diff --git a/README.md b/README.md index 6e05352..fc38505 100644 --- a/README.md +++ b/README.md @@ -3,14 +3,18 @@ ## Setup 1. Install [Knative Serving and Eventing](https://knative.dev). +1. Install [Falco](https://falco.org/). + > Note: Falco needs to be configured to send to Falco Sidekick. 1. Install This repo: ``` - kubectl apply -f https://github.com/n3wscott/falco-drop/releases/download/v0.0.2/release.yaml + kubectl apply -f https://github.com/n3wscott/falco-drop/releases/download/v0.1.0/release.yaml ``` - > Note: This release contains [Falco Sidekick](https://github.com/falcosecurity/falcosidekick), deployed as a Knative Service. -1. Install [Falco](https://falco.org/). - > Note: Falco needs to be configured to send to Falco Sidekick. `kubectl get ksvc falcosidekick` for the url. 1. Optionally, install [Sockeye](https://github.com/n3wscott/sockeye). + 1. Install the trigger for sockeye: + ``` + kubectl apply -f https://raw.githubusercontent.com/n3wscott/falco-drop/main/demo/sockeye-trigger.yaml + ``` + 1. Optionally, install [Graph](https://github.com/n3wscott/graph). After this is all installed, you will have an eventing topology like this: @@ -84,5 +88,5 @@ After this is all installed, you will have an eventing topology like this: (╯°□°)╯︵ kubectl exec -it $(kubectl get pods --selector="app=mysql-db" --output=jsonpath={.items..metadata.name}) -- bash -il root@mysql-db-7d59548d75-89v4c:/# command terminated with exit code 137 ``` -- `Sockeye` also recieves the event and displays it: +- `Sockeye` also receives the event and displays it: ![Sockeye showing the CloudEvent](./img/sockeye.png) diff --git a/config/drop/drop.yaml b/config/drop.yaml similarity index 100% rename from config/drop/drop.yaml rename to config/drop.yaml diff --git a/config/drop/rbac.yaml b/config/rbac.yaml similarity index 100% rename from config/drop/rbac.yaml rename to config/rbac.yaml diff --git a/config/sidekick/include.go b/config/sidekick/include.go deleted file mode 100644 index 5163fa0..0000000 --- a/config/sidekick/include.go +++ /dev/null @@ -1,5 +0,0 @@ -// +build includes - -package sidekick - -import _ "github.com/falcosecurity/falcosidekick" diff --git a/config/sidekick/sidekick.yaml b/config/sidekick/sidekick.yaml deleted file mode 100644 index 69e49e3..0000000 --- a/config/sidekick/sidekick.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: serving.knative.dev/v1 -kind: Service -metadata: - name: falcosidekick -spec: - template: - spec: - containers: - - image: ko://github.com/falcosecurity/falcosidekick - env: - - name: LISTENPORT - value: "8080" - - name: CLOUDEVENTS_ADDRESS - value: http://broker-ingress.knative-eventing.svc.cluster.local/default/default # this needs to be updated to your broker url - diff --git a/config/sidekick/sinkbinding.yaml b/config/sidekick/sinkbinding.yaml deleted file mode 100644 index b869a53..0000000 --- a/config/sidekick/sinkbinding.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: sources.knative.dev/v1beta1 -kind: SinkBinding -metadata: - name: falcosidekick - namespace: default -spec: - subject: - apiVersion: serving.knative.dev/v1 - kind: Service - name: falcosidekick - sink: - ref: - apiVersion: eventing.knative.dev/v1 - kind: Broker - name: default diff --git a/config/drop/trigger.yaml b/config/trigger.yaml similarity index 100% rename from config/drop/trigger.yaml rename to config/trigger.yaml diff --git a/config/sockeye/trigger.yaml b/demo/sockeye-trigger.yaml similarity index 100% rename from config/sockeye/trigger.yaml rename to demo/sockeye-trigger.yaml