Skip to content

Commit f9fcd8e

Browse files
IssifIssif
committed
use redis-cli for the initContainer check + allow to override the redis server settings + allow to use a password for the external redis
Signed-off-by: Thomas Labarussias <[email protected]>
1 parent 4e87255 commit f9fcd8e

File tree

10 files changed

+118
-18
lines changed

10 files changed

+118
-18
lines changed

‎charts/falco/README.gotmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ The cluster in our example has three nodes, one *control-plane* node and two *wo
4747
### Falco, Event Sources and Kubernetes
4848
Starting from Falco 0.31.0 the [new plugin system](https://falco.org/docs/plugins/) is stable and production ready. The **plugin system** can be seen as the next step in the evolution of Falco. Historically, Falco monitored system events from the **kernel** trying to detect malicious behaviors on Linux systems. It also had the capability to process k8s Audit Logs to detect suspicious activities in Kubernetes clusters. Since Falco 0.32.0 all the related code to the k8s Audit Logs in Falco was removed and ported in a [plugin](https://github.com/falcosecurity/plugins/tree/master/plugins/k8saudit). At the time being Falco supports different event sources coming from **plugins** or **drivers** (system events).
4949

50-
Note that **a Falco instance can handle multiple event sources in parallel**. you can deploy Falco leveraging **drivers** for syscall events and at the same time loading **plugins**. A step by step guide on how to deploy Falco with multiple sources can be found [here](https://falco.org/docs/getting-started/third-party/learning/#falco-with-multiple-sources).
50+
Note that **a Falco instance can handle multiple event sources in parallel**. you can deploy Falco leveraging **drivers** for syscall events and at the same time loading **plugins**. A step by step guide on how to deploy Falco with multiple sources can be found [here](https://falco.org/docs/getting-started/learning-environments/#falco-with-multiple-sources).
5151

5252
#### About Drivers
5353

‎charts/falco/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ The cluster in our example has three nodes, one *control-plane* node and two *wo
4747
### Falco, Event Sources and Kubernetes
4848
Starting from Falco 0.31.0 the [new plugin system](https://falco.org/docs/plugins/) is stable and production ready. The **plugin system** can be seen as the next step in the evolution of Falco. Historically, Falco monitored system events from the **kernel** trying to detect malicious behaviors on Linux systems. It also had the capability to process k8s Audit Logs to detect suspicious activities in Kubernetes clusters. Since Falco 0.32.0 all the related code to the k8s Audit Logs in Falco was removed and ported in a [plugin](https://github.com/falcosecurity/plugins/tree/master/plugins/k8saudit). At the time being Falco supports different event sources coming from **plugins** or **drivers** (system events).
4949

50-
Note that **a Falco instance can handle multiple event sources in parallel**. you can deploy Falco leveraging **drivers** for syscall events and at the same time loading **plugins**. A step by step guide on how to deploy Falco with multiple sources can be found [here](https://falco.org/docs/getting-started/third-party/learning/#falco-with-multiple-sources).
50+
Note that **a Falco instance can handle multiple event sources in parallel**. you can deploy Falco leveraging **drivers** for syscall events and at the same time loading **plugins**. A step by step guide on how to deploy Falco with multiple sources can be found [here](https://falco.org/docs/getting-started/learning-environments/#falco-with-multiple-sources).
5151

5252
#### About Drivers
5353

‎charts/falcosidekick/CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@ numbering uses [semantic versioning](http://semver.org).
55

66
Before release 0.1.20, the helm chart can be found in `falcosidekick` [repository](https://github.com/falcosecurity/falcosidekick/tree/master/deploy/helm/falcosidekick).
77

8+
## 0.8.6
9+
10+
- Use of `redis-cli` by the initContainer of Falcosidekick-UI to wait til the redis is up and running
11+
- Add the possibility to override the default redis server settings
12+
- Allow to set up a password to use with an external redis
13+
814
## 0.8.5
915

1016
- Fix an issue with the by default missing custom CA cert

‎charts/falcosidekick/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ appVersion: 2.29.0
33
description: Connect Falco to your ecosystem
44
icon: https://raw.githubusercontent.com/falcosecurity/falcosidekick/master/imgs/falcosidekick_color.png
55
name: falcosidekick
6-
version: 0.8.5
6+
version: 0.8.6
77
keywords:
88
- monitoring
99
- security

‎charts/falcosidekick/README.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -630,6 +630,7 @@ The following table lists the main configurable parameters of the Falcosidekick
630630
| webui.enabled | bool | `false` | enable Falcosidekick-UI |
631631
| webui.existingSecret | string | `""` | Existing secret with configuration |
632632
| webui.externalRedis.enabled | bool | `false` | Enable or disable the usage of an external Redis. Is mutually exclusive with webui.redis.enabled. |
633+
| webui.externalRedis.password | string | `""` | Set the password of the external Redis |
633634
| webui.externalRedis.port | int | `6379` | The port of the external Redis database with RediSearch > v2 |
634635
| webui.externalRedis.url | string | `""` | The URL of the external Redis database with RediSearch > v2 |
635636
| webui.image.pullPolicy | string | `"IfNotPresent"` | The web UI image pull policy |
@@ -641,10 +642,10 @@ The following table lists the main configurable parameters of the Falcosidekick
641642
| webui.ingress.hosts | list | `[{"host":"falcosidekick-ui.local","paths":[{"path":"/"}]}]` | Web UI ingress hosts configuration |
642643
| webui.ingress.ingressClassName | string | `""` | ingress class name |
643644
| webui.ingress.tls | list | `[]` | Web UI ingress TLS configuration |
644-
| webui.initContainer | object | `{"image":{"registry":"docker.io","repository":"busybox","tag":1.31},"resources":{},"securityContext":{}}` | Web UI wait-redis initContainer |
645+
| webui.initContainer | object | `{"image":{"registry":"docker.io","repository":"redis/redis-stack","tag":"7.2.0-v11"},"resources":{},"securityContext":{}}` | Web UI wait-redis initContainer |
645646
| webui.initContainer.image.registry | string | `"docker.io"` | wait-redis initContainer image registry to pull from |
646-
| webui.initContainer.image.repository | string | `"busybox"` | wait-redis initContainer image repository to pull from |
647-
| webui.initContainer.image.tag | float | `1.31` | wait-redis initContainer image tag to pull |
647+
| webui.initContainer.image.repository | string | `"redis/redis-stack"` | wait-redis initContainer image repository to pull from |
648+
| webui.initContainer.image.tag | string | `"7.2.0-v11"` | wait-redis initContainer image tag to pull |
648649
| webui.initContainer.resources | object | `{}` | wait-redis initContainer resources |
649650
| webui.initContainer.securityContext | object | `{}` | wait-redis initContainer securityContext |
650651
| webui.loglevel | string | `"info"` | Log level ("debug", "info", "warning", "error") |
@@ -655,6 +656,7 @@ The following table lists the main configurable parameters of the Falcosidekick
655656
| webui.priorityClassName | string | `""` | Name of the priority class to be used by the Web UI pods, priority class needs to be created beforehand |
656657
| webui.redis.affinity | object | `{}` | Affinity for the Web UI Redis pods |
657658
| webui.redis.customAnnotations | object | `{}` | custom annotations to add to all resources |
659+
| webui.redis.customConfig | object | `{}` | List of Custom config overrides for Redis |
658660
| webui.redis.customLabels | object | `{}` | custom labels to add to all resources |
659661
| webui.redis.enabled | bool | `true` | Is mutually exclusive with webui.externalRedis.enabled |
660662
| webui.redis.existingSecret | string | `""` | Existing secret with configuration |

‎charts/falcosidekick/templates/configmap-ui.yaml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{{- if and (.Values.webui.enabled) (.Values.webui.redis.enabled) -}}
2+
---
3+
apiVersion: v1
4+
kind: ConfigMap
5+
metadata:
6+
name: {{ include "falcosidekick.fullname" . }}-ui-redis
7+
namespace: {{ .Release.Namespace }}
8+
labels:
9+
{{- include "falcosidekick.labels" . | nindent 4 }}
10+
app.kubernetes.io/component: ui-redis
11+
data:
12+
{{- if .Values.webui.redis.customConfig -}}
13+
redis-stack.config: |-
14+
{{ range .Values.webui.redis.customConfig }}
15+
{{- . }}
16+
{{ end -}}
17+
{{- end }}
18+
ping-redis.sh: |-
19+
#!/bin/bash
20+
for i in {1..10};
21+
do
22+
response=$(
23+
timeout -s 3 30 \
24+
redis-cli \
25+
{{- if .Values.webui.redis.enabled }}
26+
-h {{ include "falcosidekick.fullname" . }}-ui-redis -p 6379 \
27+
{{- if .Values.webui.redis.password }}
28+
-a ${REDIS_PASSWORD} \
29+
{{- end }}
30+
{{- end }}
31+
{{- if .Values.webui.externalRedis.enabled }}
32+
-h {{ .Values.webui.externalRedis.url }} \
33+
-p {{ .Values.webui.externalRedis.port }} \
34+
{{- if .Values.webui.externalRedis.password }}
35+
-a ${REDIS_PASSWORD} \
36+
{{- end }}
37+
{{- end }}
38+
ping
39+
)
40+
if [ "$response" = "PONG" ]; then
41+
exit 0
42+
fi
43+
sleep 3
44+
done
45+
exit 1
46+
{{- end }}

‎charts/falcosidekick/templates/deployment-ui.yaml

Lines changed: 42 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -59,19 +59,29 @@ spec:
5959
initContainers:
6060
- name: wait-redis
6161
image: "{{ .Values.webui.initContainer.image.registry }}/{{ .Values.webui.initContainer.image.repository }}:{{ .Values.webui.initContainer.image.tag }}"
62-
{{- if .Values.webui.redis.enabled }}
63-
command: ['sh', '-c', 'echo -e "Checking for the availability of the Redis Server"; while ! nc -z {{ include "falcosidekick.fullname" . }}-ui-redis 6379; do sleep 1; done; echo -e "Redis Server has started";']
64-
{{- else if .Values.webui.externalRedis.enabled }}
65-
command: ['sh', '-c', 'echo -e "Checking for the availability of the Redis Server"; while ! nc -z {{ required "External Redis is enabled. Please set the URL to the database." .Values.webui.externalRedis.url }} {{ .Values.webui.externalRedis.port | default "6379" }}; do sleep 1; done; echo -e "Redis Server has started";']
66-
{{- end}}
62+
command:
63+
- sh
64+
- -c
65+
- /scripts/ping-redis.sh
6766
{{- if .Values.webui.initContainer.resources }}
6867
resources:
6968
{{- toYaml .Values.webui.initContainer.resources | nindent 12 }}
7069
{{- end }}
7170
{{- if .Values.webui.initContainer.securityContext }}
72-
securityContext:
71+
securityContext:{{ include "falcosidekick.fullname" . }}-ui-redis
7372
{{- toYaml .Values.webui.initContainer.securityContext | nindent 12}}
7473
{{- end }}
74+
volumeMounts:
75+
- name: scripts
76+
mountPath: /scripts/ping-redis.sh
77+
subPath: ping-redis.sh
78+
envFrom:
79+
- secretRef:
80+
name: {{ include "falcosidekick.fullname" . }}-ui
81+
{{- if .Values.webui.existingSecret }}
82+
- secretRef:
83+
name: {{ .Values.webui.existingSecret }}
84+
{{- end }}
7585
containers:
7686
- name: {{ .Chart.Name }}-ui
7787
image: "{{ .Values.webui.image.registry }}/{{ .Values.webui.image.repository }}:{{ .Values.webui.image.tag }}"
@@ -138,6 +148,14 @@ spec:
138148
tolerations:
139149
{{- toYaml . | nindent 8 }}
140150
{{- end }}
151+
volumes:
152+
- name: scripts
153+
configMap:
154+
name: {{ include "falcosidekick.fullname" . }}-ui-redis
155+
defaultMode: 0555
156+
items:
157+
- key: ping-redis.sh
158+
path: ping-redis.sh
141159
{{- if .Values.webui.redis.enabled }}
142160
---
143161
apiVersion: apps/v1
@@ -220,11 +238,18 @@ spec:
220238
securityContext:
221239
{{- toYaml .Values.webui.redis.securityContext | nindent 12 }}
222240
{{- end }}
223-
{{- if .Values.webui.redis.storageEnabled }}
241+
{{- if or (.Values.webui.redis.storageEnabled) (.Values.webui.redis.customConfig) }}
224242
volumeMounts:
243+
{{- if .Values.webui.redis.storageEnabled }}
225244
- name: {{ include "falcosidekick.fullname" . }}-ui-redis-data
226245
mountPath: /data
227246
{{- end }}
247+
{{- if .Values.webui.redis.customConfig }}
248+
- name: config
249+
mountPath: /redis-stack.config
250+
subPath: redis-stack.config
251+
{{- end }}
252+
{{- end }}
228253
resources:
229254
{{- toYaml .Values.webui.redis.resources | nindent 12 }}
230255
{{- with .Values.webui.redis.nodeSelector }}
@@ -239,6 +264,16 @@ spec:
239264
tolerations:
240265
{{- toYaml . | nindent 8 }}
241266
{{- end }}
267+
{{ if .Values.webui.redis.customConfig }}
268+
volumes:
269+
- name: config
270+
configMap:
271+
name: {{ include "falcosidekick.fullname" . }}-ui-redis
272+
defaultMode: 0444
273+
items:
274+
- key: redis-stack.config
275+
path: redis-stack.config
276+
{{ end }}
242277
{{- if .Values.webui.redis.storageEnabled }}
243278
volumeClaimTemplates:
244279
- metadata:

