falco icon indicating copy to clipboard operation
falco copied to clipboard

new http_output options (compression, batching, keep_alive)

Open artemNN opened this issue 8 months ago • 10 comments

http_output must have compression, batching and keep_alive options. This is relevant in HighLoad installations and without a falcosidekick in each k8s cluster.

artemNN avatar Dec 06 '23 16:12 artemNN

Agreed, http_output could be modernized!

@FedeDP @Issif

incertum avatar Dec 06 '23 19:12 incertum

@artemNN Could you give more details about what you mean by batching ?

Are you thinking about buffering a certain number of messages and send them grouped to the web server ?

sgaist avatar Dec 16 '23 13:12 sgaist

We are splitting PRs. Batching will be implemented in a follow up PR.

incertum avatar Dec 18 '23 16:12 incertum

@artemNN Could you give more details about what you mean by batching ?

Are you thinking about buffering a certain number of messages and send them grouped to the web server ?

Whith Batching option multiple events should be sent in a JSON array at its root. Buffer settings may include options like batch.size(events) or batch.delay(milliseconds)

artemNN avatar Dec 19 '23 10:12 artemNN

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana avatar Mar 18 '24 15:03 poiana

/remove-lifecycle stale

FedeDP avatar Mar 18 '24 15:03 FedeDP

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana avatar Jun 16 '24 21:06 poiana

/remove-lifecycle stale

FedeDP avatar Jun 17 '24 07:06 FedeDP

I would like to be able the manage the headers (for auth or else) and be able to use mTLS for the authentication between Falco and Falcosidekick/Talon.

Issif avatar Jun 18 '24 11:06 Issif

I would like to be able the manage the headers (for auth or else) and be able to use mTLS for the authentication between Falco and Falcosidekick/Talon.

AFAIK, mtls is already available for the http output. See https://github.com/falcosecurity/falco/blob/master/falco.yaml#L635

sgaist avatar Jun 24 '24 20:06 sgaist