Compare text

Find the difference between two text files

Real-time diff

Unified diff

Collapse lines

Highlight change

Syntax highlighting

Tools

falco chart value compare

Created 7 months agoDiff never expires

110 removals

261 lines

119 additions

269 lines

global:

image_prefix:

image_tag: ''

pullPolicy: IfNotPresent

team: security

helm:

check_deploy: true

check_deploy_timeout: 800

namespace:

env:

image:

pullPolicy: IfNotPresent

registry:

registry: docker.io

repository: falcosecurity/falco-no-driver

tag: "0.37.1"

tag: ""

imagePullSecrets: []

nameOverride: ""

fullnameOverride: ""

namespaceOverride:

namespaceOverride: ""

rbac:

podAnnotations: {}

create: true

serviceAccount:

create: true

create: false

annotations: {}

name: ""

podAnnotations: {}

podLabels: {}

podPriorityClassName: system-node-critical

podPriorityClassName:

podSecurityContext: {}

containerSecurityContext: {}

scc:

create: true

resources:

requests:

cpu: 100m

memory: 512Mi

limits:

cpu: 1000m

memory: 1024Mi

nodeSelector: {}

affinity: {}

tolerations: {}

tolerations:

- effect: NoSchedule

key: node-role.kubernetes.io/master

- effect: NoSchedule

key: node-role.kubernetes.io/control-plane

healthChecks:

livenessProbe:

initialDelaySeconds: 60

timeoutSeconds: 5

periodSeconds: 15

readinessProbe:

initialDelaySeconds: 30

timeoutSeconds: 5

periodSeconds: 15

tty: false

controller:

kind: daemonset

annotations: {}

daemonset:

updateStrategy:

type: RollingUpdate

deployment:

replicas: 1

services:

mounts:

volumes: []

volumeMounts: []

enforceProcMount: false

driver:

enabled: true

kind: ebpf

kind: kmod

kmod:

bufSizePreset: 4

dropFailedExit: false

ebpf:

path:

path: "${HOME}/.falco/falco-bpf.o"

hostNetwork: false

leastPrivileged: false

bufSizePreset: 4

dropFailedExit: false

modernEbpf:

leastPrivileged: false

bufSizePreset: 4

dropFailedExit: false

cpusForEachBuffer: 2

gvisor:

runsc:

path: /home/containerd/usr/local/sbin

root: /run/containerd/runsc

config: /run/containerd/runsc/config.toml

loader:

enabled: true

initContainer:

image:

pullPolicy: IfNotPresent

registry:

registry: docker.io

repository: falcosecurity/falco-driver-loader

tag: "0.37.1"

tag: ""

env:

env: []

- name: "DRIVER_CURL_OPTIONS"

value: "--connect-timeout 100000"

args: []

resources: {}

securityContext: {}

gvisor:

enabled: false

runsc:

path: /home/containerd/usr/local/sbin

root: /run/containerd/runsc

config: /run/containerd/runsc/config.toml

collectors:

enabled: true

docker:

enabled: true

socket: /var/run/docker.sock

containerd:

enabled: true

socket: /run/containerd/containerd.sock

crio:

enabled: false

enabled: true

socket: /run/crio/crio.sock

kubernetes:

enabled: true

enabled: false

apiAuth: /var/run/secrets/kubernetes.io/serviceaccount/token

pluginRef: "ghcr.io/falcosecurity/plugins/plugin/k8smeta:0.1.0"

apiUrl: "https://$(KUBERNETES_SERVICE_HOST)"

collectorHostname: ""

enableNodeFilter: true

collectorPort: ""

extra:

env: []

args: []

initContainers: []

certs:

existingSecret: ""

server:

key: ""

crt: ""

ca:

crt: ""

existingClientSecret: ""

client:

key: ""

crt: ""

customRules:

coinsrules.yml: |-

{}

coins_rules

falcosidekick:

enabled: true

enabled: false

fullfqdn: false

listenPort: 2801

listenPort: ""

replicaCount: 1

webui:

enabled: false

replicaCount: 1

config:

slack:

webhookurl:

outputformat: "all"

minimumpriority: "informational"

messageformat: 'Alert : rule *{{ .Rule }}* triggered in container : *{{ index .OutputFields "container.name" }}*'

customfields:

environment:

sumologic:

receiverURL:

minimumpriority: "informational"

falcoctl:

image:

pullPolicy: IfNotPresent

registry:

registry: docker.io

repository: falcosecurity/falcoctl

tag: "0.7.2"

artifact:

install:

enabled: true

env: {}

env: []

args: ["--verbose"]

args: ["--log-format=json"]

resources: {}

securityContext: {}

mounts:

volumeMounts: []

follow:

enabled: false

enabled: true

env: {}

env: []

args: ["--verbose"]

args: ["--log-format=json"]

resources: {}

securityContext: {}

mounts:

volumeMounts: []

config:

indexes:

- name: falcosecurity

url: https://falcosecurity.github.io/falcoctl/index.yaml

artifact:

allowedTypes:

- rulesfile

- plugin

install:

resolveDeps: false

resolveDeps: true

refs: [falco-rules:0]

refs: [falco-rules:3]

rulesfilesDir: /rulesfiles

pluginsDir: /plugins

follow:

refs: [falco-rules:0]

refs: [falco-rules:3]

every: 6h

falcoversions: http://localhost:8765/versions

rulesfilesDir: /rulesfiles

pluginsDir: /plugins

falco:

rules_file:

- /etc/falco/falco_rules.yaml

- /etc/falco/falco_rules.local.yaml

- /etc/falco/rules.d

rule_matching: first

outputs_queue:

capacity: 0

load_plugins: []

plugins:

- name: k8saudit

library_path: libk8saudit.so

init_config:

maxEventSize: 262144

webhookMaxBatchSize: 12582912

sslCertificate: /etc/falco/falco.pem

open_params: "http://:9765/k8s-audit"

- name: cloudtrail

library_path: libcloudtrail.so

- name: json

library_path: libjson.so

init_config: ""

load_plugins: []

watch_config_files: true

time_format_iso_8601: false

json_output: true

priority: debug

json_output: false

json_include_output_property: true

json_include_tags_property: true

Text moved to lines 239-242

log_stderr: true

log_syslog: true

log_level: info

libs_logger:

enabled: false

severity: debug

priority: informational

buffered_outputs: false

Text moved to lines 248-255

syscall_event_drops:

threshold: .1

actions:

- log

- alert

rate: .03333

max_burst: 1

simulate_drops: false

syscall_event_timeouts:

max_consecutives: 1000

syscall_buf_size_preset: 4

modern_bpf:

cpus_for_each_syscall_buffer: 2

output_timeout: 2000

outputs:

rate: 1

rate: 0

max_burst: 1000

stdout_output:

enabled: true

syslog_output:

enabled: true

file_output:

enabled: false

keep_alive: false

filename: ./events.txt

stdout_output:

http_output:

enabled: true

enabled: false

url: ""

user_agent: "falcosecurity/falco"

insecure: false

ca_cert: ""

ca_bundle: ""

ca_path: "/etc/falco/certs/"

mtls: false

client_cert: "/etc/falco/certs/client/client.crt"

client_key: "/etc/falco/certs/client/client.key"

echo: false

compress_uploads: false

keep_alive: false

Text moved with changes from lines 243-250 (88.8% similarity)

program_output:

enabled: false

keep_alive: false

program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX"

grpc_output:

enabled: false

grpc:

enabled: false

bind_address: "unix:///run/falco/falco.sock"

threadiness: 0

webserver:

enabled: true

threadiness: 0

listen_port: 8765

k8s_healthz_endpoint: /healthz

ssl_enabled: false

ssl_certificate: /etc/falco/falco.pem

Text moved with changes to lines 222-229 (88.8% similarity)

Text moved from lines 203-206

program_output:

log_stderr: true

enabled: false

log_syslog: true

keep_alive: false

log_level: info

program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX"

libs_logger:

http_output:

enabled: false

url: ""

user_agent: "falcosecurity/falco"

grpc:

enabled: false

bind_address: "unix:///run/falco/falco.sock"

severity: debug

threadiness: 0

output_timeout: 2000

grpc_output:

syscall_event_timeouts:

max_consecutives: 1000

Text moved from lines 211-218

syscall_event_drops:

threshold: .1

actions:

- log

- alert

rate: .03333

max_burst: 1

simulate_drops: false

metrics:

enabled: false

metadata_download:

interval: 1h

max_mb: 100

output_rule: true

chunk_wait_us: 1000

resource_utilization_enabled: true

watch_freq_sec: 1

state_counters_enabled: true

kernel_event_counters_enabled: true

libbpf_stats_enabled: true

convert_memory_to_mb: true

include_empty_values: false

base_syscalls:

custom_set: []

repair: false

Saved diffs

Original text

Open file

global:
  image_prefix: 
  image_tag: ''
  pullPolicy: IfNotPresent
  team: security
helm:
  check_deploy: true
  check_deploy_timeout: 800
namespace: 
env: 
image:
  pullPolicy: IfNotPresent
  registry: 
  repository: falcosecurity/falco-no-driver
  tag: "0.37.1"
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
namespaceOverride: 
rbac:
  create: true
serviceAccount:
  create: true
  annotations: {}
  name: ""
podAnnotations: {}
podLabels: {}
podPriorityClassName: system-node-critical
podSecurityContext: {}
containerSecurityContext: {}
scc:
  create: true
resources:
  requests:
    cpu: 100m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 1024Mi
nodeSelector: {}
affinity: {}
tolerations: {}
healthChecks:
  livenessProbe:
    initialDelaySeconds: 60
    timeoutSeconds: 5
    periodSeconds: 15
  readinessProbe:
    initialDelaySeconds: 30
    timeoutSeconds: 5
    periodSeconds: 15
tty: false
controller:
  kind: daemonset
  annotations: {}
  daemonset:
    updateStrategy:
      type: RollingUpdate
  deployment:
    replicas: 1
services:
mounts:
  volumes: []
  volumeMounts: []
  enforceProcMount: false
driver:
  enabled: true
  kind: ebpf
  ebpf:
    path:
    hostNetwork: false
    leastPrivileged: false
  loader:
    enabled: true
    initContainer:
      image:
        pullPolicy: IfNotPresent
        registry: 
        repository: falcosecurity/falco-driver-loader
        tag: "0.37.1"
      env:
        - name: "DRIVER_CURL_OPTIONS"
          value: "--connect-timeout 100000"
      args: []
      resources: {}
      securityContext: {}
gvisor:
  enabled: false
  runsc:
    path: /home/containerd/usr/local/sbin
    root: /run/containerd/runsc
    config: /run/containerd/runsc/config.toml
collectors:
  enabled: true
  docker:
    enabled: true
    socket: /var/run/docker.sock
  containerd:
    enabled: true
    socket: /run/containerd/containerd.sock
  crio:
    enabled: false
    socket: /run/crio/crio.sock
  kubernetes:
    enabled: true
    apiAuth: /var/run/secrets/kubernetes.io/serviceaccount/token
    apiUrl: "https://$(KUBERNETES_SERVICE_HOST)"
    enableNodeFilter: true
extra:
  env: []
  args: []
  initContainers: []
certs:
  existingSecret: ""
  server:
    key: ""
    crt: ""
  ca:
    crt: ""
customRules:
  coinsrules.yml: |-
    coins_rules
falcosidekick:
  enabled: true
  fullfqdn: false
  listenPort: 2801
  replicaCount: 1
  webui:
    enabled: false
    replicaCount: 1
  config:
    slack:
      webhookurl: 
      outputformat: "all"
      minimumpriority: "informational"
      messageformat: 'Alert : rule *{{ .Rule }}* triggered in container : *{{ index .OutputFields "container.name" }}*'
    customfields:
      environment: 
    sumologic:
      receiverURL: 
      minimumpriority: "informational"
falcoctl:
  image:
    pullPolicy: IfNotPresent
    registry: 
    repository: falcosecurity/falcoctl
    tag: "0.7.2"
  artifact:
    install:
      enabled: true 
      env: {}
      args: ["--verbose"]
      resources: {}
      securityContext: {}
    follow:
      enabled: false
      env: {}
      args: ["--verbose"]
      resources: {}
      securityContext: {}
  config:
    indexes:
    - name: falcosecurity 
      url: https://falcosecurity.github.io/falcoctl/index.yaml
    artifact:
      allowedTypes:
        - rulesfile
      install:
        resolveDeps: false
        refs: [falco-rules:0]
        rulesfilesDir: /rulesfiles
        pluginsDir: /plugins
      follow:
        refs: [falco-rules:0]
        every: 6h
        falcoversions: http://localhost:8765/versions
        rulesfilesDir: /rulesfiles
        pluginsDir: /plugins
falco:
  rules_file:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco_rules.local.yaml
    - /etc/falco/rules.d
  plugins:
    - name: k8saudit
      library_path: libk8saudit.so
      init_config:
        maxEventSize: 262144
        webhookMaxBatchSize: 12582912
        sslCertificate: /etc/falco/falco.pem
      open_params: "http://:9765/k8s-audit"
    - name: cloudtrail
      library_path: libcloudtrail.so
    - name: json
      library_path: libjson.so
      init_config: ""
  load_plugins: []
  watch_config_files: true
  time_format_iso_8601: false
  json_output: true
  json_include_output_property: true
  json_include_tags_property: true
  log_stderr: true
  log_syslog: true
  log_level: info
  libs_logger:
    enabled: false
    severity: debug
  priority: informational
  buffered_outputs: false
  syscall_event_drops:
    threshold: .1
    actions:
      - log
      - alert
    rate: .03333
    max_burst: 1
    simulate_drops: false
  syscall_event_timeouts:
    max_consecutives: 1000
  syscall_buf_size_preset: 4
  modern_bpf:
    cpus_for_each_syscall_buffer: 2
  output_timeout: 2000
  outputs:
    rate: 1
    max_burst: 1000
  syslog_output:
    enabled: true
  file_output:
    enabled: false
    keep_alive: false
    filename: ./events.txt
  stdout_output:
    enabled: true
  webserver:
    enabled: true
    threadiness: 0
    listen_port: 8765
    k8s_healthz_endpoint: /healthz
    ssl_enabled: false
    ssl_certificate: /etc/falco/falco.pem
  program_output:
    enabled: false
    keep_alive: false
    program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX"
  http_output:
    enabled: false
    url: ""
    user_agent: "falcosecurity/falco"
  grpc:
    enabled: false
    bind_address: "unix:///run/falco/falco.sock"
    threadiness: 0
  grpc_output:
    enabled: false
  metadata_download:
    max_mb: 100
    chunk_wait_us: 1000
    watch_freq_sec: 1

