Available in:  Ultimate/EE

Included in extensions:  Advanced Infrastructure Security

The module lifecycle stage: Generally available version

The module has requirements for installation

How to explicitly enable or disable the module…

You may explicitly enable or disable the module in one of the following ways:

  • Via Deckhouse web UI. In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the runtime-audit-engine module and enable (or disable) the “Module enabled” toggle. Save changes.

    Example:

    Module enable/disable interface

  • Via Deckhouse CLI (d8).

    Use the d8 system module enable command for enabling, or d8 system module disable command for disabling the module (you need Deckhouse CLI (d8), configured to work with the cluster).

    Example of enabling the module:

    d8 system module enable runtime-audit-engine

  • Using ModuleConfig runtime-audit-engine.

    Set spec.enabled to true or false in ModuleConfig runtime-audit-engine (create it if necessary).

    Example of a manifest to enable module runtime-audit-engine:

    apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: runtime-audit-engine
spec:
  enabled: true

How to configure the module…

You can configure the module in one of the following ways:

  • Via Deckhouse web UI.

    In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the runtime-audit-engine module and enable the “Advanced Settings” toggle. Fill in the required fields in the “Configuration” tab or specify the module settings in YAML format on the “YAML” tab, without the top-level settings key. Save the changes.

    Example:

    Module settings interface

    You can also edit the ModuleConfig object runtime-audit-engine on the “YAML” tab in the module settings window (“System” → “System Management” → “Deckhouse” → “Modules”, open the module runtime-audit-engine) by specifying the schema version in the spec.version parameter and the necessary module parameters in the spec.settings section.

  • Via Deckhouse CLI (d8) (requires Deckhouse CLI (d8) configured to work with the cluster).

    Edit the existing ModuleConfig runtime-audit-engine (for more details on configuring Deckhouse Platform, see the documentation) by executing the following command:

    d8 k edit mc runtime-audit-engine

    Make the necessary changes in the spec.settings section. If necessary, specify the schema version in the spec.version parameter. Save the changes.

    You can also create a manifest file for ModuleConfig runtime-audit-engine using the example below. Fill in the spec.settings section with the required module parameters. If necessary, specify the schema version in the spec.version parameter.

    Apply the manifest using the following command (indicate the manifest file name):

    d8 k apply -f <FILENAME>

    Example of a manifest for ModuleConfig runtime-audit-engine:

    apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: runtime-audit-engine
spec:
  version: 1
  enabled: true
  settings: # Module parameters from the "Parameters" section below.

How to change the module release channel…

To change the module release channel, follow the steps in How do I change the release channel for a module?.

Requirements

To the Kubernetes version: 1.31 and above.

To the Deckhouse Platform version: 1.74 and above.

Parameters

Schema version: 1

  • settings
    object
    • settings.builtInRulesList
      array of strings
      List of enabled default rules. You can specify an empty list [] to disable built-in rules.

      Default: [ "Fstec" ]

      Examples: 

      builtInRulesList:
- Fstec

      builtInRulesList: []
      • settings.builtInRulesList.Element of the array
        string

        Allowed values: Fstec

    • settings.builtInRulesTypes
      object

      Disabling built-in rules by event source type.

      By default, all built-in rule types are enabled. Set the corresponding sub-parameter to false to stop rendering rules of this type.

      Default: {}

      Examples: 

      {}

      k8sAudit: false

      syscall: false

      k8sAudit: false
syscall: false
      • settings.builtInRulesTypes.k8sAudit
        boolean

        If false, built-in rules with the K8sAudit source are not rendered.

        When the security-events-manager module is enabled, built-in K8sAudit rules are automatically disabled to avoid duplication. Setting this parameter to true explicitly overrides this behavior and keeps the rules rendered.

        Default: true

      • settings.builtInRulesTypes.syscall
        boolean
        If false, built-in rules with the Syscall source (used by default when source is not specified) are not rendered.

        Default: true

    • settings.debugLogging
      boolean
      If true, all events will be duplicated to stdout.
    • settings.resourcesRequests
      object

      Max amounts of CPU and memory resources that the pod can request when selecting a node.

      If the vertical-pod-autoscaler module is disabled, then these values become the default ones.

