Add possibility to add annotations to the metrics service

charts/falco/CHANGELOG.md

@@ -3,6 +3,10 @@
 This file documents all notable changes to Falco Helm Chart. The release
 numbering uses [semantic versioning](http://semver.org).
 
+## v4.8.3
+
+* feat(falco): add labels and annotations to the metrics service
+
 ## v4.8.2
 
 * fix(falco): correctly mount host filesystems when driver.kind is auto

charts/falco/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: falco
-version: 4.8.2
+version: 4.8.3
 appVersion: "0.38.2"
 description: Falco
 keywords:

charts/falco/README.md

@@ -581,7 +581,7 @@ If you use a Proxy in your cluster, the requests between `Falco` and `Falcosidek
 
 ## Configuration
 
-The following table lists the main configurable parameters of the falco chart v4.8.2 and their default values. See [values.yaml](./values.yaml) for full list.
+The following table lists the main configurable parameters of the falco chart v4.8.3 and their default values. See [values.yaml](./values.yaml) for full list.
 
 ## Values
 
@@ -740,7 +740,7 @@ The following table lists the main configurable parameters of the falco chart v4
 | image.repository | string | `"falcosecurity/falco-no-driver"` | The image repository to pull from |
 | image.tag | string | `""` | The image tag to pull. Overrides the image tag whose default is the chart appVersion. |
 | imagePullSecrets | list | `[]` | Secrets containing credentials when pulling from private/secure registries. |
-| metrics | object | `{"convertMemoryToMB":true,"enabled":false,"includeEmptyValues":false,"interval":"1h","kernelEventCountersEnabled":true,"libbpfStatsEnabled":true,"outputRule":false,"resourceUtilizationEnabled":true,"rulesCountersEnabled":true,"service":{"create":true,"ports":{"metrics":{"port":8765,"protocol":"TCP","targetPort":8765}},"type":"ClusterIP"},"stateCountersEnabled":true}` | metrics configures Falco to enable and expose the metrics. |
+| metrics | object | `{"convertMemoryToMB":true,"enabled":false,"includeEmptyValues":false,"interval":"1h","kernelEventCountersEnabled":true,"libbpfStatsEnabled":true,"outputRule":false,"resourceUtilizationEnabled":true,"rulesCountersEnabled":true,"service":{"annotations":{},"create":true,"labels":{},"ports":{"metrics":{"port":8765,"protocol":"TCP","targetPort":8765}},"type":"ClusterIP"},"stateCountersEnabled":true}` | metrics configures Falco to enable and expose the metrics. |
 | metrics.convertMemoryToMB | bool | `true` | convertMemoryToMB specifies whether the memory should be converted to mb. |
 | metrics.enabled | bool | `false` | enabled specifies whether the metrics should be enabled. |
 | metrics.includeEmptyValues | bool | `false` | includeEmptyValues specifies whether the empty values should be included in the metrics. |
@@ -749,8 +749,10 @@ The following table lists the main configurable parameters of the falco chart v4
 | metrics.outputRule | bool | `false` | outputRule enables seamless metrics and performance monitoring, we recommend emitting metrics as the rule "Falco internal: metrics snapshot". This option is particularly useful when Falco logs are preserved in a data lake. Please note that to use this option, the Falco rules config `priority` must be set to `info` at a minimum. |
 | metrics.resourceUtilizationEnabled | bool | `true` | resourceUtilizationEnabled`: Emit CPU and memory usage metrics. CPU usage is reported as a percentage of one CPU and can be normalized to the total number of CPUs to determine overall usage. Memory metrics are provided in raw units (`kb` for `RSS`, `PSS` and `VSZ` or `bytes` for `container_memory_used`) and can be uniformly converted to megabytes (MB) using the `convert_memory_to_mb` functionality. In environments such as Kubernetes when deployed as daemonset, it is crucial to track Falco's container memory usage. To customize the path of the memory metric file, you can create an environment variable named `FALCO_CGROUP_MEM_PATH` and set it to the desired file path. By default, Falco uses the file `/sys/fs/cgroup/memory/memory.usage_in_bytes` to monitor container memory usage, which aligns with Kubernetes' `container_memory_working_set_bytes` metric. Finally, we emit the overall host CPU and memory usages, along with the total number of processes and open file descriptors (fds) on the host, obtained from the proc file system unrelated to Falco's monitoring. These metrics help assess Falco's usage in relation to the server's workload intensity. |
 | metrics.rulesCountersEnabled | bool | `true` | rulesCountersEnabled specifies whether the counts for each rule should be emitted. |
-| metrics.service | object | `{"create":true,"ports":{"metrics":{"port":8765,"protocol":"TCP","targetPort":8765}},"type":"ClusterIP"}` | service exposes the metrics service to be accessed from within the cluster. ref: https://kubernetes.io/docs/concepts/services-networking/service/ |
+| metrics.service | object | `{"annotations":{},"create":true,"labels":{},"ports":{"metrics":{"port":8765,"protocol":"TCP","targetPort":8765}},"type":"ClusterIP"}` | service exposes the metrics service to be accessed from within the cluster. ref: https://kubernetes.io/docs/concepts/services-networking/service/ |
+| metrics.service.annotations | object | `{}` | annotations to add to the service. |
 | metrics.service.create | bool | `true` | create specifies whether a service should be created. |
+| metrics.service.labels | object | `{}` | labels to add to the service. |
 | metrics.service.ports | object | `{"metrics":{"port":8765,"protocol":"TCP","targetPort":8765}}` | ports denotes all the ports on which the Service will listen. |
 | metrics.service.ports.metrics | object | `{"port":8765,"protocol":"TCP","targetPort":8765}` | metrics denotes a listening service named "metrics". |
 | metrics.service.ports.metrics.port | int | `8765` | port is the port on which the Service will listen. |

