Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OCI artifacts and the rules files have different names #211

Open
Tracked by #3148
Issif opened this issue Dec 20, 2023 · 9 comments
Open
Tracked by #3148

OCI artifacts and the rules files have different names #211

Issif opened this issue Dec 20, 2023 · 9 comments
Assignees
Labels
kind/feature New feature or request

Comments

@Issif
Copy link
Member

Issif commented Dec 20, 2023

Motivation

The name of the OCI artifact to package the rules file and the name of the .yaml containing the rules are not the same (- vs _).

See:

OCI File
falco-rules falco_rules
falco-incubating-rules falco-incubating_rules
falco-sandbox-rules falco-sandbox_rules

Aside, to install and load the rules, the end users need to know their exact names, it leads to a this kind of values.yaml for the official Helm chart:

falcoctl:
  config:
    artifact:
  		install:
    			refs: ["falco-rules:2","falco-incubating-rules:2","falco-sandbox-rules:2"]

falco:
  rules_file:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco-incubating_rules.yaml
    - /etc/falco/falco-sandbox_rules.yaml
    - /etc/falco/rules.d

Without a knowledge about that behavior, we tend to use the same name between the refs for falcoctl and and the list of rules to load.

Feature

The names of the files and OCI artifacts should be the same. Especially, because it would allow to prepare the Helm template to automatically add to the rules_file the downloaded rules. It's a better UX.

Alternatives

Additional context

@Issif Issif added the kind/feature New feature or request label Dec 20, 2023
@incertum
Copy link
Contributor

incertum commented Jan 8, 2024

@leogr @LucaGuerra

@leogr
Copy link
Member

leogr commented Jan 11, 2024

I was already aware of this, but I guess this is something we have to solve in bulk with other inconsistencies. Moreover, since just renaming a file is kinda of breaking change, we also may have to bulks such change together and push them to Falco 1.0 eventually.

Anyway, I take care of this
/assign

@poiana
Copy link

poiana commented Apr 10, 2024

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

@Issif
Copy link
Member Author

Issif commented Apr 10, 2024

/remove-lifecycle stale

@poiana
Copy link

poiana commented Jul 9, 2024

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

@leogr
Copy link
Member

leogr commented Jul 18, 2024

/remove-lifecycle stale

@leogr
Copy link
Member

leogr commented Jul 18, 2024

My current proposal is to start using only - in ruleset names (both OCI repository and files) starting from Falco 1.0

@poiana
Copy link

poiana commented Oct 16, 2024

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

@leogr
Copy link
Member

leogr commented Oct 17, 2024

/remove-lifecycle stale

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature New feature or request
Projects
None yet
Development

No branches or pull requests

4 participants