      Default: {}

      Examples: 

      mode: VPA
vpa:
  cpu:
    max: 2
    min: 50m
  memory:
    max: 2Gi
    min: 256Mi
  mode: Auto

      mode: VPA
vpa:
  cpu:
    max: 3000m
    min: 1
  memory:
    max: 4096
    min: 1024
  mode: Initial

      mode: Static
static:
  cpu: 55m
  memory: 256Ki
      • settings.resourcesRequests.limitRange

        Configuration for LimitRange that constrains container resources in the module namespace. Used as a safety net to prevent unbounded resource consumption (e.g., due to memory leaks).

        This parameter is optional:

        • set false to disable LimitRange explicitly;
        • set an object with settings to create LimitRange.

        LimitRange applies to every container of the module, not only to Falco. For a configuration example and the value constraints, see the FAQ.

        Default: false

        Examples: 

        limitRange: false

        containerDefault:
  cpu: 2000m
  memory: 1Gi
containerMax:
  cpu: 2000m
  memory: 1Gi

        containerDefault:
  cpu: 1000m
  memory: 1Gi
containerDefaultRequest:
  cpu: 10m
  memory: 25Mi
containerMax:
  cpu: '2'
  memory: 2Gi
containerMin:
  cpu: 5m
  memory: 10Mi
        • settings.resourcesRequests.limitRange.containerDefault
          object
          Default resource limits applied to containers that don’t specify their own limits.

          Default: {}

          • settings.resourcesRequests.limitRange.containerDefault.cpu
            Default CPU limit.
          • settings.resourcesRequests.limitRange.containerDefault.memory
            Default memory limit.

            Default: 1Gi

        • settings.resourcesRequests.limitRange.containerDefaultRequest
          object
          Default resource requests applied to containers.

          Default: {}

          • settings.resourcesRequests.limitRange.containerDefaultRequest.cpu
            Default CPU request.
          • settings.resourcesRequests.limitRange.containerDefaultRequest.memory
            Default memory request.

            Default: 10Mi

        • settings.resourcesRequests.limitRange.containerMax
          object
          Maximum resource limits for any container.

          Default: {}

          • settings.resourcesRequests.limitRange.containerMax.cpu
            Maximum CPU limit.
          • settings.resourcesRequests.limitRange.containerMax.memory
            Maximum memory limit.

            Default: 1Gi

        • settings.resourcesRequests.limitRange.containerMin
          object
          Minimum resource limits for any container.

          Default: {}

          • settings.resourcesRequests.limitRange.containerMin.cpu
            Minimum CPU limit.
          • settings.resourcesRequests.limitRange.containerMin.memory
            Minimum memory limit.

            Default: 10Mi

      • settings.resourcesRequests.mode
        string

        Required value

        Resource request management mode:

        • Static is a classic one. In it, you explicitly specify requests. The parameters of this mode are defined in the static parameter section;
        • VPA mode uses VPA. You can configure this mode by modifying parameters in the vpa parameter section.

        Default: VPA

        Allowed values: VPA, Static

      • settings.resourcesRequests.static
        object
        Resource request management options for the Static mode.

        Default: {}

        • settings.resourcesRequests.static.cpu

          Required value

          Configuring CPU requests.

          Default: 50m

        • settings.resourcesRequests.static.memory

          Required value

          Configuring memory requests.

          Default: 64Mi

      • settings.resourcesRequests.vpa
        object
        Resource request management options for the VPA mode.

        Default: {}

        • settings.resourcesRequests.vpa.cpu
          object

          Required value

          CPU-related parameters.

          Default: {}

          • settings.resourcesRequests.vpa.cpu.max
            The maximum value that the VPA can set for the CPU requests.

            Default: 4000m

          • settings.resourcesRequests.vpa.cpu.min
            The minimum value that the VPA can set for the CPU requests.

            Default: 50m

        • settings.resourcesRequests.vpa.memory
          object

          Required value

          The amount of memory requested.

          Default: {}

          • settings.resourcesRequests.vpa.memory.max
            The maximum memory requests the VPA can set.

            Default: 5Gi

          • settings.resourcesRequests.vpa.memory.min
            The minimum memory requests the VPA can set.

            Default: 64Mi

        • settings.resourcesRequests.vpa.mode
          string

          Required value

          The VPA usage mode.

          Default: Initial

          Allowed values: Initial, Auto

        • settings.resourcesRequests.vpa.scopeLabel
          string
          Node label key used by VPA to split DaemonSet pods into subgroups for per-group resource recommendations.

          Default: node.deckhouse.io/group

          Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?[A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?$