feat(metrics): add optional k8s metadata labels to rules_matches#3839
feat(metrics): add optional k8s metadata labels to rules_matches#3839Debasish-87 wants to merge 1 commit intofalcosecurity:masterfrom
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Debasish-87 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Welcome @Debasish-87! It looks like this is your first PR to falcosecurity/falco 🎉 |
12ad7b4 to
56c6a51
Compare
Signed-off-by: Debasish-87 <[email protected]>
56c6a51 to
314a35a
Compare
|
Hi maintainers, This PR adds an opt-in configuration to include Kubernetes metadata in Prometheus metrics while preserving backward compatibility and avoiding high-cardinality issues. Would appreciate your feedback and review. Thanks! |
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area engine
What this PR does / why we need it:
This PR introduces an optional configuration flag
metrics.include_k8s_metadatato enrich thefalcosecurity_falco_rules_matches_totalPrometheus metric with Kubernetes-related labels.When enabled, the metric includes:
k8s_ns_namek8s_pod_nameThis addresses the current limitation where Kubernetes context is available in Falco event logs but not exposed in Prometheus metrics, making it difficult to correlate alerts with specific workloads.
Since Kubernetes metadata is not available at the metrics aggregation layer, placeholder values (
"n/a") are used. This provides a consistent interface while preserving forward compatibility for future improvements where real metadata may be available.The feature is disabled by default to avoid introducing high-cardinality metrics unless explicitly enabled by the user.
Which issue(s) this PR fixes:
Fixes #3826
Special notes for your reviewer:
false)Does this PR introduce a user-facing change?: