Integrating by using generic webhooks | Integrating | Red Hat Advanced Cluster Security for Kubernetes 3.66

Configuring Red Hat Advanced Cluster Security for Kubernetes
Configuring policy notifications

With Red Hat Advanced Cluster Security for Kubernetes, you can send alert notifications as JSON messages to any webhook receiver. When a violation occurs, Red Hat Advanced Cluster Security for Kubernetes makes an HTTP POST request on the configured URL. The POST request body includes JSON-formatted information about the alert.

The webhook POST request’s JSON data includes a v1.Alert object and any custom fields that you configure, as shown in the following example:

{
  "alert": {
    "id": "<id>",
    "time": "<timestamp>",
    "policy": {
      "name": "<name>",
      ...
    },
    ...
  },
  "<custom_field_1>": "<custom_value_1>"
}

You can create multiple webhooks. For example, you can create one webhook for receiving all audit logs and another webhook for alert notifications.

To forward alerts from Red Hat Advanced Cluster Security for Kubernetes to any webhook receiver:

Set up a webhook URL to receive alerts.
Use the webhook URL to set up notifications in Red Hat Advanced Cluster Security for Kubernetes.
Identify the policies you want to send notifications for, and update the notification settings for those policies.

Configuring Red Hat Advanced Cluster Security for Kubernetes

Create a new integration in Red Hat Advanced Cluster Security for Kubernetes by using the webhook URL.

Procedure

On the RHACS portal, navigate to Platform Configuration → Integrations.
Scroll down to the Notifier Integrations section and select PagerDuty.
Click New Integration (add icon).
Enter a name for Integration Name.
Enter the webhook URL in the Endpoint field.

If your webhook receiver uses an untrusted certificate, enter a CA certificate in the CA Cert field; otherwise leave it blank.

The server certificate used by the webhook receiver must be valid for the endpoint DNS name. You can turn on the Skip TLS Verify toggle to ignore this validation. Red Hat does not recommend turning off TLS verification.

Optional: Turn on the Enable Audit Logging toggle, to receive alerts about all the changes made in Red Hat Advanced Cluster Security for Kubernetes.

Red Hat recommends using separate webhooks for alerts and audit logs to handle these messages differently.
To authenticate with the webhook receiver, enter details for one of the following:
- Username and Password for basic HTTP authentication
- Custom Header, for example: Authorization: Bearer <access_token>
Use Extra fields to include additional key-value pairs in the JSON object that Red Hat Advanced Cluster Security for Kubernetes sends. For example, if your webhook receiver accepts objects from multiple sources, you can add "source": "rhacs" as an extra field and then filter on this value to identify all alerts from Red Hat Advanced Cluster Security for Kubernetes.
Select Test (checkmark icon) to send a test message to verify that the integration with your generic webhook is working.
Select Create (save icon) to create the configuration.

Configuring policy notifications

Enable alert notifications for system policies.

Procedure

On the RHACS portal, navigate to Platform Configuration → System policies.
Select the check boxes for one or more policies that you want to send alerts for.
Select Actions → Enable Notification.
In the Enable Notifications dialog box, select the check box for the webhook notifier.

If you have not configured any other integrations, you will see No notifiers configured!.
Click Enable.

Red Hat Advanced Cluster Security for Kubernetes sends notifications on an opt-in basis. To receive notifications, you must first assign a notifier to the policy.
Notifications are only sent once for a given alert. If you have assigned a notifier to a policy, you will not receive a notification unless a violation generates a new alert.
Red Hat Advanced Cluster Security for Kubernetes creates a new alert for the following scenarios:
- A policy violation occurs for the first time in a deployment.
- A runtime-phase policy violation occurs in a deployment after you resolved the previous runtime alert for a policy in that deployment.