Articles by Toni Schmidbauer

As mentioned in our previous post about Falco, Falco is a security tool to monitor kernel events like system calls or Kubernetes audit logs to provide real-time alerts.

In this post I'll show to customize Falco for a specific use case. We would like to monitor the following events:

• An interactive shell is opened in a container
• Log all commands executed in an interactive shell in a container
• Log read and writes to files within an interactive shell inside a container
• Log commands execute via `kubectl/oc exec` which leverage the pod/exec K8s endpoint

Falco is a security tool to monitor kernel events like system calls to provide real-time alerts. In this post I'll document the steps taken to get Open Source Falco running on an OpenShift 4.12 cluster.

UPDATE: Use the falco-driver-loader-legacy image for OpenShift 4.12 deployments.

While playing around with Falco (worth another post) I had to force a MachineConfig update even so the actual configuration of the machine did not change.

This posts documents the steps taken.

This is my personal summary of experimenting with Red Hat's Multi Cloud Gateway (MCG) based on the upstream Noobaa project. MCG is part of Red Hat's OpenShift Data Foundation (ODF). ODF bundles the upstream projects Ceph and Noobaa.

An old man tries to refresh his Java skills and does DO378. He fails spectacularly at the first real example but learns a lot on the way.