mirror of
https://github.com/falcosecurity/falco.git
synced 2026-01-30 14:08:21 +00:00
ccb3cc13b4
As a part of the changes in https://github.com/falcosecurity/falco/pull/826/, we added several breaking changes to rules files like renaming/removing some filter fields. This isn't ideal for customers who are using their own rules files. We shouldn't break older rules files in this way, so add some minimal backwards compatibility which adds back the fields that were removed *and* actually used in k8s_audit_rules.yaml. They have the same functionality as before. One exception is ka.req.binding.subject.has_name, which was only used in a single output field for debugging and shouldn't have been in the rules file in the first place. This always returns the string "N/A". Signed-off-by: Mark Stemm <mark.stemm@gmail.com>