowed_k8s_users is used just by one rule (Disallowed K8s User). On the other hand, full_admin_k8s_users seems to be not used. It might be a typo: note the difference between full_admin_k8s_users and admin_k8s_users in the rule condition (the full_ prefix is missing).

cc @Kaizhe @mstemm @vicenteherrera
Any ideas?

[Kaizhe]

/lgtm

[poiana]

LGTM label has been added.

Git tree hash: 4e1a01edd639cb4f39ec232c4d441c91fde38ec8

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fntlnz, Kaizhe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [Kaizhe,fntlnz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment