Repository navigation
feat(security): add Falco runtime threat detection - #25
Merged
Merged
Conversation
…loudWatch Falco captures what the API-server audit log can't: the commands run INSIDE a container after an exec (not just the exec call). Modern eBPF (CO-RE) driver, observe-only, in its own falco namespace (exempt from the webapp Gatekeeper constraints). Alerts ship to floci CloudWatch /k8s/falco. - falco.tf: helm_release (chart 9.1.0) + a null_resource that mounts debugfs on the node first — k3d doesn't mount it, and without it the BPF probe can't read syscall tracepoints (Falco captures nothing). - recover.sh: re-mount debugfs after a reboot (it's on tmpfs, lost on restart, like flannel's subnet.env) and bounce Falco to re-attach. - cloudwatch-log-shipper.yaml: add a third stream, falco pods -> /k8s/falco. - docs/falco.md: driver rationale, the debugfs catch, and how to test it end to end (trigger -> Falco logs -> CloudWatch). Verified live: modern eBPF loads clean (0 tracepoint errors), a tty exec into webapp fires "Terminal shell in container" with the full command line, and the alert lands in /k8s/falco via the shipper. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds Falco — syscall-level runtime threat detection — installed via Terraform, shipping alerts to floci CloudWatch.
This closes the gap we hit while investigating the audit log:
/k8s/webapp/auditshows that someone exec'd into a pod and the launch command, but not the commands run inside the shell afterward. Falco tapsexecveat the kernel, so it sees them.bashinto webapp"cat /etc/shadow,id, … run insideChanges
terraform/cluster/falco.tf—helm_release(chart 9.1.0, modern-eBPF driver, observe-only) in its ownfalconamespace (exempt from the webapp-scoped Gatekeeper constraints). Plus anull_resourcethat mounts debugfs on the node first.scripts/recover.sh— re-mounts debugfs after a reboot (tmpfs, lost on restart — same class as flannel'ssubnet.env) and bounces Falco.logging/cloudwatch-log-shipper.yaml— third stream:/var/log/pods/falco_*/falco/*.log → /k8s/falco.docs/falco.md— driver rationale, the k3d debugfs catch, and full test flow.The k3d gotcha (documented)
k3d nodes don't mount
debugfs, so the eBPF probe can't resolve syscall tracepoint IDs and Falco captures nothing (failed to determine tracepoint ... perf event ID). Mounting it fixes it cleanly (0 tracepoint errors). Handled at both cluster-create (falco.tf) and reboot (recover.sh). I tried a self-contained init-container mount first but it left a propagation race (3 residual errors); the node-level mount is clean and matches the lab's existing node-fixup pattern.Verified live (end to end)
kubectl exec -itinto webapp → Falco firesTerminal shell in container(MITRET1059) with the exactproc.cmdline./k8s/falcoin floci CloudWatch via the shipper.Local
scripts/security-gates.sh→ all four gates PASS (tfsec clean on the newfalco.tf).Footprint
No vuln DB, no scan jobs — none of the disk-pressure risk Trivy Operator carries. ~256Mi/pod.
🤖 Generated with Claude Code