charts/falco/templates/service.yaml

@@ -6,7 +6,14 @@ metadata:
   namespace: {{ include "falco.namespace" . }}
   labels:
     {{- include "falco.labels" . | nindent 4 }}
+    {{- with .Values.metrics.service.labels }}
+    {{ toYaml .Values.metrics.service.labels | nindent 4 }}
+    {{- end }}
     type: "falco-metrics"
+  {{- with .Values.metrics.service.annotations }}
+  annotations:
+    {{ toYaml .Values.metrics.service.annotations | nindent 4 }}
+  {{- end }}
 spec:
   type: {{ .Values.metrics.service.type }}
   ports:

charts/falco/tests/unit/serviceTemplate_test.go

@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2024 The Falco Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package unit
+
+import (
+	"encoding/json"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/gruntwork-io/terratest/modules/helm"
+	corev1 "k8s.io/api/core/v1"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+)
+
+type serviceTemplateTest struct {
+	suite.Suite
+	chartPath   string
+	releaseName string
+	namespace   string
+	templates   []string
+}
+
+func TestServiceTemplate(t *testing.T) {
+	t.Parallel()
+
+	chartFullPath, err := filepath.Abs(chartPath)
+	require.NoError(t, err)
+
+	suite.Run(t, &serviceTemplateTest{
+		Suite:       suite.Suite{},
+		chartPath:   chartFullPath,
+		releaseName: "falco-test",
+		namespace:   "falco-namespace-test",
+		templates:   []string{"templates/service.yaml"},
+	})
+}
+
+func (s *serviceTemplateTest) TestCreationDefaultValues() {
+	// Render the service and check that it has not been rendered.
+	_, err := helm.RenderTemplateE(s.T(), &helm.Options{}, s.chartPath, s.releaseName, s.templates)
+	s.Error(err, "should error")
+	s.Equal("error while running command: exit status 1; Error: could not find template templates/service.yaml in chart", err.Error())
+}
+
+func (s *serviceTemplateTest) TestDefaultLabelsValues() {
+	// Render the service and check that it has not been rendered.
+	output, err := helm.RenderTemplateE(s.T(), &helm.Options{}, s.chartPath, s.releaseName, s.templates)
+	s.Error(err, "should error")
+	s.Equal("error while running command: exit status 1; Error: could not find template templates/service.yaml in chart", err.Error())
+
+
+	cInfo, err := chartInfo(s.T(), s.chartPath) 
+ 	s.NoError(err) 
+ 	// Get app version. 
+ 	appVersion, found := cInfo["appVersion"] 
+ 	s.True(found, "should find app version in chart info") 
+ 	appVersion = appVersion.(string) 
+ 	// Get chart version. 
+ 	chartVersion, found := cInfo["version"] 
+ 	s.True(found, "should find chart version in chart info") 
+ 	// Get chart name. 
+ 	chartName, found := cInfo["name"] 
+ 	s.True(found, "should find chart name in chart info") 
+ 	chartName = chartName.(string) 
+ 	expectedLabels := map[string]string{ 
+ 		"helm.sh/chart":                fmt.Sprintf("%s-%s", chartName, chartVersion), 
+ 		"app.kubernetes.io/name":       chartName.(string), 
+ 		"app.kubernetes.io/instance":   s.releaseName, 
+ 		"app.kubernetes.io/version":    appVersion.(string), 
+ 		"app.kubernetes.io/managed-by": "Helm", 
+ 	} 
+	var svc corev1.Service
+	helm.UnmarshalK8SYaml(s.T(), output, &svc)
+	labels := svc.GetLabels() 
+	for key, value := range labels { 
+		expectedVal := expectedLabels[key] 
+		s.Equal(expectedVal, value) 
+	} 
+}
+
+
+func (s *serviceTemplateTest) TestCustomLabelsValues() {
+	// Render the service and check that it has not been rendered.
+	options := &helm.Options{SetValues: map[string]string{"metrics.service.labels" : {"custom-label": "falco-label"}}}
+	output, err := helm.RenderTemplateE(s.T(), &helm.Options{}, s.chartPath, s.releaseName, s.templates)
+	s.Error(err, "should error")
+	s.Equal("error while running command: exit status 1; Error: could not find template templates/service.yaml in chart", err.Error())
+
+
+	cInfo, err := chartInfo(s.T(), s.chartPath) 
+ 	s.NoError(err) 
+ 	// Get app version. 
+ 	appVersion, found := cInfo["appVersion"] 
+ 	s.True(found, "should find app version in chart info") 
+ 	appVersion = appVersion.(string) 
+ 	// Get chart version. 
+ 	chartVersion, found := cInfo["version"] 
+ 	s.True(found, "should find chart version in chart info") 
+ 	// Get chart name. 
+ 	chartName, found := cInfo["name"] 
+ 	s.True(found, "should find chart name in chart info") 
+ 	chartName = chartName.(string) 
+ 	expectedLabels := map[string]string{ 
+ 		"helm.sh/chart":                fmt.Sprintf("%s-%s", chartName, chartVersion), 
+ 		"app.kubernetes.io/name":       chartName.(string), 
+ 		"app.kubernetes.io/instance":   s.releaseName, 
+ 		"app.kubernetes.io/version":    appVersion.(string), 
+ 		"app.kubernetes.io/managed-by": "Helm", 
+ 	} 
+	var svc corev1.Service
+	helm.UnmarshalK8SYaml(s.T(), output, &svc)
+	labels := svc.GetLabels() 
+	for key, value := range labels { 
+		expectedVal := expectedLabels[key] 
+		s.Equal(expectedVal, value) 
+	} 
+	s.Equal("falco-label", labels["custom-label"])
+}

charts/falco/values.yaml

@@ -248,6 +248,10 @@ metrics:
     # -- type denotes the service type. Setting it to "ClusterIP" we ensure that are accessible
     # from within the cluster.
     type: ClusterIP
+    # -- labels to add to the service.
+    labels: {}
+    # -- annotations to add to the service.
+    annotations: {}
     # -- ports denotes all the ports on which the Service will listen.
     ports:
       # -- metrics denotes a listening service named "metrics".