Kubernetes

First pull bombini image:

docker pull ghcr.io/bombinisecurity/bombini:v1.1.0

bombini.yaml manifest has bombini ConfigMap with all configuration setup. By default, only ProcMon detector is loaded. To customize your Bombini setup, please, follow the Configuration chapter.

Besides the DaemonSet, the manifest creates a ServiceAccount with a ClusterRole allowing to watch pods, and a FlowSchema limiting the load the agents put on kube-apiserver. Events are enriched with pod metadata, see the Kubernetes configuration chapter.

To start bombini DaemonSet run:

kubectl apply -f ./bombini.yaml

Events can be found in bombini k8s log.

Kind Example

Pull bombini image:

docker pull ghcr.io/bombinisecurity/bombini:v1.1.0

Install kind.

If your cwd is repo root change it to ./install/k8s

cd ./install/k8s

Create kind cluster:

kind create cluster --config ./kind-config.yaml --name bombini-test-cluster

Load bombini image in kind cluster:

kind load docker-image ghcr.io/bombinisecurity/bombini:v1.1.0 --name bombini-test-cluster

Start bombini:

kubectl apply -f ./bombini.yaml

Check events:

kubectl get pods | grep "^bombini" | awk '{print $1}' | xargs kubectl logs -f