{"id":15747783,"url":"https://github.com/developer-guy/kubernetes-response-engine-based-on-flux-v2-gitops-toolkit","last_synced_at":"2026-01-11T09:06:53.489Z","repository":{"id":104878742,"uuid":"375757769","full_name":"developer-guy/kubernetes-response-engine-based-on-flux-v2-gitops-toolkit","owner":"developer-guy","description":null,"archived":false,"fork":false,"pushed_at":"2021-07-04T15:46:32.000Z","size":369,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-02-06T11:23:27.670Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/developer-guy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-06-10T16:09:50.000Z","updated_at":"2021-07-04T15:46:35.000Z","dependencies_parsed_at":null,"dependency_job_id":"a0418078-e752-469c-8310-195679c87367","html_url":"https://github.com/developer-guy/kubernetes-response-engine-based-on-flux-v2-gitops-toolkit","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/developer-guy%2Fkubernetes-response-engine-based-on-flux-v2-gitops-toolkit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/developer-guy%2Fkubernetes-response-engine-based-on-flux-v2-gitops-toolkit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/developer-guy%2Fkubernetes-response-engine-based-on-flux-v2-gitops-toolkit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/developer-guy%2Fkubernetes-response-engine-based-on-flux-v2-gitops-toolkit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/developer-guy","download_url":"https://codeload.github.com/developer-guy/kubernetes-response-engine-based-on-flux-v2-gitops-toolkit/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246429449,"owners_count":20775805,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-04T05:21:51.063Z","updated_at":"2026-01-11T09:06:53.426Z","avatar_url":"https://github.com/developer-guy.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Kubernetes Response Engine based on Flux v2 GitOps Toolkit\n\n![kre_flux_v2_gitops](./assets/kre_flux_v2_gitops_toolkit.png)\n\n## Prerequisites\n\n* minikube v1.20.0\n* helm v3.6.0+g7f2df64\n* kubectl v1.21.1\n\n## Tutorial\n\n### Provision local Kubernetes Cluster\n\n```shell\nminikube start\n```\n\n### Install Flux V2 - GitOps Toolkit\n\nI highly recommended you to check it out [getting started](https://fluxcd.io/docs/get-started/) page of `Flux v2` to learn more about detailed installation of Flux v2 before jump into the next sections.\n\nWe have to define token and username informations for Flux v2 to successfully create a GitHub repository for its resources. Flux is installed in a GitOps way and its manifest will be pushed to the repository.\n\n```shell\nexport GITHUB_TOKEN=\u003ctoken\u003e\nexport GITHUB_USER=\u003cusername\u003e\n```\n\nOnce we defined the necessary environment variables, we can install Flux v2. This command will create and push its manifests to the repository, then install Flux components.\n\n```shell\nflux bootstrap github \\\n  --owner=$GITHUB_USER \\\n  --repository=fleet-infra \\\n  --branch=main \\\n  --path=./clusters/my-cluster \\\n  --personal\n```\n\nAfter we installed the Flux v2 components, the next step is creating our  [GitRepository](./alpine-gitsource.yaml) and [Kustomization](./alpine-kustomization.yaml) CRD's (Custom Resource Definitions). If you want to learn more about them, you can visit this [link](https://fluxcd.io/docs/components/).\n\nYou can apply these files like the following:\n\n```shell\nkubectl apply -f alpine-gitsource.yaml -f alpine-kustomization.yaml\n```\n\nor you can use the [Flux CLI](https://fluxcd.io/docs/cmd/#installation) to do the same thing.\n\nTo create `GitRepository`:\n\n```shell\nflux create source git alpine \\\n    --url https://github.com/developer-guy/desired-state-repository \\\n    --branch master \\\n    --interval 30s\n```\n\nTo create `Kustomization`:\n\n```shell\nflux create kustomization alpine \\\n    --source alpine \\\n    --path \"./\" \\\n    --prune true \\\n    --validation client \\\n    --interval 5m\n```\n\n### Install falco-event-listener\n\nAs the name suggests, this project will listen to an event in form of `CloudEvents` that forwarded from Falcosidekick which is a simple daemon for enhancing available outputs for Falco. Once, an event received from Falcosidekick, this project will update the YAML definition to scale its replicas to zero based on the informations in the event.\n\nAt the end of the day, the architecture of the demo is going to be:\n\nFalco w/HTTP --\u003e Falcosidekick w/CloudEvent --\u003e falco-event-listener\n\nIf you want to learn more about `CloudEvents`, you can follow this [link](https://cloudevents.io).\n\nLet's clone the project's repository first.\n\n```shell\ngit clone https://github.com/developer-guy/falco-event-listener\ncd falco-event-listener\n```\n\nThis project is basically a CLI application and uses the following [arguments](https://github.com/developer-guy/falco-event-listener/blob/master/falcoeventlistener.yaml#L12):\n\n```yaml\nargs:\n  - \"--owner\"\n  - \"developer-guy\" # this is the owner of the desired state repository\n  - \"--repository\"\n  - \"desired-state-repository\" # this is the repository which we store desired state configurations\n  - \"--file\"\n  - \"alpine.yaml\" # this is the file that we are going to update\n  - \"--github-token\"\n  - \"$(GITHUB_TOKEN)\"\n```\n\nBefore installing this project, we have to [create a GitHub PAT (Personal Access Token)](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) to update the desired state configurations which is in GitHub repository after we detect a malicious behaviour related to our Pod.\n\nAs you can see in the above arguments, we should pass `GITHUB_TOKEN` as an argument to our CLI application, in order to do that in Kubernetes environment, the best option is storing `GITHUB_TOKEN` in a Kubernetes Secret and [using Secret as environment variables](https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-environment-variables).\n\n```shell\nkubectl create namespace falco\nkubectl create secret generic github-secret \\\n         --from-literal GITHUB_TOKEN=$GITHUB_TOKEN \\\n         --namespace falco\n```\n\nLast but least, we're going to use `ko` tool which is created by Google to build, push our container image and deploy the project on Kubernetes cluster. `ko` is a simple, fast container image builder for Go applications.\n\nIf you want to learn more about it, you can follow the [official repository](https://github.com/google/ko) of the project.\n\nWe are also going to use `Container Registry` as an image repository service provided by the Google Cloud to Store, manage, and secure your Docker container images, but this is not an only the option for this demo, you can use `DockerHub`, `quay.io`, etc.\n\n```shell\nexport PROJECT_ID=$(gcloud config get-value project)\nexport KO_DOCKER_REPO=gcr.io/$PROJECT_ID\nko apply -f falcoeventlistener.yaml\n```\n\n\u003e If you are using private container registry, don't forget to create a registry secret to be able to pull and push images. You can follow the following guide to achieve this:                                                       \nhttps://colinwilson.uk/2020/07/09/using-google-container-registry-with-kubernetes/\n\nIf everything works well, we should see the similar output below:\n\n```shell\n$ kubectl get pods --namespace falco\nNAME                   READY   STATUS    RESTARTS   AGE\nfalco-event-listener   1/1     Running   0          59s\n```\n\nThe last thing we have to do is installing `Falco`, `Falcosidekick` and configuring `Falcodekick` to forward events to our project.\n\n### Installing Falco and Falcosidekick\n\nThere is a up-to-date and detail guide available to install `Falco` and `Falcosidekick`, you can follow this [link](https://github.com/falcosecurity/charts/blob/master/falcosidekick/README.md#installing-the-chart) to learn more about installing them.\n\nHere is that we are going to enable `CloudEvents` support of Falcosidekick.\n\n```shell\nhelm repo add falcosecurity https://falcosecurity.github.io/charts\nhelm repo update\nhelm upgrade --install falco falcosecurity/falco \\\n  --namespace falco \\\n  --set falcosidekick.enabled=true \\\n  --set falcosidekick.webui.enabled=true \\\n  --set falcosidekick.config.cloudevents.address=http://falco-event-listener\n```\n\nVerify if everything is working before move on to the next step.\n\n```shell\n$ kubectl get pods --namespace falco\nNAME                                      READY   STATUS    RESTARTS   AGE\nfalco-event-listener                      1/1     Running   0          5m19s\nfalco-falcosidekick-5854669c76-ddvrv      1/1     Running   0          2m16s\nfalco-falcosidekick-5854669c76-rdlqn      1/1     Running   0          2m16s\nfalco-falcosidekick-ui-7c5fc8dd54-q4qh9   1/1     Running   0          2m16s\nfalco-vkl4f                               1/1     Running   0          2m16s\n```\n\n## Test\n\nTo test this, we have to connect a shell within the container.\n\nLet's list the pods that we already have.\n\n```shell\n$ kubectl get pods\nNAME                                 READY   STATUS    RESTARTS   AGE\nalpine-deployment-77789455d6-m7flp   1/1     Running   15         3h6m\nalpine-deployment-77789455d6-v7fkw   1/1     Running   15         3h6m\npodinfo-6df788c7b8-gs5qb             1/1     Running   0          3h28m\npodinfo-6df788c7b8-sfxvd             1/1     Running   0          3h28m\n```\n\nNow, run the following command to connect a shell.\n\n```shell\n$ kubectl exec -ti alpine-deployment-77789455d6-m7flp -- sh -c \"uptime\"\n19:35:58 up  3:04,  load average: 3.12, 1.91, 1.22\n```\n\nOnce you run the command above, Falco will detect that malicious behavior and send it to the Falcosidekick via HTTP.\n\nYou should see the similar output below in the `Falco` logs:\n\n```shell\n{\"output\":\"19:35:58.532086161: Notice A shell was spawned in a container with an attached terminal (user=root user_loginuid=-1 k8s.ns=default k8s.pod=alpine-deployment-77789455d6-m7flp container=788861c3cf83 shell=sh parent=runc cmdline=sh -c uptime terminal=34816 container_id=788861c3cf83 image=alpine) k8s.ns=default k8s.pod=alpine-deployment-77789455d6-m7flp container=788861c3cf83\",\"priority\":\"Notice\",\"rule\":\"Terminal shell in container\",\"time\":\"2021-06-13T19:35:58.532086161Z\", \"output_fields\": {\"container.id\":\"788861c3cf83\",\"container.image.repository\":\"alpine\",\"evt.time\":1623612958532086161,\"k8s.ns.name\":\"default\",\"k8s.pod.name\":\"alpine-deployment-77789455d6-m7flp\",\"proc.cmdline\":\"sh -c uptime\",\"proc.name\":\"sh\",\"proc.pname\":\"runc\",\"proc.tty\":34816,\"user.loginuid\":-1,\"user.name\":\"root\"}}\n```\n\nand the similar output below in the `Falcosidekick` logs:\n\n```shell\nfalco-falcosidekick-5854669c76-ddvrv falcosidekick 2021/06/13 19:51:45 [INFO] : CloudEvents - Send OK\n```\n\nand the similar output below in the `falco-event-listener` logs:\n\n```shell\nfalco-event-listener falco-event-listener 2021/06/13 19:35:59 resp.Status=200 OK\nfalco-event-listener falco-event-listener 2021/06/13 19:35:59 resp.StatusCode=200\nfalco-event-listener falco-event-listener 2021/06/13 19:35:59 [Terminal shell in container] scaled down to zero alpine-deployment-77789455d6-m7flp from default because 19:35:58.532086161: Notice A shell was spawned in a container with an attached terminal (user=root user_loginuid=-1 k8s.ns=default k8s.pod=alpine-deployment-77789455d6-m7flp container=788861c3cf83 shell=sh parent=runc cmdline=sh -c uptime terminal=34816 container_id=788861c3cf83 image=alpine) k8s.ns=default k8s.pod=alpine-deployment-77789455d6-m7flp container=788861c3cf83\n```\n\nYou should also notice that there is a new commit in the `desired-state-repository` like the following picture:\n\n![update_desired_state_repository](./assets/update_desired_state_repository.png)\n\nAfter that commit, Flux v2 will detect that change and sync the current state of the cluster with the desired state in the GitHub repository, so the Pods of the `alpine` deployment will be terminated.\n\n```shell\n$ kubectl get pods -l app=alpine\nNo resources found in default namespace.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeveloper-guy%2Fkubernetes-response-engine-based-on-flux-v2-gitops-toolkit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdeveloper-guy%2Fkubernetes-response-engine-based-on-flux-v2-gitops-toolkit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeveloper-guy%2Fkubernetes-response-engine-based-on-flux-v2-gitops-toolkit/lists"}