‎charts/falcosidekick/templates/secrets-ui.yaml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,12 @@ metadata:
4242
{{- end }}
4343
type: Opaque
4444
data:
45-
{{- if .Values.webui.redis.password }}
45+
{{- if and .Values.webui.redis.enabled .Values.webui.redis.password }}
4646
REDIS_ARGS: "{{ printf "--requirepass %s" .Values.webui.redis.password | b64enc}}"
47+
REDIS_PASSWORD: "{{ .Values.webui.redis.password | b64enc }}"
48+
{{- end }}
49+
{{- if and .Values.webui.externalRedis.password .Values.webui.externalRedis.password }}
50+
REDIS_PASSWORD: "{{ .Values.webui.externalRedis.password| b64enc }}"
4751
{{- end }}
4852
{{- end }}
4953
{{- end }}

‎charts/falcosidekick/templates/service-ui.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ spec:
2222
type: {{ .Values.webui.service.type }}
2323
ports:
2424
- port: {{ .Values.webui.service.port }}
25-
{{ if eq .Values.webui.service.type "NodePort" }}
25+
{{- if eq .Values.webui.service.type "NodePort" }}
2626
nodePort: {{ .Values.webui.service.nodePort }}
27-
{{ end }}
27+
{{- end }}
2828
targetPort: {{ .Values.webui.service.targetPort }}
2929
protocol: TCP
3030
name: http

‎charts/falcosidekick/values.yaml

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1143,9 +1143,9 @@ webui:
11431143
# -- wait-redis initContainer image registry to pull from
11441144
registry: docker.io
11451145
# -- wait-redis initContainer image repository to pull from
1146-
repository: busybox
1146+
repository: redis/redis-stack
11471147
# -- wait-redis initContainer image tag to pull
1148-
tag: 1.31
1148+
tag: "7.2.0-v11"
11491149
# -- wait-redis initContainer securityContext
11501150
securityContext: {}
11511151
# -- wait-redis initContainer resources
@@ -1222,6 +1222,8 @@ webui:
12221222
enabled: false
12231223
# -- The URL of the external Redis database with RediSearch > v2
12241224
url: ""
1225+
# -- Set the password of the external Redis
1226+
password: ""
12251227
# -- The port of the external Redis database with RediSearch > v2
12261228
port: 6379
12271229
redis:
@@ -1237,6 +1239,11 @@ webui:
12371239
# -- The web UI image pull policy
12381240
pullPolicy: IfNotPresent
12391241

1242+
# -- List of Custom config overrides for Redis
1243+
customConfig: {}
1244+
# - maxmemory-policy allkeys-lfu
1245+
# - maxmemory 4096mb
1246+
12401247
# -- Existing secret with configuration
12411248
existingSecret: ""
12421249

0 commit comments

Comments
 (0)