OCI artifacts and the rules files have different names

[Issif]

Motivation

The name of the OCI artifact to package the rules file and the name of the .yaml containing the rules are not the same (- vs _).

See:

OCI	File
falco-rules	falco_rules
falco-incubating-rules	falco-incubating_rules
falco-sandbox-rules	falco-sandbox_rules

Aside, to install and load the rules, the end users need to know their exact names, it leads to a this kind of values.yaml for the official Helm chart:

falcoctl:
  config:
    artifact:
  		install:
    			refs: ["falco-rules:2","falco-incubating-rules:2","falco-sandbox-rules:2"]

falco:
  rules_file:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco-incubating_rules.yaml
    - /etc/falco/falco-sandbox_rules.yaml
    - /etc/falco/rules.d

Without a knowledge about that behavior, we tend to use the same name between the refs for falcoctl and and the list of rules to load.

Feature

The names of the files and OCI artifacts should be the same. Especially, because it would allow to prepare the Helm template to automatically add to the rules_file the downloaded rules. It's a better UX.

Alternatives

Additional context

[incertum]

@leogr @LucaGuerra

[leogr]

I was already aware of this, but I guess this is something we have to solve in bulk with other inconsistencies. Moreover, since just renaming a file is kinda of breaking change, we also may have to bulks such change together and push them to Falco 1.0 eventually.

Anyway, I take care of this
/assign

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Issif]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[leogr]

/remove-lifecycle stale

[leogr]

My current proposal is to start using only - in ruleset names (both OCI repository and files) starting from Falco 1.0

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[leogr]

/remove-lifecycle stale