deckhouse / deckhouse/deckhouse
[runtime-audit-engine] Events to files
Open
Nobody has claimed this yet.
area/security
priority/backlog
source/deckhouse-team
type/enhancement
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 162
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 653
Description
Preflight Checklist
- I agree to follow the Code of Conduct that this project adheres to.
- I have searched the issue tracker for an issue that matches the one I want to file, without success.
Use case. Why is this important?
This is important to protect essential security data from leaking. We should not expose it to stdout, because this way data can be accessed using the Kubernetes API.
Proposed Solution
Writing data to the log is possible, but no log rotation is included.
See https://github.com/falcosecurity/falco/issues/1808
Additional Information
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No implementation files, tests, or entry points are named. Start by locating the runtime-audit-engine event output path and its interaction with the Kubernetes API; done should keep essential security data out of stdout while writing events to files with log rotation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- observability, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100