Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Collecting all the labels from the containers #3346

Open
Issif opened this issue Sep 26, 2024 · 0 comments
Open

Collecting all the labels from the containers #3346

Issif opened this issue Sep 26, 2024 · 0 comments

Comments

@Issif
Copy link
Member

Issif commented Sep 26, 2024

Motivation

Having available as fields all labels from the running containers, ie container.labels[].

These labels are really useful to get more context. For example, for the runners of CI like Gitlab Runners, the fields are filled with information which allow to do the correlation with the job, the project, etc. Having these fields will allow to integrate more Falco in the Supply Chain Security:

			"com.gitlab.gitlab-runner.job.before_sha":  "",
			"com.gitlab.gitlab-runner.job.id":          "0",
			"com.gitlab.gitlab-runner.job.ref":         "",
			"com.gitlab.gitlab-runner.job.sha":         "",
			"com.gitlab.gitlab-runner.job.url":         "/-/jobs/0",
			"com.gitlab.gitlab-runner.managed":         "true",
			"com.gitlab.gitlab-runner.pipeline.id":     "",
			"com.gitlab.gitlab-runner.project.id":      "0",
			"com.gitlab.gitlab-runner.runner.id":       "",
			"com.gitlab.gitlab-runner.runner.local_id": "0",
			"com.gitlab.gitlab-runner.type":            "build",
			"my.custom.label":                          "my.custom.value",

Feature

Having the fields container.labels[] containing all the labels of the pod where the suspicious action happened.

Alternatives

n/a

Additional context

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant