Donate alacuku/k8s-metacollector to falcosecurity

[alacuku]

Repository: https://github.com/alacuku/k8s-metacollector

Motivation
Falco has a built-in functionality called Kubernetes Metadata Enrichment. It provides k8s metadata, fetched from the k8s api-server, used by Falco to enrich the system-call events. Furthermore, these metadata are available to users as events fields to be used in the conditions and 'outputs' of Falco rules.

The current k8s client has a number of issues described in this issue falcosecurity/falco#2973.

The new component addresses those issues and scales in large environments with thousands of nodes. It is a standalone component deployed alongside Falco in a Kubernetes cluster. It connects to the Kubernetes API server and dispatches the metadata to the Falco instances. For more info on the implementation details please refer to:

• K8S client issues falco#2973
• https://github.com/alacuku/k8s-metacollector

Please note that, the repository is still a work in progress since we are working on a new Falco plugin that will be paired with the metacollector and provide Falco with the k8s metadata.

[Andreagit97]

Thank you for the amazing job! 🚀 +1 from me 👍

count me in if you need help maintaining the project!

[leogr]

Big +1 from me! 🥳

[LucaGuerra]

+1 🎉 🚀

[FedeDP]

Big +1 from me!! 🚀

[leogr]

PS count me as maintainer if you need help

[zuc]

+1 from me as well!

[jasondellaluce]

+1 for this!

[Issif]

Do you think we could extend this to more than just Kubernetes? I mean, collecting metadata for EC2, etc?

Huge +1 anyway 😉

[leogr]

I guess we can proceed :)

@alacuku I will help with the process.
/assign

Anyone other than @Andreagit97 and me is willing to maintain this project? 🤔 If so, please ping us. Thank you.

[Issif]

Count on me if others agree, I know go and k8s api.

[alacuku]

Do you think we could extend this to more than just Kubernetes? I mean, collecting metadata for EC2, etc?

It could be extended for other use-cases, but currently, we are focused on replacing the old k8s metadata fetcher in Falco.

[leogr]

I guess this is done 🥳 https://github.com/alacuku/k8s-metacollector