falcosecurity / plugins

Falco plugins registry
Apache License 2.0
82 stars 75 forks source link

fix(k8smeta): introduce /proc scan to recover the pod uid of threads already spawned #517

Closed Andreagit97 closed 1 month ago

Andreagit97 commented 1 month ago

What type of PR is this?

/kind bug

/kind feature

Any specific area of the project related to this PR?

/area plugins

What this PR does / why we need it:

This PR introduces a proc-scan feature in the k8smeta plugin init phase. We need this to collect the pod uid of threads already running when Falco and the k8smeta plugin are started.

Which issue(s) this PR fixes:

Fixes #https://github.com/falcosecurity/plugins/issues/514

Special notes for your reviewer:

github-actions[bot] commented 1 month ago

Rules files suggestions

github-actions[bot] commented 1 month ago

Rules files suggestions

poiana commented 1 month ago

LGTM label has been added.

Git tree hash: 7e40b508b8f3b049105fb9198e0119f088dba6c3

alacuku commented 1 month ago

Thanks for the fix @Andreagit97!

github-actions[bot] commented 1 month ago

Rules files suggestions

github-actions[bot] commented 1 month ago

Rules files suggestions

alacuku commented 1 month ago

hey @Andreagit97, is this PR ready?

Andreagit97 commented 1 month ago

yes! i removed the [WIP]

poiana commented 1 month ago

LGTM label has been added.

Git tree hash: dcd3c1e88753eab241d35ca59573f4d1a7de208a

poiana commented 1 month ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alacuku, Andreagit97, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/falcosecurity/plugins/blob/main/OWNERS)~~ [leogr] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment