-
Notifications
You must be signed in to change notification settings - Fork 905
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(userspace/falco): report plugin deps rules issues in any case #2589
Conversation
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
/milestone 0.35.0 |
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/approve
LGTM label has been added. Git tree hash: c54ce966c2083f0a742010ac23e685a0301d2636
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/approve
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Andreagit97, FedeDP, jasondellaluce The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Closing and reopening to trigger the CI |
@leogr: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/reopen |
@leogr: Reopened this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
What type of PR is this?
/kind bug
Any specific area of the project related to this PR?
/area engine
What this PR does / why we need it:
We have an egg-and-chicken problem here. We would like to check plugin requirements before loading any rule, so that we avoid having all the "unkwown field XXX" errors caused when a plugin is required but not loaded. On the other hand, we can't check the requirements before loading the rules file, because that's where the plugin dependencies are specified. This issue is visible only for dependencies over extractor plugins, due to the fact that if a source plugin is not loaded, its source will be unknown for the engine and so it will skip loading all of the rules to that source, to finally end up here and return a fatal error due to plugin dependency not satisfied being the actual problem.
The long-term solution would be to pass information about all the loaded plugins to the falco engine before or when loading a rules file, so that plugin version checks can be performed properly by the engine, just like it does for the engine version requirement. On the other hand, This also requires refactoring a big chunk of the API and code of the engine responsible of loading rules.
Since we're close to releasing Falco v0.35, the chosen workaround is to first collect any error from the engine, then checking if there is also a version dependency not being satisfied, and give that failure cause priority in case we encounter it. This is indeed not perfect, but suits us for the time being. The non-covered corner case is when the
required_plugin_versions
YAML block is defined after the first rule definition (which is wrong anyways but currently allowed by the engine), in which case Falco would stop at the first error (which behavior we'll still want to change in the near future), not collect the plugin deps info, and the version checks will pass with success wrongly due to no requirement definition being read by the engine yet.Which issue(s) this PR fixes:
Special notes for your reviewer:
Does this PR introduce a user-facing change?: