Reflecting back on Kubecon North America 2020, a project that garnered a good amount of talks was Falco. If you are unfamiliar with Falco, Falco is an incubating project inside the CNCF that focuses on runtime security. Leveraging the blossoming support for eBPF, Falco adds the ability to describe security rules and take actions against violations. 

From an event recording standpoint, it is pretty hard to get around the kernel level monitoring that Falco provides. Because of the ability to introspect at deep levels on Kubernetes and the sub-systems that support Kubernetes, Falco can be a great source of truth. Harness can facilitate the installation of Falco and workloads that Falco will intercept. In this example, we go through Falco installation and deploying a sample workload. Like always you can watch the video and/or follow along with the blog. 

Getting Started – Harness Prep

If this is your first time on the Harness Platform, getting up and started is a breeze. First, you will need to install a Harness Delegate into your Kubernetes cluster. If you don’t have a Kubernetes cluster, my favorite way to spin one up is EKSCTL which will spin up an Amazon EKS cluster for you. 

#Create EKS Cluster
eksctl create cluster \
--name fabulous-falco \
--version 1.18 \
--region us-east-2 \
--nodegroup-name standard-workers \
--node-type t3.xlarge \
--nodes 2 \
--nodes-min 1 \
--nodes-max 3 \
--node-ami auto

The Harness Delegate is a worker node that performs actions on your behalf and setup is a breeze. 

Setup -> Harness Delegates -> Install Delegate. Select Kubernetes YAML and can give the name “falcofacilitator” 

Harness Delegate Install

Click Download and expand the tar.gz that gets downloaded. 

Harness Delegate Download
Harness Delegate TAR.GZ

Inside the expanded tar.gz, the README.txt file has all the commands you need to get installed. The most prudent would be “kubectl apply -f harness-delegate.yaml” which you can run. 

Harness Delegate Install

After a few moments, the Kubernetes Harness Delegate will appear in the UI. 

Harness Delegate UI

With the Delegate installed, wiring up a Kubernetes cluster to Harness is also pretty snappy. The quickest way is to add the Kubernetes cluster as a Harness Cloud Provider

To add a Cloud Provider, head to Setup -> Cloud Providers + Add Cloud Provider. Select Kubernetes cluster as the type. In the wizard, you can name the cluster “Falco Cluster” and since this is the Kubernetes cluster where we installed the Delegate, the Delegate can inherit the details about the cluster. 

Harness Kubernetes Cloud Provider

Hit Next and you will be all set to start leveraging your Kubernetes cluster. 

Falco Prep

There are several installation methods depending on the depth and injection strategy of Falco. For simplicity in the example, you can install Falco as a DameonSet. This will ensure that a Falco Pod will run on every node in your Kubernetes cluster. 

The good news is that the DameonSet installation of Falco is available in a Helm Chart. Harness has native Helm capabilities and has the ability to reference a Git Repository to retrieve the needed Helm Chart. 

To wire the Git Repository to Harness, head to Setup -> Connectors -> Source Code Repo Providers + Add Source Repo Provider. 

Display Name: Falco
URL: https://github.com/falcosecurity/charts
Branch: master 

GitHub does require authentication to pull, the easiest way is to enter your GitHub credentials. If this is your first time, Harness will store your password as an encrypted secret. 

Falco Git Repository

Once you hit Submit, you will be wired up to the repository. 

Falco Helm Repository

Harness and Falco – Installing Falco

With the wirings out of the way, now it is time to put Harness to work. We are going to install Falco via the Helm Chart then we are going to deploy a simple application to see what all has been generated by Falco. We will fill out the pieces of the Harness CD Abstraction Model to achieve the installation and deployment.  

To get this started, you will need to create a Harness Application which is the lifeblood of any deployment. 

Setup -> Applications + Add Application. Can name the Application “Falco is Watching”.

Once you hit submit, we can start wiring together the other pieces. Next on the list is a Harness Environment, basically where you want to deploy. In this case, we will use the Kubernetes cluster we are already leveraging. 

To create a new Harness Environment, go to Setup -> Falco is Watching -> Environments + Add Environment. 

Harness Environment

Once you hit Submit, can define the Infrastructure Definition for the Kubernetes cluster. In the middle of the UI, click + Add Infrastructure Definition. 

Name: Falco Cluster
Cloud Provider Type: Kubernetes Cluster
Deployment Type: Kubernetes
Cloud Provider: Falco Cluster

Harness Infrastructure Definition

Once you hit Submit, your Infrastructure Definition will be complete. 

Harness Falco Cluster

Next, you will need to wire in a pair of Harness Services e.g the deployables. One will be for the Helm Chart and one will be for an Nginx container. 

To add a Service, head to Setup -> Falco is Watching -> Services + Add Service. Let’s start with Falco first. 

Falco Service

Once you hit Submit, can link to the remote Helm Chart with is in the GitHub Repository.  Midway down under “Manifests” select the ellipses and click “Link Remote Manifests”.

Falco Service Overview

Can fill in the details of the location of the Helm Chart in GitHub. 

