Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(userspace/falco): report plugin deps rules issues in any case #2589

Merged
merged 2 commits into from
May 29, 2023

Conversation

jasondellaluce
Copy link
Contributor

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area engine

What this PR does / why we need it:

We have an egg-and-chicken problem here. We would like to check plugin requirements before loading any rule, so that we avoid having all the "unkwown field XXX" errors caused when a plugin is required but not loaded. On the other hand, we can't check the requirements before loading the rules file, because that's where the plugin dependencies are specified. This issue is visible only for dependencies over extractor plugins, due to the fact that if a source plugin is not loaded, its source will be unknown for the engine and so it will skip loading all of the rules to that source, to finally end up here and return a fatal error due to plugin dependency not satisfied being the actual problem.

The long-term solution would be to pass information about all the loaded plugins to the falco engine before or when loading a rules file, so that plugin version checks can be performed properly by the engine, just like it does for the engine version requirement. On the other hand, This also requires refactoring a big chunk of the API and code of the engine responsible of loading rules.

Since we're close to releasing Falco v0.35, the chosen workaround is to first collect any error from the engine, then checking if there is also a version dependency not being satisfied, and give that failure cause priority in case we encounter it. This is indeed not perfect, but suits us for the time being. The non-covered corner case is when the required_plugin_versions YAML block is defined after the first rule definition (which is wrong anyways but currently allowed by the engine), in which case Falco would stop at the first error (which behavior we'll still want to change in the near future), not collect the plugin deps info, and the version checks will pass with success wrongly due to no requirement definition being read by the engine yet.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

fix(userspace/falco): report plugin deps rules issues in any case

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
@jasondellaluce
Copy link
Contributor Author

/milestone 0.35.0

@poiana poiana added this to the 0.35.0 milestone May 25, 2023
@poiana poiana added the size/M label May 25, 2023
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented May 29, 2023

LGTM label has been added.

Git tree hash: c54ce966c2083f0a742010ac23e685a0301d2636

Copy link
Member

@Andreagit97 Andreagit97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented May 29, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, jasondellaluce

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [Andreagit97,FedeDP,jasondellaluce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@leogr
Copy link
Member

leogr commented May 29, 2023

Closing and reopening to trigger the CI
/close

@poiana poiana closed this May 29, 2023
@poiana
Copy link
Contributor

poiana commented May 29, 2023

@leogr: Closed this PR.

In response to this:

Closing and reopening to trigger the CI
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@leogr
Copy link
Member

leogr commented May 29, 2023

/reopen

@poiana poiana reopened this May 29, 2023
@poiana
Copy link
Contributor

poiana commented May 29, 2023

@leogr: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@poiana poiana merged commit 1263c67 into master May 29, 2023
@poiana poiana deleted the fix/plugin-deps-checks branch May 29, 2023 10:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

5 participants