cleanup(rules): remove dangling references to lists, lint

[LucaGuerra]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind cleanup

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area plugins

What this PR does / why we need it:

Some rules in the k8s_audit set were referencing lists present in falco_rules and falco_sandbox_rules sets. I believe it is risky to keep them like this because we introduce a dependency on something that is optional. While it's true that if you have both rulesfiles loaded you probably want those lists to be the same, we cannot assume that you will always have falco_rules loaded if you are using k8s audit and we need to leave this choice to the user.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

[github-actions[bot]]

Rules files suggestions

gcp_auditlog_rules.yaml

Comparing 9f055538322473c410bb633de5cb7e4454a9856e with latest tag gcpaudit-0.3.0

No changes detected

k8s_audit_rules.yaml

Comparing 9f055538322473c410bb633de5cb7e4454a9856e with latest tag k8saudit-eks-0.4.0

Minor changes:

• List k8s_sensitive_mount_images has been added
• List k8s_privileged_images has been added

[github-actions[bot]]

Rules files suggestions

gcp_auditlog_rules.yaml

Comparing 8785ede33eeb5b765fb377a6dea1daf716612049 with latest tag gcpaudit-0.3.0

No changes detected

k8s_audit_rules.yaml

Comparing 8785ede33eeb5b765fb377a6dea1daf716612049 with latest tag k8saudit-eks-0.4.0

Minor changes:

• List k8s_sensitive_mount_images has been added
• List k8s_privileged_images has been added

Patch changes:

• List falco_hostnetwork_images has some item added or removed
• List allowed_kube_namespace_image_list has some item added or removed

Rules files suggestions

gcp_auditlog_rules.yaml

Comparing 8785ede33eeb5b765fb377a6dea1daf716612049 with latest tag gcpaudit-0.3.0

No changes detected

k8s_audit_rules.yaml

Comparing 8785ede33eeb5b765fb377a6dea1daf716612049 with latest tag k8saudit-eks-0.4.0

Minor changes:

• List k8s_sensitive_mount_images has been added
• List k8s_privileged_images has been added

Patch changes:

• List falco_hostnetwork_images has some item added or removed
• List allowed_kube_namespace_image_list has some item added or removed

[LucaGuerra]

@leogr sure, updated!

[github-actions[bot]]

Rules files suggestions

gcp_auditlog_rules.yaml

Comparing 82301365ec730d614376c11a7207819b5195c89f with latest tag gcpaudit-0.3.0

No changes detected

k8s_audit_rules.yaml

Comparing 82301365ec730d614376c11a7207819b5195c89f with latest tag k8saudit-eks-0.4.0

Major changes:

• List falco_hostnetwork_images has been removed
• List falco_hostpid_images has been removed
• List falco_hostipc_images has been removed

Minor changes:

• List k8s_audit_privileged_images has been added
• List k8s_audit_sensitive_mount_images has been added
• List k8s_audit_hostpid_images has been added
• List k8s_audit_hostnetwork_images has been added
• List k8s_audit_hostipc_images has been added

Patch changes:

• List allowed_kube_namespace_image_list has some item added or removed

Rules files suggestions

gcp_auditlog_rules.yaml

Comparing 82301365ec730d614376c11a7207819b5195c89f with latest tag gcpaudit-0.3.0

No changes detected

k8s_audit_rules.yaml

Comparing 82301365ec730d614376c11a7207819b5195c89f with latest tag k8saudit-eks-0.4.0

Major changes:

• List falco_hostnetwork_images has been removed
• List falco_hostpid_images has been removed
• List falco_hostipc_images has been removed

Minor changes:

• List k8s_audit_privileged_images has been added
• List k8s_audit_sensitive_mount_images has been added
• List k8s_audit_hostpid_images has been added
• List k8s_audit_hostnetwork_images has been added
• List k8s_audit_hostipc_images has been added

Patch changes:

• List allowed_kube_namespace_image_list has some item added or removed

[github-actions[bot]]

Rules files suggestions

[github-actions[bot]]

Rules files suggestions

[poiana]

LGTM label has been added.

Git tree hash: 5db0473f6bd9a4a99c6e153023168690dc99be62

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leogr, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/falcosecurity/plugins/blob/master/OWNERS)~~ [leogr] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment