Skip to content

feat(metrics): add optional k8s metadata labels to rules_matches#3839

Open
Debasish-87 wants to merge 1 commit intofalcosecurity:masterfrom
Debasish-87:feature/k8s-metrics-labels
Open

feat(metrics): add optional k8s metadata labels to rules_matches#3839
Debasish-87 wants to merge 1 commit intofalcosecurity:masterfrom
Debasish-87:feature/k8s-metrics-labels

Conversation

@Debasish-87
Copy link
Copy Markdown

@Debasish-87 Debasish-87 commented Mar 30, 2026

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area engine

What this PR does / why we need it:

This PR introduces an optional configuration flag metrics.include_k8s_metadata to enrich the falcosecurity_falco_rules_matches_total Prometheus metric with Kubernetes-related labels.

When enabled, the metric includes:

  • k8s_ns_name
  • k8s_pod_name

This addresses the current limitation where Kubernetes context is available in Falco event logs but not exposed in Prometheus metrics, making it difficult to correlate alerts with specific workloads.

Since Kubernetes metadata is not available at the metrics aggregation layer, placeholder values ("n/a") are used. This provides a consistent interface while preserving forward compatibility for future improvements where real metadata may be available.

The feature is disabled by default to avoid introducing high-cardinality metrics unless explicitly enabled by the user.

Which issue(s) this PR fixes:

Fixes #3826

Special notes for your reviewer:

  • Fully backward-compatible (feature is opt-in and defaults to false)
  • No impact on existing metrics unless explicitly enabled
  • Avoids high-cardinality risks by design
  • Placeholder values are used due to current architectural constraints at aggregation level

Does this PR introduce a user-facing change?:

Add optional `metrics.include_k8s_metadata` configuration to include Kubernetes labels (namespace and pod name) in Prometheus rule match metrics.

@poiana
Copy link
Copy Markdown
Contributor

poiana commented Mar 30, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Debasish-87
Once this PR has been reviewed and has the lgtm label, please assign sgaist for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana
Copy link
Copy Markdown
Contributor

poiana commented Mar 30, 2026

Welcome @Debasish-87! It looks like this is your first PR to falcosecurity/falco 🎉

@Debasish-87
Copy link
Copy Markdown
Author

Hi maintainers,

This PR adds an opt-in configuration to include Kubernetes metadata in Prometheus metrics while preserving backward compatibility and avoiding high-cardinality issues.

Would appreciate your feedback and review.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

Prometheus metrics should include pod name and namespace as labels

2 participants