KubeArmor
KubeArmor copied to clipboard
feat: add support for audit alerts from bpflsm enforcer
Purpose of PR?:
Fixes #1477
Until now we depended upon System monitor to receive Audit Policy alerts, this PR contains the changes that will allow the enforcer to send Audit alerts as well thus reducing the dependency of the BPFLSM enforcer on the System monitor .
In addition, this PR also contains handling of some edge cases which were not handled earlier
- owner only + allow policy with an audit default posture
- owner id missing for owner only logs in BPFLSM
Does this PR introduce a breaking change?
If the changes in this PR are manually verified, list down the scenarios covered::
Additional information for reviewer? : Mention if this PR is part of any design or a continuation of previous PRs
Checklist:
- [ ] Bug fix. Fixes #
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] This change requires a documentation update
- [ ] PR Title follows the convention of
<type>(<scope>): <subject> - [ ] Commit has unit tests
- [ ] Commit has integration tests
Fixes #1477