apps: Allow calico-accountant drop and execute in Falco

elastisys · Oct 12, 2023 · cc88455 · cc88455
1 parent e06aebb
commit cc88455
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/helmfile/values/falco/falco-common.yaml.gotmpl b/helmfile/values/falco/falco-common.yaml.gotmpl
@@ -307,6 +307,10 @@ customRules:
     - list: known_binaries_to_read_environment_variables_from_proc_files
       append: true
       items: [systemd-run, rook, udevadm]
+    - list: known_drop_and_execute_containers
+      append: true
+      items:
+        - ghcr.io/elastisys/calico-accountant # when .calicoAccountant.backend = nftables
 falcosidekick:
   enabled: {{ .Values.falco.alerts.enabled }}
   config: