falcosecurity · poiana · Oct 9, 2024 · Oct 9, 2024
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -39,6 +39,8 @@ Please remove the leading whitespace before the `/kind <>` you uncommented.
 
 > /area falcosidekick-chart
 
+> /area falco-talon
+
 > /area event-generator-chart
 
 > /area k8s-metacollector

diff --git a/charts/falco-talon/CHANGELOG.md b/charts/falco-talon/CHANGELOG.md
@@ -0,0 +1,13 @@
+# Change Log
+
+This file documents all notable changes to Falco Talon Helm Chart. The release
+numbering uses [semantic versioning](http://semver.org).
+
+## 0.1.1 - 2024-10-01
+
+- Use version `0.1.1`
+- Fix wrong port for the `serviceMonitor`
+
+## 0.1.0 - 2024-09-05
+
+- First release
diff --git a/charts/falco-talon/Chart.yaml b/charts/falco-talon/Chart.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+appVersion: 0.1.1
+description: React to the events from Falco
+name: falco-talon
+version: 0.1.1
+keywords:
+  - falco
+  - monitoring
+  - security
+  - response-engine
+home: https://github.com/falco-talon/falco-talon
+sources:
+  - https://github.com/falco-talon/falco-talon
+maintainers:
+  - name: Issif
+    email: [email protected]
diff --git a/charts/falco-talon/README.gotmpl b/charts/falco-talon/README.gotmpl
@@ -0,0 +1,61 @@
+# Falco Talon
+
+![release](https://flat.badgen.net/github/release/falco-talon/falco-talon/latest?color=green) ![last commit](https://flat.badgen.net/github/last-commit/falco-talon/falco-talon) ![licence](https://flat.badgen.net/badge/license/MIT/blue) ![docker pulls](https://flat.badgen.net/docker/pulls/issif/falco-talon?icon=docker)
+
+## Description
+
+`Falco Talon` is a Response Engine for managing threats in your Kubernetes. It enhances the solutions proposed by the Falco community with a no-code tailor made solution. With easy rules, you can react to `events` from [`Falco`](https://falco.org) in milliseconds.
+
+## Architecture
+
+`Falco Talon` can receive the `events` from [`Falco`](https://falco.org) or [`Falcosidekick`](https://github.com/falco-talon/falcosidekick):
+
+## Documentation
+
+The full documentation is available on its own website: [https://docs.falco-talon.org/docs](https://docs.falco-talon.org/docs).
+
+## Helm
+
+The helm chart is available in the folder [`deployment/helm`](https://github.com/falco-talon/falco-talon/tree/main/deployment/helm).
+
+Two config files are provided:
+* `values.yaml` allows you to configure `Falcon Talon` and the deployment
+* `rules.yaml` contains rules to set
+
+### Install Falco Talon
+
+```shell
+git clone https://github.com/falco-talon/falco-talon.git
+cd deployment/helm/
+helm upgrade -i falco-talon . -n falco --create-namespace -f values.yaml
+```
+
+### Uninstall Falco Talon
+
+```
+helm delete falco-talon -n falco
+````
+
+### Configuration
+
+{{ template "chart.valuesSection" . }}
+
+## Configure Falcosidekick
+
+Once you have installed `Falco Talon` with Helm, you need to connect `Falcosidekick` by adding the flag `--set falcosidekick.config.webhook.address=http://falco-talon:2803`
+
+```shell
+helm upgrade -i falco falco-talon/falco --namespace falco \
+  --create-namespace \
+  --set tty=true \
+  --set falcosidekick.enabled=true \
+  --set falcosidekick.config.talon.address=http://falco-talon:2803
+```
+
+## License
+
+Falco Talon is licensed to you under the **Apache 2.0** open source license.
+
+## Author
+
+Thomas Labarussias (https://github.com/Issif)
diff --git a/charts/falco-talon/README.md b/charts/falco-talon/README.md
@@ -0,0 +1,160 @@
+# Falco Talon
+
+![release](https://flat.badgen.net/github/release/falco-talon/falco-talon/latest?color=green) ![last commit](https://flat.badgen.net/github/last-commit/falco-talon/falco-talon) ![licence](https://flat.badgen.net/badge/license/MIT/blue) ![docker pulls](https://flat.badgen.net/docker/pulls/issif/falco-talon?icon=docker)
+
+## Description
+
+`Falco Talon` is a Response Engine for managing threats in your Kubernetes. It enhances the solutions proposed by the Falco community with a no-code tailor made solution. With easy rules, you can react to `events` from [`Falco`](https://falco.org) in milliseconds.
+
+## Architecture
+
+`Falco Talon` can receive the `events` from [`Falco`](https://falco.org) or [`Falcosidekick`](https://github.com/falco-talon/falcosidekick):
+
+## Documentation
+
+The full documentation is available on its own website: [https://docs.falco-talon.org/docs](https://docs.falco-talon.org/docs).
+
+## Helm
+
+The helm chart is available in the folder [`deployment/helm`](https://github.com/falco-talon/falco-talon/tree/main/deployment/helm).
+
+Two config files are provided:
+* `values.yaml` allows you to configure `Falcon Talon` and the deployment
+* `rules.yaml` contains rules to set
+
+### Install Falco Talon
+
+```shell
+git clone https://github.com/falco-talon/falco-talon.git
+cd deployment/helm/
+helm upgrade -i falco-talon . -n falco --create-namespace -f values.yaml
+```
+
+### Uninstall Falco Talon
+
+```
+helm delete falco-talon -n falco
+````
+
+### Configuration
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` | affinity |
+| config | object | `{"aws":{"accesKey":"","externalId":"","region":"","roleArn":"","secretKey":""},"deduplication":{"leaderElection":true,"timeWindowSeconds":5},"defaultNotifiers":["k8sevents"],"listenAddress":"0.0.0.0","listenPort":2803,"minio":{"accessKey":"","endpoint":"","secretKey":"","useSsl":false},"notifiers":{"elasticsearch":{"createIndexTemplate":true,"numberOfReplicas":1,"numberOfShards":1,"url":""},"loki":{"apiKey":"","customHeaders":[],"hostPort":"","tenant":"","user":""},"slack":{"footer":"https://github.com/falco-talon/falco-talon","format":"long","icon":"https://upload.wikimedia.org/wikipedia/commons/2/26/Circaetus_gallicus_claw.jpg","username":"Falco Talon","webhookUrl":""},"smtp":{"format":"html","from":"","hostPort":"","password":"","tls":false,"to":"","user":""},"webhook":{"url":""}},"otel":{"collectorEndpoint":"","collectorPort":4317,"collectorUseInsecureGrpc":false,"metricsEnabled":false,"tracesEnabled":false},"printAllEvents":false,"rulesFiles":["rules.yaml","rules_override.yaml"],"watchRules":true}` | config of Falco Talon (See https://docs.falco-talon.org/docs/configuration/) |
+| config.aws | object | `{"accesKey":"","externalId":"","region":"","roleArn":"","secretKey":""}` | aws |
+| config.aws.accesKey | string | `""` | access key (if not specified, default access_key from provider credential chain will be used) |
+| config.aws.externalId | string | `""` | external id |
+| config.aws.region | string | `""` | region (if not specified, default region from provider credential chain will be used) |
+| config.aws.roleArn | string | `""` | role arn |
+| config.aws.secretKey | string | `""` | secret key (if not specified, default secret_key from provider credential chain will be used) |
+| config.deduplication | object | `{"leaderElection":true,"timeWindowSeconds":5}` | deduplication of the Falco events |
+| config.deduplication.leaderElection | bool | `true` | enable the leader election for cluster mode |
+| config.deduplication.timeWindowSeconds | int | `5` | duration in seconds for the deduplication time window |
+| config.defaultNotifiers | list | `["k8sevents"]` | default notifiers for all rules |
+| config.listenAddress | string | `"0.0.0.0"` | listen address |
+| config.listenPort | int | `2803` | listen port |
+| config.minio | object | `{"accessKey":"","endpoint":"","secretKey":"","useSsl":false}` | minio |
+| config.minio.accessKey | string | `""` | access key |
+| config.minio.endpoint | string | `""` | endpoint |
+| config.minio.secretKey | string | `""` | secret key |
+| config.minio.useSsl | bool | `false` | use ssl |
+| config.notifiers | object | `{"elasticsearch":{"createIndexTemplate":true,"numberOfReplicas":1,"numberOfShards":1,"url":""},"loki":{"apiKey":"","customHeaders":[],"hostPort":"","tenant":"","user":""},"slack":{"footer":"https://github.com/falco-talon/falco-talon","format":"long","icon":"https://upload.wikimedia.org/wikipedia/commons/2/26/Circaetus_gallicus_claw.jpg","username":"Falco Talon","webhookUrl":""},"smtp":{"format":"html","from":"","hostPort":"","password":"","tls":false,"to":"","user":""},"webhook":{"url":""}}` | notifiers (See https://docs.falco-talon.org/docs/notifiers/list/ for the settings) |
+| config.notifiers.elasticsearch | object | `{"createIndexTemplate":true,"numberOfReplicas":1,"numberOfShards":1,"url":""}` | elasticsearch |
+| config.notifiers.elasticsearch.createIndexTemplate | bool | `true` | create the index template |
+| config.notifiers.elasticsearch.numberOfReplicas | int | `1` | number of replicas |
+| config.notifiers.elasticsearch.numberOfShards | int | `1` | number of shards |
+| config.notifiers.elasticsearch.url | string | `""` | url |
+| config.notifiers.loki | object | `{"apiKey":"","customHeaders":[],"hostPort":"","tenant":"","user":""}` | loki |
+| config.notifiers.loki.apiKey | string | `""` | api key |
+| config.notifiers.loki.customHeaders | list | `[]` | custom headers |
+| config.notifiers.loki.hostPort | string | `""` | host:port |
+| config.notifiers.loki.tenant | string | `""` | tenant |
+| config.notifiers.loki.user | string | `""` | user |
+| config.notifiers.slack | object | `{"footer":"https://github.com/falco-talon/falco-talon","format":"long","icon":"https://upload.wikimedia.org/wikipedia/commons/2/26/Circaetus_gallicus_claw.jpg","username":"Falco Talon","webhookUrl":""}` | slack |
+| config.notifiers.slack.footer | string | `"https://github.com/falco-talon/falco-talon"` | footer |
+| config.notifiers.slack.format | string | `"long"` | format |
+| config.notifiers.slack.icon | string | `"https://upload.wikimedia.org/wikipedia/commons/2/26/Circaetus_gallicus_claw.jpg"` | icon |
+| config.notifiers.slack.username | string | `"Falco Talon"` | username |
+| config.notifiers.slack.webhookUrl | string | `""` | webhook url |
+| config.notifiers.smtp | object | `{"format":"html","from":"","hostPort":"","password":"","tls":false,"to":"","user":""}` | smtp |
+| config.notifiers.smtp.format | string | `"html"` | format |
+| config.notifiers.smtp.from | string | `""` | from |
+| config.notifiers.smtp.hostPort | string | `""` | host:port |
+| config.notifiers.smtp.password | string | `""` | password |
+| config.notifiers.smtp.tls | bool | `false` | enable tls |
+| config.notifiers.smtp.to | string | `""` | to |
+| config.notifiers.smtp.user | string | `""` | user |
+| config.notifiers.webhook | object | `{"url":""}` | webhook |
+| config.notifiers.webhook.url | string | `""` | url |
+| config.otel | object | `{"collectorEndpoint":"","collectorPort":4317,"collectorUseInsecureGrpc":false,"metricsEnabled":false,"tracesEnabled":false}` | open telemetry parameters |
+| config.otel.collectorEndpoint | string | `""` | collector endpoint |
+| config.otel.collectorPort | int | `4317` | collector port |
+| config.otel.collectorUseInsecureGrpc | bool | `false` | use insecure grpc |
+| config.otel.metricsEnabled | bool | `false` | enable otel metrics |
+| config.otel.tracesEnabled | bool | `false` | enable otel traces |
+| config.printAllEvents | bool | `false` | print in stdout all received events, not only those which match a rule |
+| config.rulesFiles | list | `["rules.yaml","rules_override.yaml"]` | list of rules to load |
+| config.watchRules | bool | `true` | auto reload the rules when the files change |
+| extraEnv | list | `[{"name":"LOG_LEVEL","value":"warning"}]` | extra env |
+| image | object | `{"pullPolicy":"Always","registry":"falco.docker.scarf.sh","repository":"issif/falco-talon","tag":""}` | image parameters |
+| image.pullPolicy | string | `"Always"` | The image pull policy |
+| image.registry | string | `"falco.docker.scarf.sh"` | The image registry to pull from |
+| image.repository | string | `"issif/falco-talon"` | The image repository to pull from |
+| image.tag | string | `""` | Override the image tag to pull |
+| imagePullSecrets | list | `[]` | one or more secrets to be used when pulling images |
+| ingress | object | `{"annotations":{},"enabled":false,"hosts":[{"host":"falco-talon.local","paths":[{"path":"/"}]}],"tls":[]}` | ingress parameters |
+| ingress.annotations | object | `{}` | annotations of the ingress |
+| ingress.enabled | bool | `false` | enable the ingress |
+| ingress.hosts | list | `[{"host":"falco-talon.local","paths":[{"path":"/"}]}]` | hosts |
+| ingress.tls | list | `[]` | tls |
+| nameOverride | string | `""` | override name |
+| nodeSelector | object | `{}` | node selector |