Changed text

Open file

image:
  pullPolicy: IfNotPresent
  registry: docker.io
  repository: falcosecurity/falco-no-driver
  tag: ""
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
namespaceOverride: ""
podAnnotations: {}
serviceAccount:
  create: false
  annotations: {}
  name: ""
podLabels: {}
podPriorityClassName:
podSecurityContext: {}
containerSecurityContext: {}
scc:
  create: true
resources:
  requests:
    cpu: 100m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 1024Mi
nodeSelector: {}
affinity: {}
tolerations:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
  - effect: NoSchedule
    key: node-role.kubernetes.io/control-plane
healthChecks:
  livenessProbe:
    initialDelaySeconds: 60
    timeoutSeconds: 5
    periodSeconds: 15
  readinessProbe:
    initialDelaySeconds: 30
    timeoutSeconds: 5
    periodSeconds: 15
tty: false
controller:
  kind: daemonset
  annotations: {}
  daemonset:
    updateStrategy:
      type: RollingUpdate
  deployment:
    replicas: 1
services:
mounts:
  volumes: []
  volumeMounts: []
  enforceProcMount: false
driver:
  enabled: true
  kind: kmod
  kmod:
    bufSizePreset: 4
    dropFailedExit: false
  ebpf:
    path: "${HOME}/.falco/falco-bpf.o"
    hostNetwork: false
    leastPrivileged: false
    bufSizePreset: 4
    dropFailedExit: false
  modernEbpf:
    leastPrivileged: false
    bufSizePreset: 4
    dropFailedExit: false
    cpusForEachBuffer: 2
  gvisor:
    runsc:
      path: /home/containerd/usr/local/sbin
      root: /run/containerd/runsc
      config: /run/containerd/runsc/config.toml
  loader:
    enabled: true
    initContainer:
      image:
        pullPolicy: IfNotPresent
        registry: docker.io
        repository: falcosecurity/falco-driver-loader
        tag: ""
      env: []
      args: []
      resources: {}
      securityContext: {}
collectors:
  enabled: true
  docker:
    enabled: true
    socket: /var/run/docker.sock
  containerd:
    enabled: true
    socket: /run/containerd/containerd.sock
  crio:
    enabled: true
    socket: /run/crio/crio.sock
  kubernetes:
    enabled: false
    pluginRef: "ghcr.io/falcosecurity/plugins/plugin/k8smeta:0.1.0"
    collectorHostname: ""
    collectorPort: ""
extra:
  env: []
  args: []
  initContainers: []
certs:
  existingSecret: ""
  server:
    key: ""
    crt: ""
  ca:
    crt: ""
  existingClientSecret: ""
  client:
    key: ""
    crt: ""
customRules:
  {}
falcosidekick:
  enabled: false
  fullfqdn: false
  listenPort: ""
falcoctl:
  image:
    pullPolicy: IfNotPresent
    registry: docker.io
    repository: falcosecurity/falcoctl
    tag: "0.7.2"
  artifact:
    install:
      enabled: true
      env: []
      args: ["--log-format=json"]
      resources: {}
      securityContext: {}
      mounts:
        volumeMounts: []
    follow:
      enabled: true
      env: []
      args: ["--log-format=json"]
      resources: {}
      securityContext: {}
      mounts:
        volumeMounts: []
  config:
    indexes:
    - name: falcosecurity
      url: https://falcosecurity.github.io/falcoctl/index.yaml
    artifact:
      allowedTypes:
        - rulesfile
        - plugin
      install:
        resolveDeps: true
        refs: [falco-rules:3]
        rulesfilesDir: /rulesfiles
        pluginsDir: /plugins
      follow:
        refs: [falco-rules:3]
        every: 6h
        falcoversions: http://localhost:8765/versions
        rulesfilesDir: /rulesfiles
        pluginsDir: /plugins
falco:
  rules_file:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco_rules.local.yaml
    - /etc/falco/rules.d
  rule_matching: first
  outputs_queue:
    capacity: 0
  load_plugins: []
  plugins:
    - name: k8saudit
      library_path: libk8saudit.so
      init_config:
      open_params: "http://:9765/k8s-audit"
    - name: cloudtrail
      library_path: libcloudtrail.so
    - name: json
      library_path: libjson.so
      init_config: ""
  watch_config_files: true
  time_format_iso_8601: false
  priority: debug
  json_output: false
  json_include_output_property: true
  json_include_tags_property: true
  buffered_outputs: false
  outputs:
    rate: 0
    max_burst: 1000
  stdout_output:
    enabled: true
  syslog_output:
    enabled: true
  file_output:
    enabled: false
    keep_alive: false
    filename: ./events.txt
  http_output:
    enabled: false
    url: ""
    user_agent: "falcosecurity/falco"
    insecure: false
    ca_cert: ""
    ca_bundle: ""
    ca_path: "/etc/falco/certs/"
    mtls: false
    client_cert: "/etc/falco/certs/client/client.crt"
    client_key: "/etc/falco/certs/client/client.key"
    echo: false
    compress_uploads: false
    keep_alive: false
  program_output:
    enabled: false
    keep_alive: false
    program: "jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX"
  grpc_output:
    enabled: false
  grpc:
    enabled: false
    bind_address: "unix:///run/falco/falco.sock"
    threadiness: 0
  webserver:
    enabled: true
    threadiness: 0
    listen_port: 8765
    k8s_healthz_endpoint: /healthz
    ssl_enabled: false
    ssl_certificate: /etc/falco/falco.pem
  log_stderr: true
  log_syslog: true
  log_level: info
  libs_logger:
    enabled: false
    severity: debug
  output_timeout: 2000
  syscall_event_timeouts:
    max_consecutives: 1000
  syscall_event_drops:
    threshold: .1
    actions:
      - log
      - alert
    rate: .03333
    max_burst: 1
    simulate_drops: false
  metrics:
    enabled: false
    interval: 1h
    output_rule: true
    resource_utilization_enabled: true
    state_counters_enabled: true
    kernel_event_counters_enabled: true
    libbpf_stats_enabled: true
    convert_memory_to_mb: true
    include_empty_values: false
  base_syscalls:
    custom_set: []
    repair: false