Falco安全项目简介与部署

$ helm repo add falcosecurity https://falcosecurity.github.io/charts
$ helm repo update
Hang tight while we grab the latest from your chart repositories......Successfully got an update from the "falcosecurity" chart repository...Successfully got an update from the "stable" chart repository
Update Complete. ⎈Happy Helming!⎈

$ helm install falco falcosecurity/falco \
--set falco.jsonOutput=true \
--set falco.fileOutput.enabled=true,falco.fileOutput.keepAlive=true,falco.fileOutput.filename=/mnt/events.txt #这里我们安装时打开文件文件输出以及定义日志文件位置

NAME: falco
LAST DEPLOYED: Mon Nov 9 22:09:28 2020
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Falco agents are spinning up on each node in your cluster. After a few
seconds, they are going to start monitoring your containers looking for
security issues.
No further action should be required.

$ helm ls
$ kubectl get pods

#安装nfs#
master节点作为nfs服务端，node节点作为客户端#master节点安装nfs$yum install -y nfs-utils rpcbind
#node节点安装nfs

$ yum install -y nfs-utils
$ yum install -y nfs-utils
#配置nfs
$vim /etc/exports
/nfsdata *(rw,no_root_squash,no_all_squash,sync)
#创建/nfsdata目录并赋权$mkdir /nfsdata$chmod 775 -R /nfsdata
#启动nfs和rpcbind服务
$systemctl start rpcbind$systemctl start nfs
#node节点查看master共享目录
$showmount -e {NFS服务节点ip}
Export list for {NFS服务节点ip}:
/nfsdata *

#vim pv1.yamlapiVersion: v1kind: PersistentVolumemetadata:
name: pv1
labels:
app: nfsspec:
capacity: #指定 PV 的容量为 1G
storage: 1Gi
accessModes: #指定访问模式
- ReadWriteOnce #PV 能以 read-write 模式 mount 到单个节点
persistentVolumeReclaimPolicy: Recycle #指定当 PV 的回收策略为 Recycle
storageClassName: nfs #指定 PV 的 class 为 nfs。相当于为 PV 设置了一个分类，PVC 可以指定 class 申请相应 class 的 PV
nfs:
path: /nfsdataserver: XXX.XXX.XXX.132 #nfs服务端ip

$kubectl apply -f pv1.yaml $persistentvolume/pv1 created
查看pv$kubectl get pv

#vim pvc.yamlapiVersion: v1kind: PersistentVolumeClaimmetadata:
name: pvc1spec:
accessModes:  #指定访问模式

ReadWriteOnce #PV 能以 read-write 模式 mount 到单个节点resources:
requests:storage: 1Gi
storageClassName: nfs

$kubectl apply -f pvc.yml
persistentvolumeclaim/pvc1 created
#查看pvc$kubectl get pvc
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
pvc1 Bound pv1 1Gi RWO nfs 3s
#查看pv和pvc是否绑定
kubectl get pv

$kubectl get daemonsets.apps falco -o=yaml > falco.yaml

volumeMounts:
·····
- mountPath: /mnt
name: events-volume
·····
- name: events-volume
persistentVolumeClaim:
claimName: pvc1

$kubectl delete daemonsets.apps falco$kubectl apply -f falco.yaml

$ kubectl run --generator=run-pod/v1 nginx --image=nginx

$kubectl exec -it nginx -- bash$cat /etc/shadow