+| podAnnotations | object | `{}` | pod annotations |
+| podSecurityContext | object | `{"fsGroup":1234,"runAsUser":1234}` | pod security context |
+| podSecurityContext.fsGroup | int | `1234` | group |
+| podSecurityContext.runAsUser | int | `1234` | user id |
+| podSecurityPolicy | object | `{"create":false}` | pod security policy |
+| podSecurityPolicy.create | bool | `false` | enable the creation of the PSP |
+| priorityClassName | string | `""` | priority class name |
+| rbac | object | `{"caliconetworkpolicies":["get","update","patch","create"],"ciliumnetworkpolicies":["get","update","patch","create"],"clusterroles":["get","delete"],"configmaps":["get","delete"],"daemonsets":["get","delete"],"deployments":["get","delete"],"events":["get","update","patch","create"],"leases":["get","update","patch","watch","create"],"namespaces":["get","delete"],"networkpolicies":["get","update","patch","create"],"nodes":["get","update","patch","watch","create"],"pods":["get","update","patch","delete","list"],"podsEphemeralcontainers":["patch","create"],"podsEviction":["get","create"],"podsExec":["get","create"],"podsLog":["get"],"replicasets":["get","delete"],"roles":["get","delete"],"secrets":["get","delete"],"statefulsets":["get","delete"]}` | rbac |
+| replicaCount | int | `2` | number of running pods |
+| resources | object | `{}` | resources |
+| service | object | `{"annotations":{},"port":2803,"type":"ClusterIP"}` | service parameters |
+| service.annotations | object | `{}` | annotations of the service |
+| service.port | int | `2803` | port of the service |
+| service.type | string | `"ClusterIP"` | type of service |
+| serviceMonitor | object | `{"additionalLabels":{},"enabled":false,"interval":"30s","path":"/metrics","port":"http","relabelings":[],"scheme":"http","scrapeTimeout":"10s","targetLabels":[],"tlsConfig":{}}` | serviceMonitor holds the configuration for the ServiceMonitor CRD. |
+| serviceMonitor.additionalLabels | object | `{}` | additionalLabels specifies labels to be added on the Service Monitor. |
+| serviceMonitor.enabled | bool | `false` | enable the deployment of a Service Monitor for the Prometheus Operator. |
+| serviceMonitor.interval | string | `"30s"` | interval specifies the time interval at which Prometheus should scrape metrics from the service. |
+| serviceMonitor.path | string | `"/metrics"` | path at which the metrics are exposed |
+| serviceMonitor.port | string | `"http"` | portname at which the metrics are exposed |
+| serviceMonitor.relabelings | list | `[]` | relabelings configures the relabeling rules to apply the target’s metadata labels. |
+| serviceMonitor.scheme | string | `"http"` | scheme specifies network protocol used by the metrics endpoint. In this case HTTP. |
+| serviceMonitor.scrapeTimeout | string | `"10s"` | scrapeTimeout determines the maximum time Prometheus should wait for a target to respond to a scrape request. If the target does not respond within the specified timeout, Prometheus considers the scrape as failed for that target. |
+| serviceMonitor.targetLabels | list | `[]` | targetLabels defines the labels which are transferred from the associated Kubernetes service object onto the ingested metrics. |
+| serviceMonitor.tlsConfig | object | `{}` | tlsConfig specifies TLS (Transport Layer Security) configuration for secure communication when scraping metrics from a service. It allows you to define the details of the TLS connection, such as CA certificate, client certificate, and client key. Currently, the k8s-metacollector does not support TLS configuration for the metrics endpoint. |
+| tolerations | list | `[]` | tolerations |
+
+## Configure Falcosidekick
+
+Once you have installed `Falco Talon` with Helm, you need to connect `Falcosidekick` by adding the flag `--set falcosidekick.config.webhook.address=http://falco-talon:2803`
+
+```shell
+helm upgrade -i falco falco-talon/falco --namespace falco \
+  --create-namespace \
+  --set tty=true \
+  --set falcosidekick.enabled=true \
+  --set falcosidekick.config.talon.address=http://falco-talon:2803
+```
+
+## License
+
+Falco Talon is licensed to you under the **Apache 2.0** open source license.
