search

falcosecurity / falco

Cloud Native Runtime Security
https://falco.org
Apache License 2.0
7.2k stars 889 forks source link

new http_output options (compression, batching, keep_alive) #2955

Open artemNN opened 8 months ago

artemNN commented 8 months ago

http_output must have compression, batching and keep_alive options. This is relevant in HighLoad installations and without a falcosidekick in each k8s cluster.

incertum commented 8 months ago

Agreed, http_output could be modernized!

@FedeDP @Issif

sgaist commented 8 months ago

@artemNN Could you give more details about what you mean by batching ?

Are you thinking about buffering a certain number of messages and send them grouped to the web server ?

incertum commented 8 months ago

We are splitting PRs. Batching will be implemented in a follow up PR.

artemNN commented 8 months ago

@artemNN Could you give more details about what you mean by batching ?

Are you thinking about buffering a certain number of messages and send them grouped to the web server ?

Whith Batching option multiple events should be sent in a JSON array at its root. Buffer settings may include options like batch.size(events) or batch.delay(milliseconds)

poiana commented 5 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

FedeDP commented 5 months ago

/remove-lifecycle stale

poiana commented 2 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

FedeDP commented 2 months ago

/remove-lifecycle stale

Issif commented 2 months ago

I would like to be able the manage the headers (for auth or else) and be able to use mTLS for the authentication between Falco and Falcosidekick/Talon.

sgaist commented 2 months ago

I would like to be able the manage the headers (for auth or else) and be able to use mTLS for the authentication between Falco and Falcosidekick/Talon.

AFAIK, mtls is already available for the http output. See https://github.com/falcosecurity/falco/blob/master/falco.yaml#L635