Skip to main content

Runtime Security feature

Runtime Security integrates a runtime security tool into your cluster to detect anomalous activity that could pose a risk to the runtime layer and worker node kernel.

Falco is an open-source tool for monitoring and detecting anomalous activity in container and Kubernetes environments, developed by Sysdig and currently a CNCF (Cloud Native Computing Foundation) incubating project. Falco monitors operating system and container behavior in real time, then applies predefined rules to flag anomalous or risky activity.

FPT Cloud's Runtime Security integration lets you configure detailed alerts via Telegram or Gmail, so security events are detected promptly and administrators can respond quickly.

note

Security enhancement features are available only after the cluster is successfully created (status: Succeeded/Running).

Integrate Falco Engine​

Enable Falco Engine​

  1. Go to console.fptcloud.com and select Kubernetes.

    Kubernetes menu in the FPT Cloud portal

  2. Select the cluster to integrate Runtime Security for.

    Cluster selection screen

  3. Select the Security tab → Runtime Security, then enable it.

    Runtime Security enable toggle on the Security tab

  4. Select Confirm.

    Confirm dialog for enabling Runtime Security

Runtime Security is now enabled, but you won't receive alerts yet — no alert channel is configured.

Runtime Security enabled with no alert channel configured

Disable Falco Engine​

  1. Select the button currently showing Enable.

    Disable Runtime Security, step 1

  2. Enter the cluster name and select Disable.

    Disable Runtime Security, step 2

Result after disabling:

Runtime Security disabled state

Integrate Falco UI​

Enable Falco UI​

  1. Select the Security tab → Runtime Security, then enable it.

    Enabling Runtime Security before turning on Falco UI

  2. Enable the UI.

    Falco UI enable toggle

  3. Enter a Username and Password to access Falco UI, then select Confirm.

    Falco UI credentials form

    Falco UI credentials confirmation

  4. Download the kubeconfig file and port-forward the falco-falcosidekick-ui service. In Lens, go to Network → Services and filter by namespace fptcloud-runtime-security.

    Lens Services view filtered by fptcloud-runtime-security namespace

    Select the falco-falcosidekick-ui service and select Forward.

    Selecting Forward on the falco-falcosidekick-ui service

    Enter the port to forward and select Start.

    Port-forward configuration dialog

  5. Enter the Username and Password you configured when enabling the service.

    Falco UI login form

Result after login:

Falco UI dashboard after login

Dashboard with alerts:

Falco UI dashboard showing alerts

Update the Falco UI username and password​

  1. Select Edit Runtime.

    Edit Runtime option

  2. Edit the Username and Password, then select Confirm.

    Editing Falco UI credentials

    Confirming updated Falco UI credentials

Disable Falco UI​

Select Edit Runtime → toggle the enable button off → select Confirm.

Disabling Falco UI, step 1

Disabling Falco UI, step 2

Disabling Falco UI, step 3

Result after disabling Falco UI:

Falco UI disabled state

Integrate runtime security event notifications​

Telegram​

Enable notifications via Telegram​

  1. Log in to Telegram and search for BotFather.

    Searching for BotFather in Telegram

  2. Enter /newbot and name your bot.

    Creating a new bot with BotFather

  3. Create a group chat to receive notifications.

    Creating a Telegram group chat, step 1

    Creating a Telegram group chat, step 2

    Creating a Telegram group chat, step 3

    Creating a Telegram group chat, step 4

    Creating a Telegram group chat, step 5

  4. On the portal, enable Runtime Security Event Notification.

    Enabling Runtime Security Event Notification

  5. Select Telegram as the alert channel, enter the Chat ID and Token ID, then select Confirm.

    Telegram alert channel configuration form

Result after configuration:

Telegram alert channel configured successfully

When an anomaly is detected, Telegram receives an alert like this:

Example Telegram alert for a detected anomaly

Switch the notification channel to Gmail​

note

Enable 2-Step Verification on your Google Account before you create a Gmail Application Token.

  1. Go to Google App Passwords to create an Application Token.

    Google App Passwords page, step 1

    Google App Passwords page, step 2

  2. Select Edit Runtime.

    Edit Runtime option for Gmail notifications

  3. Enter your Gmail notification details and select Confirm.

    Gmail notification configuration form

Result after configuration:

Gmail alert channel configured successfully

When an anomaly occurs, the system sends an alert to Gmail:

Example Gmail alert for a detected anomaly

Disable runtime security event notifications​

Go to the Security tab → select Edit Runtime → disable Runtime Security Event Notification → select Confirm.

Disabling event notifications, step 1

Disabling event notifications, step 2

Disabling event notifications, step 3

Disabling event notifications, step 4

After disabling, you no longer receive alerts when anomalies occur.