search

falcosecurity / event-generator

Generate a variety of suspect actions that are detected by Falco rulesets
Apache License 2.0
94 stars 40 forks source link

event-generator launched through helm chart, can't run k8saudit tests #212

Closed alfredomagallon closed 4 weeks ago

alfredomagallon commented 5 months ago

Describe the bug

I tried to launch event-generator using helm in order to test the k8saudit events:

  helm install event-generator-k8saudits falcosecurity/event-generator \
    --namespace event-generator \
    --create-namespace \
    --set config.grpc.enabled=true \
    --set config.command="test" \
    --set config.loop=false \
    --set config.actions="^k8saudit"

however, that results in the following error:

Error: none of the selected actions is enabled
FATA error executing event-generator               error="none of the selected actions is enabled"

How to reproduce it

Setup a kind cluster Enable k8s audit logs Setup falco Setup event-generator using the command above

Expected behaviour

Valid k8saudit events should be tested

Environment

poiana commented 2 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana commented 1 month ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

poiana commented 4 weeks ago

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

poiana commented 4 weeks ago

@poiana: Closing this issue.

In response to [this](https://github.com/falcosecurity/event-generator/issues/212#issuecomment-2439751564): >Rotten issues close after 30d of inactivity. > >Reopen the issue with `/reopen`. > >Mark the issue as fresh with `/remove-lifecycle rotten`. > >Provide feedback via https://github.com/falcosecurity/community. >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.