aquasecurity / aquasecurity/tracee
Add Kubernetes filters to scopes
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
As of today, when using tracee on k8s we can filter events based on the pod namespace (as attached on the picture)

Lately, we have encountered numerous situations where we need to trace events and signatures only from a specific pod namespace.
Cloud you please add this ability to the scope so we could filter the whole policy?
Attaching the desired outcome:

Thank you
Contributor guide
Research direction
Start by tracing the existing scope filters and the Kubernetes pod namespace data used by Tracee. Confirm how scopes apply to both events and signatures, then define the expected behavior for filtering a whole policy by namespace. Done means a policy can select a specific pod namespace and the corresponding events and signatures are filtered accordingly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes, linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100