Gardener

Appearance

Edit this page Report an issue

Gardener Extension for Falco ​

REUSE statusBuildGo Report Card

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Its main principle is to leverage Kubernetes concepts for all of its tasks.

Recently, most of the vendor specific logic has been developed in-tree. However, the project has grown to a size where it is very hard to extend, maintain, and test. With GEP-1 we have proposed how the architecture can be changed in a way to support external controllers that contain their very own vendor specifics. This way, we can keep Gardener core clean and independent.

This extension integrates Falco, the cloud-native runtime security tool, into Gardener shoot clusters. It enables automated deployment, configuration, and lifecycle management of Falco, providing real-time security event detection for container workloads. This functionality of this extension was first proposed in the GEP-27.

Overview ​

  • Extension Name: gardener-extension-shoot-falco-service
  • Purpose: Deploy and manage Falco in shoot clusters via Gardener’s extension mechanism
  • Features:
    • Automated Falco deployemnt with lifecycle management
    • Deployment with standard or custom Falco rules
    • Support for custom event storage

Getting Started ​

Prerequisites ​

  • A running Gardener landscape (see Gardener documentation)
  • Access to a shoot cluster
  • Extension enabled in the landscape configuration via extension configuration

Installation ​

Add the extension to your shoot manifest:

yaml
  extensions:
    - type: shoot-falco-service

For a full shoot extension section configuration, refer to the configuration documentation

How to start using or developing this extension controller locally ​

You can run the controller locally on your machine by executing make start. Please make sure to reference the kubeconfig to the seed you want to connect to via the KUBECONFIG variable and the respective gardener via the GARDEN_KUBECONFIG variable. Static code checks and tests can be executed by running make verify. We are using Go modules for Golang package dependency management and Ginkgo/Gomega for testing.

Feedback and Support ​

Feedback and contributions are always welcome!

Please report bugs or suggestions as GitHub issues or reach out on Slack (join the workspace here).

Learn more! ​

Please find further resources about our project here:

Bundesministerium fĂĽr Wirtschaft und Energie (BMWE)-EU funding logo