falcosecurity / plugins

Falco plugins registry

Apache License 2.0

86 stars 80 forks source link

fix(k8smeta): introduce /proc scan to recover the pod uid of threads already spawned #517

Closed Andreagit97 closed 4 months ago

Andreagit97 commented 4 months ago

What type of PR is this?

/kind bug

/kind feature

Any specific area of the project related to this PR?

/area plugins

What this PR does / why we need it:

This PR introduces a proc-scan feature in the k8smeta plugin init phase. We need this to collect the pod uid of threads already running when Falco and the k8smeta plugin are started.

Which issue(s) this PR fixes:

Fixes #https://github.com/falcosecurity/plugins/issues/514

Special notes for your reviewer:

github-actions[bot] commented 4 months ago

Rules files suggestions

github-actions[bot] commented 4 months ago

Rules files suggestions

poiana commented 4 months ago

LGTM label has been added.

Git tree hash: 7e40b508b8f3b049105fb9198e0119f088dba6c3

alacuku commented 4 months ago

Thanks for the fix @Andreagit97!

github-actions[bot] commented 4 months ago

Rules files suggestions

github-actions[bot] commented 4 months ago

Rules files suggestions

alacuku commented 4 months ago

hey @Andreagit97, is this PR ready?

Andreagit97 commented 4 months ago

yes! i removed the [WIP]

poiana commented 4 months ago

LGTM label has been added.

Git tree hash: dcd3c1e88753eab241d35ca59573f4d1a7de208a

poiana commented 4 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alacuku, Andreagit97, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/falcosecurity/plugins/blob/main/OWNERS)~~ [leogr] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment