plugins
plugins copied to clipboard
falcosecurity
new(plugins/k8smeta): update k8smeta plugin to require plugin API version 3.9.0.
What type of PR is this?
/kind cleanup /kind feature
Any specific area of the project related to this PR?
/area plugins
What this PR does / why we need it:
Implemented the "suggested output fields feature", by suggesting k8smeta.pod.name and k8smeta.ns.name as output fields.
Also, entirely avoid the proc scan, instead relying on the listening CAPability to initially loop over the thread table to attach pod_uid to threads.
Following the above, hostProc initConfig key is now deprecated and unused.
Moved the plugin to 0.3.0 too (given the minimum plugin API version changes).
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
Also, we might want to use the provided logger by the sdk, like i did here for the container plugin: https://github.com/FedeDP/container_plugin/pull/26
This would allow use to drop the spdlog dep, to have better unified logging, and to drop the verbosity init config key, since we would then use the verbosity used for libs logger (https://github.com/falcosecurity/libs/blob/3d1d4a930d3a16f3e72ab62876ba0837c02d2ec5/userspace/libsinsp/plugin.cpp#L79).
I will make the change in its own commit.
[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: FedeDP, leogr
The full list of commands accepted by this bot can be found here.
The pull request process is described here
- ~~OWNERS~~ [leogr]
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
I will make the change in its own commit.
Won't do that here since it would be a bit too big. We can fix it later if needed.