k8sstormcenter / honeycluster

Threat-informed defense for cloudnative: Reference Implementation of a so-called Honeycluster - for kind (and GKE, RKE2, AKS)
Apache License 2.0
22 stars 3 forks source link

Prepare a wasm transform template #10

Closed entlein closed 5 months ago

entlein commented 7 months ago

This is indirectly related to the issue #7 . If it were possible to read values into WASM at runtime, the jQuery/go filters could be also supplied via configmaps . Which in turn would make it possible to work with just one wasm-transform template for all the filter topics

Im talking concretely about replacing query, err := gojq.Parse("select( .process_kprobe != null and .process_kprobe.policy_name == \"enumerate-util\" )| .") with something like

// Read the gojq query from a file queryBytes, err := ioutil.ReadFile("path/to/your/query.jq") queryStr := string(queryBytes) query, err := gojq.Parse(queryStr)