plugin system, events tester, and minor features

[leogr]

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area commands

/area pkg

/area events

What this PR does / why we need it:

• Add the event-generator test command to run integration tests against a Falco instance as suggested in Falco Rule Integration Test #30
• Introduces minor features and fixes, in particular, to skip actions when needed and match the rule name
• Rename some actions to exactly match the rule name as per this convention 👉 done by refactor: action naming #33

TODOs:

• This PR uses the new gRPC implementation so we have to wait for bidirectional gRPC outputs - client update client-go#45 and the next Falco release
• Use client-go v0.2.0 once released Release v0.2.0 once Falco 0.24.0 is out client-go#47
• Update the documentation (how to properly run tests)
• Update the action list in the README
• k8saudit are not yet tested (some refactoring might be needed)
• Add release notes 👉 update(.github): remove release-note block #34

Which issue(s) this PR fixes:

Fixes #30

Special notes for your reviewer:

It's a WIP but can be tested by:

• using Falco built from bidirectional gRPC outputs + fix server streaming gRPC outputs falco#1241
  with gRPC enable over Unix socket (TCP should work too but not yet tested)
• using patched rules that you can find here correct rule conditions to support syscall variants  falco#1250 (since during the development I noticed some rules did not work as expected)

Then

make
sudo ./event-generator test syscall

DEMO

/cc @leodido
/cc @fntlnz
/cc @nibalizer

[poiana]

@leogr: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[poiana]

@leogr: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[leodido]

Even though it's still a WIP, it looks pretty good to me! 👏

Just one consideration (for a future iteration on this great work).

Rules (and the fields they use) depend on the Falco Engine version (link).

Thus, the test command should somehow (in the future) filter by Falco engine version.

In order to be able to achieve this level of completeness we need two missing pieces:

• a mapping Falco Engine version => fields => rules
• expose the Falco Engine version through the Falco gRPC Version API (issue Expose the Falco Engine version through the gRPC Version API falco#1269)

[leogr]

Hey @leodido

Thank you for your preliminary review!

I totally agree with you; we need to check the engine version. Furthermore, since the user can customize rules, my current idea is to create a sort of "presets". That would help in testing a set of rules that are intended for a specific engine version. Ofc, it will be implemented in a future iteration, since this PR is already too big :)

Also a quick update
I'm also thinking of moving those "action renamed" commits to another PR, just because they could already be merged into the current master.

[poiana]

LGTM label has been added.

Git tree hash: 94f151080ae23005f22f41f412de1c56221d42d4

[leogr]

Ready for review!
/cc @fntlnz
/cc @leodido

[poiana]

LGTM label has been added.

Git tree hash: c48042d31155258d8246c934fe2db3a5f045067a

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fntlnz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [fntlnz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment