Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

new: k8s node filtering #1671

Merged
merged 2 commits into from
Sep 16, 2021
Merged

new: k8s node filtering #1671

merged 2 commits into from
Sep 16, 2021

Conversation

leogr
Copy link
Member

@leogr leogr commented Jun 9, 2021

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area engine

What this PR does / why we need it:

See falcosecurity/libs#43

Which issue(s) this PR fixes:

Fixes #778

Special notes for your reviewer:

To enable this feature, the current node name (i.e. the one on which Falco is running) needs to be passed to Falco
via the --k8s-node command-line option.

When Falco is deployed as a DaemonSet, the easiest way to automatically pass that value is by using the downward API. For example:

...
    containers:
        - name: falco
        ...
          args:
            - /usr/bin/falco
            - --cri
            - /run/containerd/containerd.sock
            - -K
            - /var/run/secrets/kubernetes.io/serviceaccount/token
            - -k
            - "https://$(KUBERNETES_SERVICE_HOST)"
            - -pk
            - --k8s-node
            - "$(MY_NODE_NAME})"
        env:
        - name: MY_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
...

Update: the above example was fixed accordingly to what suggested in #1786

Does this PR introduce a user-facing change?:

new: add `--k8s-node` command-line options, which allows filtering by a node when requesting metadata of pods to the K8s API server

@poiana
Copy link

poiana commented Jun 17, 2021

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
@leogr
Copy link
Member Author

leogr commented Jul 29, 2021

/hold
to let other PRs get merged in

@leogr
Copy link
Member Author

leogr commented Aug 23, 2021

/hold cancel

@leogr
Copy link
Member Author

leogr commented Sep 6, 2021

Anyone up for a review?
/cc @leodido @fntlnz @kris-nova

@leogr leogr requested a review from krisnova September 6, 2021 15:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Runtime error: Socket handler (k8s_pod_handler_state): read more than 30MB of data
4 participants