mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Initial commit
This commit is contained in:
Scooby Husky
@@ -0,0 +1,84 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: grafana-dashboard-tetragon
|
||||
namespace: grafana
|
||||
labels:
|
||||
grafana_dashboard: "1"
|
||||
data:
|
||||
tetragon-overview.json: |
|
||||
{
|
||||
"annotations": { "list": [] },
|
||||
"editable": true,
|
||||
"fiscalYearStartMonth": 0,
|
||||
"graphTooltip": 0,
|
||||
"links": [],
|
||||
"panels": [
|
||||
{
|
||||
"title": "Process Exec Events (rate/5m)",
|
||||
"type": "timeseries",
|
||||
"datasource": { "type": "prometheus", "uid": "Prometheus" },
|
||||
"targets": [
|
||||
{
|
||||
"expr": "sum(rate(tetragon_events_total{type=\"PROCESS_EXEC\"}[5m])) by (namespace)",
|
||||
"legendFormat": "{{namespace}}"
|
||||
}
|
||||
],
|
||||
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 0 }
|
||||
},
|
||||
{
|
||||
"title": "Network Connections (rate/5m)",
|
||||
"type": "timeseries",
|
||||
"datasource": { "type": "prometheus", "uid": "Prometheus" },
|
||||
"targets": [
|
||||
{
|
||||
"expr": "sum(rate(tetragon_events_total{type=\"PROCESS_KPROBE\"}[5m])) by (namespace)",
|
||||
"legendFormat": "{{namespace}}"
|
||||
}
|
||||
],
|
||||
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 0 }
|
||||
},
|
||||
{
|
||||
"title": "Policy Events by Type",
|
||||
"type": "piechart",
|
||||
"datasource": { "type": "prometheus", "uid": "Prometheus" },
|
||||
"targets": [
|
||||
{
|
||||
"expr": "sum(tetragon_events_total) by (type)",
|
||||
"legendFormat": "{{type}}"
|
||||
}
|
||||
],
|
||||
"gridPos": { "h": 8, "w": 8, "x": 0, "y": 8 }
|
||||
},
|
||||
{
|
||||
"title": "Tracing Policy Matches",
|
||||
"type": "stat",
|
||||
"datasource": { "type": "prometheus", "uid": "Prometheus" },
|
||||
"targets": [
|
||||
{
|
||||
"expr": "sum(tetragon_events_total{type=~\"PROCESS_KPROBE|PROCESS_TRACEPOINT\"})",
|
||||
"legendFormat": "Total Policy Events"
|
||||
}
|
||||
],
|
||||
"gridPos": { "h": 8, "w": 8, "x": 8, "y": 8 }
|
||||
},
|
||||
{
|
||||
"title": "Events by Namespace",
|
||||
"type": "bargauge",
|
||||
"datasource": { "type": "prometheus", "uid": "Prometheus" },
|
||||
"targets": [
|
||||
{
|
||||
"expr": "sum(rate(tetragon_events_total[5m])) by (namespace) > 0",
|
||||
"legendFormat": "{{namespace}}"
|
||||
}
|
||||
],
|
||||
"gridPos": { "h": 8, "w": 8, "x": 16, "y": 8 }
|
||||
}
|
||||
],
|
||||
"schemaVersion": 39,
|
||||
"tags": ["tetragon", "security", "zero-trust"],
|
||||
"templating": { "list": [] },
|
||||
"time": { "from": "now-1h", "to": "now" },
|
||||
"title": "Tetragon Runtime Security",
|
||||
"uid": "tetragon-overview"
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: cilium.io/v1alpha1
|
||||
kind: TracingPolicy
|
||||
metadata:
|
||||
name: kubernetes-api-access-monitoring
|
||||
spec:
|
||||
kprobes:
|
||||
- call: tcp_connect
|
||||
syscall: false
|
||||
args:
|
||||
- index: 0
|
||||
type: sock
|
||||
selectors:
|
||||
- matchArgs:
|
||||
- index: 0
|
||||
operator: DPort
|
||||
values:
|
||||
- "6443"
|
||||
- "443"
|
||||
matchActions:
|
||||
- action: Post
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: cilium.io/v1alpha1
|
||||
kind: TracingPolicy
|
||||
metadata:
|
||||
name: network-egress-monitoring
|
||||
spec:
|
||||
kprobes:
|
||||
- call: tcp_connect
|
||||
syscall: false
|
||||
args:
|
||||
- index: 0
|
||||
type: sock
|
||||
selectors:
|
||||
- matchActions:
|
||||
- action: Post
|
||||
- call: tcp_close
|
||||
syscall: false
|
||||
args:
|
||||
- index: 0
|
||||
type: sock
|
||||
selectors:
|
||||
- matchActions:
|
||||
- action: Post
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: cilium.io/v1alpha1
|
||||
kind: TracingPolicy
|
||||
metadata:
|
||||
name: privilege-escalation-detection
|
||||
spec:
|
||||
kprobes:
|
||||
- call: __x64_sys_setuid
|
||||
syscall: true
|
||||
args:
|
||||
- index: 0
|
||||
type: int
|
||||
selectors:
|
||||
- matchArgs:
|
||||
- index: 0
|
||||
operator: Equal
|
||||
values:
|
||||
- "0"
|
||||
matchActions:
|
||||
- action: Post
|
||||
- call: __x64_sys_setgid
|
||||
syscall: true
|
||||
args:
|
||||
- index: 0
|
||||
type: int
|
||||
selectors:
|
||||
- matchArgs:
|
||||
- index: 0
|
||||
operator: Equal
|
||||
values:
|
||||
- "0"
|
||||
matchActions:
|
||||
- action: Post
|
||||
@@ -0,0 +1,31 @@
|
||||
apiVersion: cilium.io/v1alpha1
|
||||
kind: TracingPolicy
|
||||
metadata:
|
||||
name: shell-execution-monitoring
|
||||
spec:
|
||||
tracepoints:
|
||||
- subsystem: raw_syscalls
|
||||
event: sys_enter
|
||||
args:
|
||||
- index: 4
|
||||
type: syscall64
|
||||
selectors:
|
||||
- matchArgs:
|
||||
- index: 4
|
||||
operator: Equal
|
||||
values:
|
||||
- "59" # execve
|
||||
matchBinaries:
|
||||
- operator: In
|
||||
values:
|
||||
- /bin/sh
|
||||
- /bin/bash
|
||||
- /bin/dash
|
||||
- /usr/bin/bash
|
||||
- /usr/bin/sh
|
||||
- /usr/bin/curl
|
||||
- /usr/bin/wget
|
||||
- /usr/bin/nc
|
||||
- /usr/bin/ncat
|
||||
matchActions:
|
||||
- action: Post
|
||||
@@ -0,0 +1,26 @@
|
||||
apiVersion: cilium.io/v1alpha1
|
||||
kind: TracingPolicy
|
||||
metadata:
|
||||
name: sensitive-file-access
|
||||
spec:
|
||||
kprobes:
|
||||
- call: fd_install
|
||||
syscall: false
|
||||
args:
|
||||
- index: 0
|
||||
type: int
|
||||
- index: 1
|
||||
type: file
|
||||
selectors:
|
||||
- matchArgs:
|
||||
- index: 1
|
||||
operator: Prefix
|
||||
values:
|
||||
- /etc/shadow
|
||||
- /etc/passwd
|
||||
- /etc/gshadow
|
||||
- /root/.ssh
|
||||
- /etc/kubernetes/pki
|
||||
- /var/run/secrets/kubernetes.io
|
||||
matchActions:
|
||||
- action: Post
|
||||
@@ -0,0 +1,33 @@
|
||||
# Tetragon eBPF Runtime Security - Zero Trust Configuration
|
||||
|
||||
tetragon:
|
||||
exportAllowList: |-
|
||||
{"event_set": ["PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE", "PROCESS_TRACEPOINT"]}
|
||||
prometheus:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
labels:
|
||||
release: kube-prometheus-stack
|
||||
resources:
|
||||
limits:
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
|
||||
export:
|
||||
stdout:
|
||||
enabledCommand: true
|
||||
enabledArgs: true
|
||||
|
||||
# Enable JSON event export for log aggregation
|
||||
exportDirectory: /var/run/cilium/tetragon
|
||||
|
||||
# Prometheus metrics
|
||||
prometheus:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
labels:
|
||||
release: kube-prometheus-stack
|
||||
Reference in New Issue
Block a user