+
+## Author
+
+Thomas Labarussias (https://github.com/Issif)
diff --git a/charts/falco-talon/rules.yaml b/charts/falco-talon/rules.yaml
@@ -0,0 +1,17 @@
+- action: Terminate Pod
+  actionner: kubernetes:terminate
+
+- action: Label Pod as Suspicious
+  actionner: kubernetes:label
+  parameters:
+    labels:
+      analysis/status: "suspicious"
+
+- rule: Terminal shell in container 
+  match:
+    rules:
+      - Terminal shell in container
+    output_fields:
+      - k8s.ns.name!=kube-system, k8s.ns.name!=falco
+  actions:
+    - action: Label Pod as Suspicious
diff --git a/charts/falco-talon/rules_override.yaml b/charts/falco-talon/rules_override.yaml
@@ -0,0 +1,6 @@
+- action: Terminate Pod
+  actionner: kubernetes:terminate
+  parameters:
+    ignore_daemonsets: true
+    ignore_statefulsets: true
+    grace_period_seconds: 2
diff --git a/charts/falco-talon/templates/_helpers.tpl b/charts/falco-talon/templates/_helpers.tpl
@@ -0,0 +1,64 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "falco-talon.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "falco-talon.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Return the appropriate apiVersion for ingress.
+*/}}
+{{- define "falco-talon.ingress.apiVersion" -}}
+  {{- if and (.Capabilities.APIVersions.Has "networking.k8s.io/v1") (semverCompare ">= 1.19-0" .Capabilities.KubeVersion.Version) -}}
+      {{- print "networking.k8s.io/v1" -}}
+  {{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" -}}
+    {{- print "networking.k8s.io/v1beta1" -}}
+  {{- else -}}
+    {{- print "extensions/v1beta1" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "falco-talon.labels" -}}
+helm.sh/chart: {{ include "falco-talon.chart" . }}
+app.kubernetes.io/part-of: {{ include "falco-talon.name" . }}
+app.kubernetes.io/managed-by: {{ .Release.Name }}
+{{ include "falco-talon.selectorLabels" . }}
+{{- if .Values.image.tag }}
+app.kubernetes.io/version: {{ .Values.image.tag }}
+{{- else }}
+app.kubernetes.io/version: {{ .Chart.AppVersion }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "falco-talon.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "falco-talon.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Return if ingress is stable.
+*/}}
+{{- define "falco-talon.ingress.isStable" -}}
+  {{- eq (include "falco-talon.ingress.apiVersion" .) "networking.k8s.io/v1" -}}
+{{- end -}}
+
+{{/*
+Return if ingress supports pathType.
+*/}}
+{{- define "falco-talon.ingress.supportsPathType" -}}
+  {{- or (eq (include "falco-talon.ingress.isStable" .) "true") (and (eq (include "falco-talon.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) -}}
+{{- end -}}
diff --git a/charts/falco-talon/templates/clusterrole.yaml b/charts/falco-talon/templates/clusterrole.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.podSecurityPolicy.create }}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "falco-talon.name" .}}
+  labels:
+    {{- include "falco-talon.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - policy
+    resources:
+      - podsecuritypolicies
+    resourceNames:
+      - {{ template "falco-talon.name" . }}
+    verbs:
+      - use
+{{- end }}
diff --git a/charts/falco-talon/templates/configmap.yaml b/charts/falco-talon/templates/configmap.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "falco-talon.name" . }}-rules
+  labels:
+    {{- include "falco-talon.labels" . | nindent 4 }}
+data:
+  rules.yaml: |-
+{{- range $file := .Values.config.rulesFiles -}}
+{{ $fileContent := $.Files.Get . }}
+{{- $fileContent | nindent 4 -}}
+{{- end -}}