Falco: Include k8s namespace in output

Created on 10 Sep 2018 · 6Comments · Source: falcosecurity/falco

Given the following example Slack message, it would be great to include the k8s namespace in the message e.g. k8s.namespace=default k8s.pod=db-0 container=b27073b986af

13:58:40.957866797: Error File below / or /root opened for writing (user=root command=mysql -usearch -ppassword search parent=<NA> file=/root/.mysql_history.TMP program=mysql) k8s.pod=db-0 container=b27073b986af

Source

swestcott

👍5

Most helpful comment

Fixed in #472

mfdii on 5 Mar 2019

👍2

All 6 comments

+1 @mstemm

mfdii on 10 Sep 2018

Yeah I second this!

My use-case is deploying a system-wide falco inside a ns like kube-system, and monitors all the pods in all the k8s namespaces. But falco as of today doesn't differentiate which alert is coming from which namespace, resulting in falco outputs ambiguous.

That is, I currently have to look for pods name as the k8s.pod.name field in all the namespaces in order to locate the suspicious pod. Something like k8s.pod.ns in falco outputs would greatly simplify the incident response process.

mumoshu on 5 Oct 2018

👍2

Thirded. If anyone has cycles/interest to get started on this, it should just be a matter of adding the k8s.ns.name to the right place, and could be a good starter PR 😄.

(This commit which originally introduced the -pk flag provides context: https://github.com/falcosecurity/falco/pull/134/commits/880c39633def5ea7272a4e9a82bb2b0c18fa1763).

henridf on 5 Oct 2018

👍1

Not sure if it is possible but potentially cluster name would be great too. We have multiple kube clusters and would like to run falco in each but it sends alerts to aggregated source and it would be nice to know which cluster it came from instead of having to search.

xamox on 11 Oct 2018

There is some support for adding k8s info to rules--if the output expression contains %container.info that is replaced with either container info or k8s info, depending on whether falco was run with -pk. More info provided here: https://github.com/falcosecurity/falco/wiki/Falco-Formatting-for-Containers-and-Orchestration. I don't think the namespace is part of what's included in %container.info. Also, not every rule has %container.info, just those rules that are container specific.

Sounds like for your use case you'd want some common information added to all outputs, and for that common information to include a lot of different k8s fields including pod, namespace, etc.