Manifest Format: Helm Chart from Source Repository 
Source Repository: Falco
Branch: master
File/Folder path: falco [https://github.com/falcosecurity/charts/tree/master/falco]
Helm Version: v3

Falco Helm Repository

Once you hit Submit, you will be wired up to the Remote Manifest. 

Falco Helm Manifestt

Next can create a new Harness Service for Nginx. Setup -> Falco is Watching -> Services + Add Service. 

Nginx Service

Since Nginx is available via public Docker Hub, we can add that location as an Artifact Source. Click on + Add Artifact Source then Docker Registry. 

Nginx Image

Can fill out the details for Nginx. Harness ships with a link to the public Docker Hub [e.g “Harness Docker Hub” as the Source Server].

Docker Image Name: library/nginx

Nginx Docker Hub

Harness provides all of the scaffolding you need for a basic Kubernetes deployment. Hit submit and you are all set for Nginx. 

Nginx Service Overview

Next, let’s define a pair of Harness Workflows to deploy our Services. Setup -> Falco is Watching -> Workflows + Add Workflow. Can fill in the pieces that were created in the example.

Name: Install Falco
Workflow Type: Rolling Deployment
Environment: Falco K8s Cluster
Service: Falco Install
Infrastructure Definition: Falco Cluster. 

Installing Falco

Once you hit Submit, can do the same for Nginx. Setup -> Falco is Watching -> Workflows + Add Workflow. 

Name: Deploy Nginx
Workflow Type: Rolling Deployment
Environment: Falco K8s Cluster
Service: Nginx
Infrastructure Definition: Falco Cluster 

Deploying Nginx

Once you hit Submit, you will have a pair of Workflows. 

Harness Falco Pipeline

The last item to create is a Harness Pipeline so that we can execute both of these Workflows in order. Setup -> Falco is Watching -> Pipelines + Add Pipeline. Can name the Pipeline “Falco Example Pipeline”.

Add Pipeline

 Can create a two-stage Pipeline, one per Workflow. To add a Stage, click on the +.

Pipeline Stages

The first Pipeline Stage will be to Install Falco. Can select the Workflow that was previously created. 

Falco CI/CD Pipeline

Next, add a second Harness Stage to Deploy Nginx. 

Nginx CI/CD Pipeline

With both Stages complete, your Pipeline should look like the following:

Pipeline Stages

With that last twisty out of the way, can review all of the CD Abstraction pieces that were created. 

CD Abstraction

Now it is time to execute your Pipeline and explore what Falco is capturing. 

Execute Your Falco Pipeline

After the setup, time to run your Harness CI/CD Pipeline. There are a few ways to do this, an easy way is to head over to Continuous Deployment in the left-hand navigation. Then select Deployments in the sub-menu then > Start New Deployment on the top right. 

In the Start New Deployment prompt, will prompt you for the required pieces of data. The only required piece is which version/tag of Nginx you want to deploy. For the example you can select “latest”.

New Falco Deployment

Click Submit and watch the Harness orchestration magic occur!

Exploring Your First Falco

Harness is able to lay down Falco’s Helm Chart and Nginx with ease. You need not install Helm to leverage Harness’s native Helm capabilities and can leverage Harrness’s scaffolding to quickly deploy Nginx into your Kubernetes cluster. Hitting submit you can see the two-stage pipeline running through Helm and Kubernetes deployments in each respective stage. 

Falco CI/CD Pipeline executing

With Falco and Nginx running, you take a look at some of the log information Falco generates. There are two excellent examples from Amazon Web Services and Better Programming which demonstrate modifying a sensitive configuration of Nginx and having the default Falco rules trigger and log that event.  

First, you can see that Falco is running on both of our Kubernetes worker nodes with “kubectl get pod -o wide”. The “*-falco-* Pod names are running on both of my example Kubernetes worker nodes. 

Falco DameonSet

The “ip-192-168-54-210.us-east-2.compute.internal” node both has Falco and Nginx running and will be the node to look at the Falco logs with. 

To check out the Falco logs that are currently generated by, run “kubectl logs <falco_pod_name>” which in my case is “kubectl logs release-53c46443-3cd8-313c-b0ed-10bc54c72705-falco-wp7tf”

Falco Logs

The AWS and Better Programming example recommend accessing/modifying a sensitive location in the Nginx container, for example, etc/shadow

To do that SSH into the running Nginx instance by “kubectl exec -it <nginx_pod_name> — bash” or in my case “kubectl exec -it harness-example-deployment-786b69bd8f-xbflj — bash

Then cat etc/shadow.

Sensitive Nginx

By re-running the Falco log command in the same Pod [kubectl logs <falco_pod_name>] you will see a message generated by Falco. 

Falco Output

Just like that, you are up and running with Falco. There is a lot of the art of the possible with third party integrations and log forwarders. When investigating new cloud-native technologies, Harness has you covered. 

Harness, Your Partner in New Technologies

The cliche saying that the only constant in technology is change marches on. With new approaches and ways of thinking coming of age, getting these new paradigms into your organization can be challenging. With Harness, the initial steps of operationalizing new technology is easy. If you have not already, feel free to sign up for a Harness Trial and start your journey today!

Cheers,

-Ravi