-
Notifications
You must be signed in to change notification settings - Fork 43
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* node agent exporters config Signed-off-by: Amir Malka <[email protected]> * updated maintainers and home URL Signed-off-by: Amir Malka <[email protected]> * adding alertCRD chart Signed-off-by: David Wertenteil <[email protected]> * fixed URL Signed-off-by: David Wertenteil <[email protected]> * check crd scope mutual exclusive Signed-off-by: David Wertenteil <[email protected]> * using test image Signed-off-by: David Wertenteil <[email protected]> * use ks namespace Signed-off-by: David Wertenteil <[email protected]> * update image Signed-off-by: David Wertenteil <[email protected]> * fixed relevantCVEServiceEnabled Signed-off-by: David Wertenteil <[email protected]> * update node-agent image Signed-off-by: David Wertenteil <[email protected]> * update node-agent Signed-off-by: David Wertenteil <[email protected]> * update image Signed-off-by: David Wertenteil <[email protected]> * adding test basic_incident_presented Signed-off-by: David Wertenteil <[email protected]> * update image Signed-off-by: David Wertenteil <[email protected]> * update version Signed-off-by: Amir Malka <[email protected]> * fix Signed-off-by: Amir Malka <[email protected]> --------- Signed-off-by: Amir Malka <[email protected]> Signed-off-by: David Wertenteil <[email protected]> Co-authored-by: Amir Malka <[email protected]>
- Loading branch information
Showing
14 changed files
with
331 additions
and
82 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,14 +9,14 @@ type: application | |
| # to the chart and its templates, including the app version. | ||
| # Versions are expected to follow Semantic Versioning (https://semver.org/) | ||
|
|
||
| version: 1.18.10 | ||
| version: 1.18.11 | ||
|
|
||
| # This is the version number of the application being deployed. This version number should be | ||
| # incremented each time you make changes to the application. Versions are not expected to | ||
| # follow Semantic Versioning. They should reflect the version the application is using. | ||
| # It is recommended to use it with quotes. | ||
|
|
||
| appVersion: 1.18.10 | ||
| appVersion: 1.18.11 | ||
|
|
||
| maintainers: | ||
| - name: Ben Hirschberg | ||
|
|
@@ -31,5 +31,18 @@ maintainers: | |
| - name: Matthias Bertschy | ||
| email: [email protected] | ||
| url: https://www.linkedin.com/in/matthias-bertschy-b427b815/ | ||
| - name: Amir Malka | ||
| email: [email protected] | ||
| url: https://www.linkedin.com/in/amirmalka | ||
|
|
||
| home: https://www.armosec.io/ | ||
| home: https://kubescape.io/ | ||
|
|
||
| dependencies: | ||
| - name: kubescape-alert-crd | ||
| version: 0.0.1 | ||
| repository: "file://./charts/clustered-crds" | ||
| condition: alertCRD.scopeClustered | ||
| - name: kubescape-alert-crd-ns | ||
| version: 0.0.1 | ||
| repository: "file://./charts/namespaced-crds" | ||
| condition: alertCRD.scopeNamespaced | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| apiVersion: v2 | ||
| name: kubescape-alert-crd | ||
| description: A Helm chart CRDs required by Kubescape Runtime Security detection | ||
|
|
||
| type: application | ||
|
|
||
| version: 0.0.1 | ||
|
|
||
| appVersion: "0.0.1" |
File renamed without changes.
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| apiVersion: v2 | ||
| name: kubescape-alert-crd-ns | ||
| description: A Helm chart CRDs required by Kubescape Runtime Security detection | ||
|
|
||
| type: application | ||
|
|
||
| version: 0.0.1 | ||
|
|
||
| appVersion: "0.0.1" |
167 changes: 167 additions & 0 deletions
167
charts/kubescape-operator/charts/namespaced-crds/crds/runtime-rule-binding.crd.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,167 @@ | ||
| apiVersion: apiextensions.k8s.io/v1 | ||
| kind: CustomResourceDefinition | ||
| metadata: | ||
| name: runtimerulealertbindings.kubescape.io | ||
| spec: | ||
| group: kubescape.io | ||
| names: | ||
| kind: RuntimeRuleAlertBinding | ||
| plural: runtimerulealertbindings | ||
| shortNames: | ||
| - rab | ||
| singular: runtimerulealertbinding | ||
| scope: Namespaced | ||
| versions: | ||
| - name: v1 | ||
| schema: | ||
| openAPIV3Schema: | ||
| properties: | ||
| spec: | ||
| properties: | ||
| namespaceSelector: | ||
| properties: | ||
| matchExpressions: | ||
| items: | ||
| properties: | ||
| key: | ||
| type: string | ||
| operator: | ||
| type: string | ||
| values: | ||
| items: | ||
| type: string | ||
| type: array | ||
| type: object | ||
| type: array | ||
| matchLabels: | ||
| additionalProperties: | ||
| type: string | ||
| type: object | ||
| type: object | ||
| podSelector: | ||
| properties: | ||
| matchExpressions: | ||
| items: | ||
| properties: | ||
| key: | ||
| type: string | ||
| operator: | ||
| type: string | ||
| values: | ||
| items: | ||
| type: string | ||
| type: array | ||
| type: object | ||
| type: array | ||
| matchLabels: | ||
| additionalProperties: | ||
| type: string | ||
| type: object | ||
| type: object | ||
| rules: | ||
| items: | ||
| oneOf: | ||
| - not: | ||
| anyOf: | ||
| - required: | ||
| - ruleID | ||
| - required: | ||
| - ruleName | ||
| required: | ||
| - ruleTags | ||
| - not: | ||
| anyOf: | ||
| - required: | ||
| - ruleTags | ||
| - required: | ||
| - ruleName | ||
| required: | ||
| - ruleID | ||
| - not: | ||
| anyOf: | ||
| - required: | ||
| - ruleTags | ||
| - required: | ||
| - ruleID | ||
| required: | ||
| - ruleName | ||
| properties: | ||
| parameters: | ||
| additionalProperties: true | ||
| type: object | ||
| ruleID: | ||
| enum: | ||
| - R0001 | ||
| - R0002 | ||
| - R0003 | ||
| - R0004 | ||
| - R0005 | ||
| - R0006 | ||
| - R0007 | ||
| - R1000 | ||
| - R1001 | ||
| - R1002 | ||
| - R1003 | ||
| - R1004 | ||
| - R1005 | ||
| - R1006 | ||
| - R1007 | ||
| - R1008 | ||
| - R1009 | ||
| type: string | ||
| ruleName: | ||
| enum: | ||
| - Unexpected process launched | ||
| - Unexpected file access | ||
| - Unexpected system call | ||
| - Unexpected capability used | ||
| - Unexpected domain request | ||
| - Unexpected Service Account Token Access | ||
| - Kubernetes Client Executed | ||
| - Exec from malicious source | ||
| - Exec Binary Not In Base Image | ||
| - Kernel Module Load | ||
| - Malicious SSH Connection | ||
| - Exec from mount | ||
| - Fileless Execution | ||
| - Unshare System Call usage | ||
| - XMR Crypto Mining Detection | ||
| - Crypto Mining Domain Communication | ||
| - Crypto Mining Related Port Communication | ||
| type: string | ||
| ruleTags: | ||
| items: | ||
| enum: | ||
| - base image | ||
| - binary | ||
| - capabilities | ||
| - connection | ||
| - crypto | ||
| - dns | ||
| - escape | ||
| - exec | ||
| - kernel | ||
| - load | ||
| - malicious | ||
| - miners | ||
| - module | ||
| - mount | ||
| - network | ||
| - open | ||
| - port | ||
| - signature | ||
| - ssh | ||
| - syscall | ||
| - token | ||
| - unshare | ||
| - whitelisted | ||
| type: string | ||
| type: array | ||
| severity: | ||
| type: string | ||
| type: object | ||
| type: array | ||
| type: object | ||
| type: object | ||
| served: true | ||
| storage: true |
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
29 changes: 29 additions & 0 deletions
29
charts/kubescape-operator/templates/node-agent/default-rule-binding-namespaced.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| {{- if and .Values.alertCRD.installDefault .Values.alertCRD.scopeNamespaced }} | ||
| apiVersion: kubescape.io/v1 | ||
| kind: RuntimeRuleAlertBinding | ||
| metadata: | ||
| name: all-rules-default-namespace | ||
| namespace: {{ .Values.ksNamespace }} | ||
| spec: | ||
| rules: | ||
| - ruleName: "Unexpected process launched" | ||
| - ruleName: "Unexpected file access" | ||
| parameters: | ||
| ignoreMounts: true | ||
| ignorePrefixes: ["/proc", "/run/secrets/kubernetes.io/serviceaccount", "/var/run/secrets/kubernetes.io/serviceaccount", "/tmp"] | ||
| - ruleName: "Unexpected system call" | ||
| - ruleName: "Unexpected capability used" | ||
| - ruleName: "Unexpected domain request" | ||
| - ruleName: "Unexpected Service Account Token Access" | ||
| - ruleName: "Kubernetes Client Executed" | ||
| - ruleName: "Exec from malicious source" | ||
| - ruleName: "Kernel Module Load" | ||
| - ruleName: "Exec Binary Not In Base Image" | ||
| - ruleName: "Malicious SSH Connection" | ||
| - ruleName: "Fileless Execution" | ||
| - ruleName: "XMR Crypto Mining Detection" | ||
| - ruleName: "Exec from mount" | ||
| - ruleName: "Crypto Mining Related Port Communication" | ||
| - ruleName: "Crypto Mining Domain Communication" | ||
| {{- end }} | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.