Add a plugin for Azure AKS k8_audit

[nissessenap]

Motivation

Just like in AWS I want to be able to monitor my k8s audit logs in Azure.

Feature

A implementation of reading k8s_aduit logs in AKS through Log Analytics Workspace.

Alternatives

AKS also supports sending logs directly to a storage account and a event hub

But to make the initial offering as similar to AWS I think starting with Log Analytics Workspace is a good idea.

Additional context

How to manage the Azure Diagnostic resources through terraform:
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting

[nissessenap]

I have started working on this feature.

[jasondellaluce]

While developing the current k8saudit plugin, I tried to design it so that it could be easy to develop integrations like this to fetch audit logs from managed k8s platforms. I'm excited to see the first one coming! 😄

Note that the whole k8saudit plugin is an importable Go struct. In your case, you probably just need to re-implement the open method and reuse all the extraction-related code:

plugins/plugins/k8saudit/pkg/k8saudit/source.go

Line 56 in 52e46f7

func (k *Plugin) Open(params string) (source.Instance, error) {

Let me know if you'd some help or to work together in this!

[jasondellaluce]

@nissessenap any news? There's a WIP EKS porting that you could use as inspiration #134. It took few lines of code to adapt the k8saudit plugin to the new integration.

[nissessenap]

@jasondellaluce sadly I haven't had time to look in to this. My guess I can take a look in a month or something similar, if any one else have time please go for it.

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[jasondellaluce]

/remove-lifecycle rotten

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale