whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix links into Audit with Falco section (#15958)

Browse Source 
* Fix links into Audit with Falco section

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>

* Fix typo in audit docs

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>

Co-Authored-By: Tim Bannister <tim@scalefactory.com>
This commit is contained in:
Leo Di Donato
2019-08-21 18:08:00 +02:00
committed by Kubernetes Prow Robot
parent 4db47aea47
commit 570ba84ac7
1 changed files with 23 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tasks/debug-application-cluster/audit.md
+6 -8
View File
@@ -493,16 +493,16 @@ plugin which supports full-text search and analytics.
### Use Falco to collect audit events
[Falco](falco_website) is an open source project for intrusion and abnormality detection for Cloud Native platforms.
[Falco][falco_website] is an open source project for intrusion and abnormality detection for Cloud Native platforms.
This section describes how to set up Falco, how to send audit events to the Kubernetes Audit endpoint exposed by Falco, and how Falco applies a set of rules to automatically detect suspicious behavior.
#### Install Falco
Install Falco by using one of the following methods:
- [Standalone Falco](falco_installation)
- [Kubernetes DaemonSet](falco_installation)
- [Falco Helm Chart](falco_helm_chart)
- [Standalone Falco][falco_installation]
- [Kubernetes DaemonSet][falco_installation]
- [Falco Helm Chart][falco_helm_chart]
Once Falco is installed make sure it is configured to expose the Audit webhook. To do so, use the following configuration:
@@ -521,7 +521,6 @@ This configuration is typically found in the `/etc/falco/falco.yaml` file. If Fa
1. Create a [kubeconfig file](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) for the [kube-apiserver][kube-apiserver] webhook audit backend.
```shell
cat <<EOF > /etc/kubernetes/audit-webhook-kubeconfig
apiVersion: v1
kind: Config
@@ -538,9 +537,8 @@ This configuration is typically found in the `/etc/falco/falco.yaml` file. If Fa
preferences: {}
users: []
EOF
```
2. Start [kube-apiserver][kube-apiserver] with the following options:
1. Start [kube-apiserver][kube-apiserver] with the following options:
```shell
--audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-webhook-config-file=/etc/kubernetes/audit-webhook-kubeconfig
@@ -579,7 +577,7 @@ A second class of rules tracks resources being created or destroyed, including:
The final class of rules simply displays any Audit Event received by Falco. This rule is disabled by default, as it can be quite noisy.
For further details refer to the this [Falco documentation page](falco_ka_docs).
For further details, see [Kubernetes Audit Events][falco_ka_docs] in the Falco documentation.
[kube-apiserver]: /docs/admin/kube-apiserver
[auditing-proposal]: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/auditing.md