github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-13 13:32:50 +00:00
Code Issues Projects Releases Wiki Activity

cleanup(userspace/engine,userspace/falco): drop replace_container_info flag.

Browse Source 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro
2025-04-30 11:06:11 +02:00
committed by poiana
parent 0326210f49
commit 6e4b7663ca
5 changed files with 8 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
userspace/engine/falco_engine.cpp
View File

@@ -986,9 +986,8 @@ void falco_engine::set_sampling_multiplier(double sampling_multiplier) {
void falco_engine::add_extra_output_format(const std::string &format,
const std::string &source,
const std::set<std::string> &tags,
const std::string &rule,
bool replace_container_info) {
m_extra_output_format.push_back({format, source, tags, rule, replace_container_info});
const std::string &rule) {
m_extra_output_format.push_back({format, source, tags, rule});
}
void falco_engine::add_extra_output_formatted_field(const std::string &key,

3
userspace/engine/falco_engine.h
View File

@@ -199,8 +199,7 @@ public:
void add_extra_output_format(const std::string &format,
const std::string &source,
const std::set<std::string> &tags,
const std::string &rule,
bool replace_container_info);
const std::string &rule);
// You can optionally add fields that will only show up in the object
// output (e.g. json, gRPC) alongside other output_fields

1
userspace/engine/rule_loader.h
View File

@@ -272,7 +272,6 @@ struct extra_output_format_conf {
std::string m_source;
std::set<std::string> m_tags;
std::string m_rule;
bool m_replace_container_info;
};
struct extra_output_field_conf {

16
userspace/engine/rule_loader_compiler.cpp
View File

@@ -434,21 +434,7 @@ void rule_loader::compiler::compile_rule_infos(configuration& cfg,
continue;
}
if(extra.m_replace_container_info) {
if(rule.output.find(s_container_info_fmt) != std::string::npos) {
cfg.res->add_warning(falco::load_result::load_result::LOAD_DEPRECATED_ITEM,
"%container.info is deprecated and no more useful, and "
"will be dropped by Falco 1.0.0. "
"The container plugin will automatically add required "
"fields to the output message.",
r.ctx);
rule.output = replace(rule.output, s_container_info_fmt, extra.m_format);
} else {
rule.output = rule.output + " " + extra.m_format;
}
} else {
rule.output = rule.output + " " + extra.m_format;
}
rule.output = rule.output + " " + extra.m_format;
}
if(rule.output.find(s_container_info_fmt) != std::string::npos) {