K8s metadata from falco #1606
Merged
K8s metadata from falco #1606
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Molter73
force-pushed
the
mauro/k8s-metadata-from-falco
branch
from
37d2d6e
to
940dd28
Compare
This commit reenables Falco's full build in order to enable us using the container engines to extract k8s metadata from container labels. A feature flag has been added in order to maintain the current behaviour of using our custom engine that just grabs container ID from cgroups or default to using Falco's engines that also capture metadata by querying runtimes. In order to simplify and (somewhat) abstract extraction of fields, a new K8s class has been created. Unfortunately, due to how Falco works, we still need to pass in the inspector to the constructor and the events need to be forwarded to the getters for the metadata. By default only CRI, CRI-O and containerd engines are used (all 3 of them share the same API), but a couple configuration flags have been added to enable using docker and podman in case we need them at some point in time.
Molter73
force-pushed
the
mauro/k8s-metadata-from-falco
branch
4 times, most recently
from
707b724
to
b623e54
Compare
This was referenced Mar 27, 2024
collector/lib/K8s.h
Outdated
|
|
||
| inline std::string_view GetContainerLabel(const std::string& container_id, const std::string& label) { | ||
| const auto container = inspector_->m_container_manager.get_container(container_id); | ||
| if (container == nullptr || container->m_labels.count(label) == 0) { |
There was a problem hiding this comment.
Using count seems inefficient.
There was a problem hiding this comment.
It's what Falco does so I didn't pay it too much care, count returns either 1 or 0 since map doesn't allow duplicate keys (see https://en.cppreference.com/w/cpp/container/map/count)
I could change it to find, but I think the slowest operation will be creating the copy of the string either way
(And as I write this comment I realize there are some changes missing here that are in #1614, I'll add them back and rebase the other 2 PRs)
|
I don't think |
Molter73
force-pushed
the
mauro/k8s-metadata-from-falco
branch
from
604e236
to
d7fb9bc
Compare
ovalenti
reviewed
Apr 2, 2024
ovalenti
reviewed
Apr 2, 2024
JoukoVirtanen
approved these changes
Apr 11, 2024
* Add k8s based tests for namespace metadata (#1615)
5 tasks
4 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
As part of the ROX-22981 issue, requiring collector to filter what that is sent depending on k8s metadata like the namespace a given container belongs to, this PR re-enables Falco's full build, allowing for the container engines to be used again. By doing this, we can now query the CRI, CRI-O and containerd sockets for additional container information and get the namespace from that, as well as additional label information that might come in handy in the near future. Also added configuration options for falco's docker and podman container engine information gathering, since these might could be helpful for either testing or if we need to support native workloads.
Checklist
Automated testing
If any of these don't apply, please comment below.
Testing Performed
Manually tested the changes alongside the newly implemented k8s based tests.