new(plugins/k8smeta): update k8smeta plugin to require plugin API version 3.9.0. #625

FedeDP · 2025-02-13T09:54:14Z

What type of PR is this?

/kind cleanup
/kind feature

Any specific area of the project related to this PR?

/area plugins

What this PR does / why we need it:

Implemented the "suggested output fields feature", by suggesting k8smeta.pod.name and k8smeta.ns.name as output fields.

Also, entirely avoid the proc scan, instead relying on the listening CAPability to initially loop over the thread table to attach pod_uid to threads.
Following the above, hostProc initConfig key is now deprecated and unused.

Moved the plugin to 0.3.0 too (given the minimum plugin API version changes).

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

poiana · 2025-02-13T09:54:27Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: FedeDP
Once this PR has been reviewed and has the lgtm label, please assign jasondellaluce for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

FedeDP · 2025-02-13T09:55:06Z

plugins/k8smeta/cmake/modules/plugin-sdk-cpp.cmake

@@ -6,7 +6,7 @@ message(
 FetchContent_Declare(
  plugin-sdk-cpp
  GIT_REPOSITORY https://github.com/falcosecurity/plugin-sdk-cpp.git
-  GIT_TAG 2097bdb5a5d77f3f38162da1f438382912465340)
+  GIT_TAG 0.2.0)


Use tagged sdk-cpp version.

FedeDP · 2025-02-13T09:55:18Z

plugins/k8smeta/src/plugin.cpp

@@ -138,8 +138,8 @@ falcosecurity::init_schema my_plugin::get_init_schema()
 		},
 		"hostProc": {
 			"type": "string",
-			"title": "Path to reach the '/proc' folder we want to scan.",
-			"description": "The plugin needs to scan the '/proc' of the host on which is running. In Falco usually we put the host '/proc' folder under '/host/proc' so the the default for this config is '/host'. The path used here must not have a final '/'."
+			"title": "[DEPRECATED] Path to reach the '/proc' folder we want to scan.",


Deprecated initConfig key, unused now.

Do you confirm that this setting won't produce any effect anymore?

If so, we should add a notice in addition to the deprecation. Make sense?

FedeDP · 2025-02-13T09:55:52Z

plugins/k8smeta/src/plugin.cpp

@@ -428,11 +295,20 @@ bool my_plugin::init(falcosecurity::init_input& in)
    try
    {
        m_thread_table = t.get_table(THREAD_TABLE_NAME, st::SS_PLUGIN_ST_INT64);
+
+        // get the 'cgroups' field accessor from the thread table
+        m_thread_field_cgroups = m_thread_table.get_field(


We need these to be able to correctly fetch cgroups string from the thread entry in the capture_open() listen CAP callback.

FedeDP · 2025-02-13T09:58:16Z

plugins/k8smeta/src/plugin.cpp

+    SPDLOG_DEBUG("enriching initial thread table entries");
+    auto& tr = in.get_table_reader();
+    auto& tw = in.get_table_writer();
+    m_thread_table.iterate_entries(


We iterate over all thread table entries, and for each, we iterate over its cgroups vector, taking the ->second (cgroups are a vector of std::pair and second hosts the cgroup path, while first hosts the cgroup controller); for each cgroup path we try to extract the pod_uid and, if successful, we break the loop for the current thread entry.

FedeDP · 2025-02-13T09:58:29Z

plugins/k8smeta/src/plugin.cpp

@@ -520,7 +438,7 @@ std::vector<falcosecurity::field_info> my_plugin::get_fields()
    // Use an array to perform a static_assert one the size.
    const falcosecurity::field_info fields[] = {
            {ft::FTYPE_STRING, "k8smeta.pod.name", "Pod Name",
-             "Kubernetes pod name."},
+             "Kubernetes pod name.", {}, false, {}, true}, // use as suggested output format


Mark this field as suggested output format.

FedeDP · 2025-02-13T09:58:32Z

plugins/k8smeta/src/plugin.cpp

@@ -535,7 +453,7 @@ std::vector<falcosecurity::field_info> my_plugin::get_fields()
            {ft::FTYPE_STRING, "k8smeta.pod.ip", "Pod Ip", "Kubernetes pod ip"},

            {ft::FTYPE_STRING, "k8smeta.ns.name", "Namespace Name",
-             "Kubernetes namespace name."},
+             "Kubernetes namespace name.", {}, false, {}, true}, // use as suggested output format


Mark this field as suggested output format.

…sion 3.9.0. Implement the suggested output fields feature, by suggesting `k8smeta.pod.name` and `k8smeta.ns.name` as output fields. Also, entirely avoid the proc scan, instead relying on the listening CAPability to initially loop over the thread table to attach pod_uid to threads. `hostProc` initConfig key is now deprecated and unused. Moved the plugin to 0.3.0 too. Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP · 2025-02-13T09:59:55Z

plugins/k8smeta/src/plugin.h

@@ -282,3 +286,4 @@ FALCOSECURITY_PLUGIN(my_plugin);
 FALCOSECURITY_PLUGIN_FIELD_EXTRACTION(my_plugin);
 FALCOSECURITY_PLUGIN_ASYNC_EVENTS(my_plugin);
 FALCOSECURITY_PLUGIN_EVENT_PARSING(my_plugin);
+FALCOSECURITY_PLUGIN_CAPTURE_LISTENING(my_plugin);


New capability.

FedeDP · 2025-02-13T10:00:09Z

plugins/k8smeta/src/plugin.h

@@ -245,7 +250,7 @@ class my_plugin
    private:
    // Async thread
    std::thread m_async_thread;
-    std::atomic<bool> m_async_thread_quit;
+    std::atomic<bool> m_async_thread_quit = false;


Compiler warning.

Signed-off-by: Federico Di Pierro <[email protected]>

github-actions · 2025-02-13T10:17:43Z

Rules files suggestions

Signed-off-by: Federico Di Pierro <[email protected]>

github-actions · 2025-02-13T10:35:08Z

Rules files suggestions

Signed-off-by: Federico Di Pierro <[email protected]>

github-actions · 2025-02-13T11:20:08Z

Rules files suggestions

github-actions · 2025-02-13T13:27:16Z

Rules files suggestions

FedeDP · 2025-02-13T13:53:39Z

/hold

github-actions · 2025-02-13T13:57:01Z

Rules files suggestions

leogr

Nice!

Just left two suggestions. I will do a second pass later.

Thank you

plugins/k8smeta/README.md

leogr · 2025-02-13T14:01:06Z

plugins/k8smeta/src/plugin.cpp

@@ -138,8 +138,8 @@ falcosecurity::init_schema my_plugin::get_init_schema()
 		},
 		"hostProc": {
 			"type": "string",
-			"title": "Path to reach the '/proc' folder we want to scan.",
-			"description": "The plugin needs to scan the '/proc' of the host on which is running. In Falco usually we put the host '/proc' folder under '/host/proc' so the the default for this config is '/host'. The path used here must not have a final '/'."
+			"title": "[DEPRECATED] Path to reach the '/proc' folder we want to scan.",


Do you confirm that this setting won't produce any effect anymore?

If so, we should add a notice in addition to the deprecation. Make sense?

Moreover, dropped proc-scan related tests. Signed-off-by: Federico Di Pierro <[email protected]>

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP · 2025-02-13T14:50:37Z

@leogr pushed changes to address your review! Thanks!

github-actions · 2025-02-13T15:08:34Z

Rules files suggestions

FedeDP · 2025-02-28T08:24:28Z

Also, we might want to use the provided logger by the sdk, like i did here for the container plugin: FedeDP/container_plugin#26

This would allow use to drop the spdlog dep, to have better unified logging, and to drop the verbosity init config key, since we would then use the verbosity used for libs logger (https://github.com/falcosecurity/libs/blob/3d1d4a930d3a16f3e72ab62876ba0837c02d2ec5/userspace/libsinsp/plugin.cpp#L79).

