rules icon indicating copy to clipboard operation
rules copied to clipboard

OCI artifacts and the rules files have different names

Open Issif opened this issue 1 year ago • 7 comments

Motivation

The name of the OCI artifact to package the rules file and the name of the .yaml containing the rules are not the same (- vs _).

See:

OCI File
falco-rules falco_rules
falco-incubating-rules falco-incubating_rules
falco-sandbox-rules falco-sandbox_rules

Aside, to install and load the rules, the end users need to know their exact names, it leads to a this kind of values.yaml for the official Helm chart:

falcoctl:
  config:
    artifact:
  		install:
    			refs: ["falco-rules:2","falco-incubating-rules:2","falco-sandbox-rules:2"]

falco:
  rules_file:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco-incubating_rules.yaml
    - /etc/falco/falco-sandbox_rules.yaml
    - /etc/falco/rules.d

Without a knowledge about that behavior, we tend to use the same name between the refs for falcoctl and and the list of rules to load.

Feature

The names of the files and OCI artifacts should be the same. Especially, because it would allow to prepare the Helm template to automatically add to the rules_file the downloaded rules. It's a better UX.

Alternatives

Additional context

Issif avatar Dec 20 '23 15:12 Issif