Highlights for the week ending Nov 16 2023

General

• Logging infrastructure is now available on AWS and CAPA management clusters.
  • Loki and Promtail are deployed on AWS and CAPA management clusters
  • You can query for following Logs:
    • Kubernetes Pods
    • Audit logs from Kubernetes API server
    • Systemd units
  • Logs retention is set to 1 month
  • Only Management cluster Logs are available (for now)
  • Access Logs using Grafana, see usage doc

Falco

• Falco 0.7.0 is released. It means the underlying component version is higher than 0.36.0. The update contains falcoctl tool which helps to administrate Falco configuration and audit the state of the system. From now on Falco images will not be longer shipped with rules inside the image. Instead, they will use an init container to download the rules from an official repository and will check frequently for updates. As a consequence, the amount of rules Falco installs has drastically been lowered, and the previous ruleset has been divided into several categories, Standard, Incubating, and Sandbox. This reduces the noise in general but in case the previous ruleset is required, it is possible to enable this using the command line tool. For more information about the new situation, check Falco’s new rules repository.