I will make the change in its own commit.

poiana added kind/cleanup dco-signoff: yes kind/feature New feature or request area/plugins labels Feb 13, 2025

poiana requested review from jasondellaluce and LucaGuerra February 13, 2025 09:54

poiana added the size/XL label Feb 13, 2025

FedeDP commented Feb 13, 2025

View reviewed changes

FedeDP force-pushed the new/k8smeta_update branch from e7b1571 to f8c60d8 Compare February 13, 2025 09:59

FedeDP commented Feb 13, 2025

View reviewed changes

chore(plugins/k8smeta): apply formatting.

11b3034

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP added 2 commits February 13, 2025 11:22

chore(plugins/k8smeta): update README.

24ee42a

Signed-off-by: Federico Di Pierro <[email protected]>

update(ci): bump falco image to 0.40.0 and falcoctl to 0.11.0.

571f8e1

Signed-off-by: Federico Di Pierro <[email protected]>

chore(plugins/k8smeta): bump libs to 0.20.0.

6083828

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP force-pushed the new/k8smeta_update branch from e90d163 to d8815ba Compare February 13, 2025 13:45

poiana added the do-not-merge/hold label Feb 13, 2025

leogr reviewed Feb 13, 2025

View reviewed changes

FedeDP added 2 commits February 13, 2025 15:50

fix(plugins/k8smeta): fixed a couple of tests.

6a470c0

Moreover, dropped proc-scan related tests. Signed-off-by: Federico Di Pierro <[email protected]>

chore(src): add a deprecation warning for hostProc.

fcba3e4

Signed-off-by: Federico Di Pierro <[email protected]>

FedeDP force-pushed the new/k8smeta_update branch from d8815ba to fcba3e4 Compare February 13, 2025 14:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

new(plugins/k8smeta): update k8smeta plugin to require plugin API version 3.9.0. #625

new(plugins/k8smeta): update k8smeta plugin to require plugin API version 3.9.0. #625

FedeDP commented Feb 13, 2025

poiana commented Feb 13, 2025

FedeDP Feb 13, 2025

FedeDP Feb 13, 2025

leogr Feb 13, 2025

FedeDP Feb 28, 2025

FedeDP Feb 13, 2025

FedeDP Feb 13, 2025

FedeDP Feb 13, 2025

FedeDP Feb 13, 2025

FedeDP Feb 13, 2025

FedeDP Feb 13, 2025

github-actions bot commented Feb 13, 2025

github-actions bot commented Feb 13, 2025

github-actions bot commented Feb 13, 2025

github-actions bot commented Feb 13, 2025

FedeDP commented Feb 13, 2025

github-actions bot commented Feb 13, 2025

leogr left a comment

leogr Feb 13, 2025

FedeDP commented Feb 13, 2025

github-actions bot commented Feb 13, 2025

FedeDP commented Feb 28, 2025 •

edited

Loading

new(plugins/k8smeta): update k8smeta plugin to require plugin API version 3.9.0. #625

Are you sure you want to change the base?

new(plugins/k8smeta): update k8smeta plugin to require plugin API version 3.9.0. #625

Conversation

FedeDP commented Feb 13, 2025

poiana commented Feb 13, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Feb 13, 2025

Rules files suggestions

github-actions bot commented Feb 13, 2025

Rules files suggestions

github-actions bot commented Feb 13, 2025

Rules files suggestions

github-actions bot commented Feb 13, 2025

Rules files suggestions

FedeDP commented Feb 13, 2025

github-actions bot commented Feb 13, 2025

Rules files suggestions

leogr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedeDP commented Feb 13, 2025

github-actions bot commented Feb 13, 2025

Rules files suggestions

FedeDP commented Feb 28, 2025 • edited Loading

FedeDP commented Feb 28, 2025 •

edited

Loading