Skip to content

Commit 83a1279

Browse files
knrt10knrt10
committed
falco: Add base plugin
This adds events, rule and settings page to the plugin. User can select the backend for the events. Default backend is file/volumes. They can easily configure redis as well and use that as backend. Signed-off-by: Kautilya Tripathi <[email protected]>
1 parent 13bc2aa commit 83a1279

36 files changed

+18230
-0
lines changed

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ This is a repository of official plugins that Headlamp uses or recommends.
1515
| [prometheus](./prometheus) | Provides a Prometheus-powered chart in the details views of workloads. | Needs Prometheus installed in the cluster for the chart to be shown. Shipped with Headlamp desktop and CI builds by default. | [@yolossn](https://github.com/yolossn) |
1616
| [cert-manager](./cert-manager) | A UI for viewing and managing cert-manager. | |[@yolossn](https://github.com/yolossn)|
1717
| [minikube](./minikube) | A UI for minikube, for running Kubernetes locally. | |[@illume](https://github.com/illume)|
18+
| [falco](./falco) | A UI for Falco, to view various security events in the cluster. | |[@knrt10](https://github.com/knrt10)|
1819

1920
## Development
2021

‎falco/.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
node_modules
2+
.vscode
3+
dist

‎falco/README.md

+120
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
# Falco Headlamp Plugin
2+
3+
A modern, Headlamp plugin for visualizing and managing [Falco](https://falco.org/) security events and rules in Kubernetes clusters.
4+
5+
## Features
6+
7+
- **Falco Events Viewer:**
8+
9+
- Real-time streaming and display of Falco security events from all cluster namespaces.
10+
- Powerful search and filter UI for namespaces, pods, containers, and severity.
11+
- Multiple backend options: file-based (default) or Redis for persistent storage.
12+
- Fully type-safe event handling and clear, maintainable utility functions.
13+
14+
- **Falco Rules Explorer:**
15+
16+
- Lists all Falco rules loaded in the cluster, with support for multiple pods and custom rule files.
17+
- Search and filter by rule name, description, pod, or source file.
18+
19+
- **Storage Backends:**
20+
21+
- **File-based** (default): Access events directly from Falco output files.
22+
- **Redis**: Store events in Redis for persistence and centralized access via a Redis REST proxy.
23+
24+
## Prerequisites
25+
26+
Before you begin, ensure you have the following:
27+
28+
- A running Kubernetes cluster (minikube, kind, or a production cluster)
29+
- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) installed and configured
30+
- [Helm](https://helm.sh/docs/intro/install/) v3+ installed
31+
- [Node.js](https://nodejs.org/) and npm installed (for development)
32+
- [Headlamp](https://headlamp.dev/docs/latest/installation/) installed and access to your cluster
33+
34+
## Setup
35+
36+
### Basic Setup
37+
38+
1. Clone this repository and install dependencies:
39+
40+
```bash
41+
npm install
42+
```
43+
44+
2. Install Falco with file output enabled:
45+
46+
```bash
47+
helm install falco falcosecurity/falco \
48+
--namespace falco \
49+
--set falco.file_output.enabled=true \
50+
--set falco.file_output.filename="/tmp/falco_events.json" \
51+
--set falco.file_output.keep_alive=true \
52+
--set falco.json_output=true \
53+
--set driver.kind=modern_ebpf \
54+
--set falco.tty=true
55+
```
56+
57+
### Redis Backend Setup
58+
59+
To use the Redis backend for persistent event storage:
60+
61+
1. Deploy Redis and the REST proxy in your Kubernetes cluster:
62+
63+
```bash
64+
npm run setup-redis
65+
```
66+
67+
> **Important Note:** If you already have a Redis server but not the REST proxy, you must still deploy the Redis REST proxy component. This plugin communicates with Redis via HTTP and requires the proxy layer.
68+
>
69+
> **For Production Environments**: To connect to your existing Redis server, modify `redis/redis-rest-proxy.yaml` by changing line 46 in the Python code:
70+
>
71+
> ```python
72+
> # Change this line:
73+
> rclient = redis.Redis(host='redis-service', port=6379)
74+
>
75+
> # To point to your Redis server:
76+
> rclient = redis.Redis(host='your-redis-hostname', port=6379, password='your-password-if-needed')
77+
> ```
78+
>
79+
> You may also need to adjust security settings, resource limits, and consider adding persistence for production deployments.
80+
81+
2. Install Falco with both file and Redis output enabled using our provided values file:
82+
83+
```bash
84+
# The falco-values.yaml file in the repo already contains the Redis configuration
85+
helm install falco falcosecurity/falco \
86+
--namespace falco \
87+
--set falco.file_output.enabled=true \
88+
--set falco.file_output.filename="/tmp/falco_events.json" \
89+
--set falco.file_output.keep_alive=true \
90+
--set falco.json_output=true \
91+
--set driver.kind=modern_ebpf \
92+
--values=falco-values.yaml \
93+
--set falco.tty=true
94+
```
95+
96+
3. In the plugin settings, switch to Redis backend and test the connection.
97+
98+
## Development
99+
100+
To develop or extend this plugin:
101+
102+
1. Clone this repository and install dependencies (see `package.json`).
103+
2. Run Headlamp in plugin development mode.
104+
3. Edit TypeScript/TSX files in `src/` for UI or logic changes.
105+
4. All contributions must maintain or improve type safety and documentation.
106+
107+
See the following resources for Headlamp plugin development:
108+
109+
- [Headlamp Plugin Getting Started](https://headlamp.dev/docs/latest/development/plugins/)
110+
- [Headlamp API Reference](https://headlamp.dev/docs/latest/development/api/)
111+
- [UI Component Storybook](https://headlamp.dev/docs/latest/development/frontend/#storybook)
112+
- [Plugin Examples](https://github.com/headlamp-k8s/headlamp/tree/main/plugins/examples)
113+
114+
## Contributing
115+
116+
Contributions are welcome! Please ensure that:
117+
118+
- All new code is type-safe and well-documented.
119+
- Comments describing utility functions are replaced with TypeScript type annotations and JSDoc comments.
120+
- No business logic or user experience is broken by refactors.

