mirror of
https://github.com/falcosecurity/falco.git
synced 2025-07-19 00:57:48 +00:00
docs(proposals): gRPC outputs goals/non-goals
Co-authored-by: Lorenzo Fontana <lo@linux.com> Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
parent
19f69f4f08
commit
1ee769a76c
49
proposals/20190826-grpc-outputs.md
Normal file
49
proposals/20190826-grpc-outputs.md
Normal file
@ -0,0 +1,49 @@
|
||||
# gRPC Falco Output
|
||||
|
||||
<!-- toc -->
|
||||
|
||||
## Summary
|
||||
|
||||
We intend to build a gRPC interface to allow users receive and consume the alerts regarding the violated rul.
|
||||
|
||||
## Motivation
|
||||
|
||||
The most valuable information that Falco can give to its users are the alerts.
|
||||
An alert is given by Falco each time a rule is matched.
|
||||
At the current moment, however, Falco can deliver alerts in a very basic way, for example by dumping
|
||||
them to standard output.
|
||||
|
||||
For this reason, many Falco users asked, with issues - eg., [falco#528](https://github.com/falcosecurity/falco/issues/528) - or in the [slack channel]() if we can find a more consumable way to
|
||||
implement Falco outputs in an extensible way.
|
||||
|
||||
The motivation behind this proposal is to design a new output implementation that can meet our user's needs.
|
||||
|
||||
### Goals
|
||||
|
||||
- To design and implement an additional output containing a gRPC client
|
||||
- To keep it as simple as possible
|
||||
- To have a simple contract interface
|
||||
- To only have the responsibility to route Falco output requests and responses
|
||||
- To continue supporting the old output formats by implementing their same interface
|
||||
- To be secure by default
|
||||
- To be asynchronous and non-blocking
|
||||
|
||||
|
||||
### Non-Goals
|
||||
|
||||
- To substitute existing outputs (stdout, syslog, etc.)
|
||||
- To support connecting to multiple gRPC servers
|
||||
- Users can have a single server multiplexing requests to multiple servers
|
||||
- To support queuing mechanisms for message retransmission
|
||||
- Users can have a local gRPC relay server along with Falco that multiplexes connections and handles retires and backoff
|
||||
- To change the output format
|
||||
- To make the message context (text, fields, etc.) and format configurable
|
||||
- Users can already override rules changing their output messages
|
||||
- To act as an orchestrator for Falco instances
|
||||
|
||||
|
||||
## Proposal
|
||||
|
||||
## Design Details
|
||||
|
||||
---
|
Loading…
Reference in New Issue
Block a user