falco load k8s audit rules failed

[woniuzhang]

/etc/falco/k8s_audit_rules.yaml | schema validation: failed for [11]: Value type not permitted by 'type' constraint.

Using helm chart install falco and use values-k8saudit.yaml as value file

Chart.yaml
apiVersion: v2
appVersion: 0.39.1
dependencies:

• condition: falcosidekick.enabled
  name: falcosidekick
  repository: https://falcosecurity.github.io/charts
  version: 0.8.*
• condition: collectors.kubernetes.enabled
  name: k8s-metacollector
  repository: https://falcosecurity.github.io/charts
  version: 0.1.*
  description: Falco
  home: https://falco.org
  icon: https://raw.githubusercontent.com/cncf/artwork/master/projects/falco/horizontal/color/falco-horizontal-color.svg
  keywords:
• monitoring
• security
• alerting
• metric
• troubleshooting
• run-time
  maintainers:
• email: [email protected]
  name: The Falco Authors
  name: falco
  sources:
• https://github.com/falcosecurity/falco
  version: 4.11.1

[woniuzhang]

I download the rule file k8s-audit.yaml , it seems like L82 is unnecessary.

[woniuzhang]

container falcoctl-artifact-install log
{"level":"INFO","msg":"Preparing to pull artifact","ref":"ghcr.io/falcosecurity/plugins/ruleset/k8saudit:0.7","timestamp":"2024-12-06 02:15:38"}

[alacuku]

Hey @woniuzhang, thanks for the issue.

I'm seeing the same issue but it does not seem to be related to line 82:

plugins/plugins/k8saudit/rules/k8s_audit_rules.yaml

Line 82 in e61c52a

"eks:addon-manager",

.

I will investigate in the coming days and report back here.

[woniuzhang]

I guess it had been fixed, you can see it here: https://github.com/falcosecurity/plugins/blob/k8saudit-0.7.0/plugins/k8saudit/rules/k8s_audit_rules.yaml#L82

[leogr]

/assign

I'm on it

Also I'm moving this issue to the plugins repo, since the problem is there.

[leogr]

Hey @woniuzhang

The problem has been fixed already, you should use the latest plugins and rules version, which is 0.11.

I've also prepared falcosecurity/charts#799 for our helm charts to bump k8saudit to the latest version.

Please let me know if that solves your issue. Thank you 🙏