‎falco/falco-values.yaml

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Enable Kubernetes audit log
2+
auditLog:
3+
enabled: true
4+
5+
# Enable the driver, and choose between the kernel module or the ebpf probe.
6+
# Default value: kernel module.
7+
driver:
8+
enabled: true
9+
kind: modern_ebpf
10+
11+
# Enable the collectors used to enrich the events with metadata.
12+
# Check the values.yaml file for fine-grained options.
13+
collectors:
14+
enabled: true
15+
16+
# We set the controller to daemonset since we have the syscalls source enabled.
17+
# It will ensure that every node on our cluster will be monitored by Falco.
18+
# Please note that the api-server will use the "k8saudit-webhook" service to send
19+
# audit logs to the falco instances. That means that when we have multiple instances of Falco
20+
# we can not predict to which instance the audit logs will be sent. When testing please check all
21+
# the Falco instance to make sure that at least one of them have received the audit logs.
22+
controller:
23+
kind: daemonset
24+
25+
falcoctl:
26+
artifact:
27+
install:
28+
# -- Enable the init container.
29+
enabled: true
30+
follow:
31+
# -- Enable the sidecar container.
32+
enabled: true
33+
config:
34+
artifact:
35+
install:
36+
# -- List of artifacts to be installed by the falcoctl init container.
37+
refs: [falco-rules:3, k8saudit-rules:0.11, k8saudit:0.11]
38+
follow:
39+
# -- List of artifacts to be followed by the falcoctl sidecar container.
40+
refs: [falco-rules:3, k8saudit-rules:0.11, k8saudit:0.11]
41+
42+
services:
43+
- name: k8saudit-webhook
44+
type: NodePort
45+
ports:
46+
- port: 9765 # See plugin open_params
47+
nodePort: 30007
48+
protocol: TCP
49+
50+
falco:
51+
# Basic settings
52+
json_output: true
53+
tty: true
54+
log_level: debug
55+
56+
# File output
57+
file_output:
58+
enabled: true
59+
keep_alive: true
60+
filename: /tmp/falco_events.json
61+
62+
# Direct program output to pipe events to Redis
63+
program_output:
64+
enabled: true
65+
keep_alive: false
66+
program: "curl -s -d @- -H 'Content-Type: application/json' http://redis-rest-proxy.falco.svc.cluster.local:8080/events"
67+
68+
# HTTP output to Redis proxy (keep as backup)
69+
http_output:
70+
enabled: true
71+
url: 'http://redis-rest-proxy.falco.svc.cluster.local:8080/events'
72+
73+
rules_files:
74+
- /etc/falco/falco_rules.yaml
75+
- /etc/falco/k8s_audit_rules.yaml
76+
- /etc/falco/rules.d
77+
plugins:
78+
- name: k8saudit
79+
library_path: libk8saudit.so
80+
init_config:
81+
''
82+
# maxEventBytes: 1048576
83+
# sslCertificate: /etc/falco/falco.pem
84+
open_params: 'http://:9765/k8s-audit'
85+
- name: json
86+
library_path: libjson.so
87+
init_config: ''
88+
load_plugins: [k8saudit, json]

0 commit comments

Comments
 (0)