diff --git a/userspace/falco/config_json_schema.h b/userspace/falco/config_json_schema.h index c27d22fe9f6..7756dd629a3 100644 --- a/userspace/falco/config_json_schema.h +++ b/userspace/falco/config_json_schema.h @@ -577,6 +577,10 @@ const char config_schema_string[] = LONG_STRING_CONST( }, "jemalloc_stats_enabled": { "type": "boolean" + }, + "include_k8s_metadata": { + "type": "boolean", + "default": false } }, "minProperties": 1, diff --git a/userspace/falco/configuration.cpp b/userspace/falco/configuration.cpp index 9f5d9ce8c24..e3510d4a8c1 100644 --- a/userspace/falco/configuration.cpp +++ b/userspace/falco/configuration.cpp @@ -96,6 +96,7 @@ falco_configuration::falco_configuration(): m_metrics_flags(0), m_metrics_convert_memory_to_mb(true), m_metrics_include_empty_values(false), + m_include_k8s_metadata(false), m_plugins_hostinfo(true), m_capture_enabled(false), m_capture_path_prefix("/tmp/falco"), @@ -563,6 +564,7 @@ void falco_configuration::load_yaml(const std::string &config_name) { m_base_syscalls_all = m_config.get_scalar("base_syscalls.all", false); m_metrics_enabled = m_config.get_scalar("metrics.enabled", false); + m_include_k8s_metadata = m_config.get_scalar("metrics.include_k8s_metadata", false); m_metrics_interval_str = m_config.get_scalar("metrics.interval", "5000"); m_metrics_interval = falco::utils::parse_prometheus_interval(m_metrics_interval_str); m_metrics_stats_rule_enabled = m_config.get_scalar("metrics.output_rule", false); diff --git a/userspace/falco/configuration.h b/userspace/falco/configuration.h index 68baea7dce0..b387c6c39e5 100644 --- a/userspace/falco/configuration.h +++ b/userspace/falco/configuration.h @@ -190,6 +190,7 @@ class falco_configuration { uint32_t m_metrics_flags; bool m_metrics_convert_memory_to_mb; bool m_metrics_include_empty_values; + bool m_include_k8s_metadata; std::vector m_plugins; bool m_plugins_hostinfo; diff --git a/userspace/falco/falco_metrics.cpp b/userspace/falco/falco_metrics.cpp index 6e55fcb54d3..4e7df766b35 100644 --- a/userspace/falco/falco_metrics.cpp +++ b/userspace/falco/falco_metrics.cpp @@ -206,6 +206,12 @@ std::string falco_metrics::falco_to_text_prometheus( {"priority", std::to_string(rule->priority)}, {"source", rule->source}, }; + if(state.config->m_include_k8s_metadata) { + // Kubernetes metadata is not available at metrics aggregation level. + // Expose placeholder labels for consistency with other Falco outputs. + const_labels["k8s_ns_name"] = "n/a"; + const_labels["k8s_pod_name"] = "n/a"; + } std::for_each(rule->tags.cbegin(), rule->tags.cend(), [&const_labels](std::string const& tag) {