Skip to content

chore(plugins/container): deprecate container probe fields#1265

Open
leogr wants to merge 3 commits intomainfrom
deprecate-container-probe-fields
Open

chore(plugins/container): deprecate container probe fields#1265
leogr wants to merge 3 commits intomainfrom
deprecate-container-probe-fields

Conversation

@leogr
Copy link
Copy Markdown
Member

@leogr leogr commented Mar 24, 2026

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area plugins

/area registry

/area build

/area documentation

What this PR does / why we need it:

Deprecate container.healthcheck, container.liveness_probe, container.readiness_probe and the related proc.is_container_* fields.

These fields rely on the kubectl.kubernetes.io/last-applied-configuration annotation, which is fragile and K8s-specific. Moreover, liveness/readiness probes never worked for CRI runtimes, they just were implemented only for Docker.

As discussed in #1218 (which I'm going to close in favor of this), the consensus is to deprecate them here and eventually move the functionality to the k8smeta plugin.

Which issue(s) this PR fixes:

Fixes #1017

Special notes for your reviewer:

The Falco deprecation policy for stable features technically requires 1 release cycle of functioning-while-deprecated before removal. However, I believe deprecating and making these fields no-op in the same release is acceptable here for the following reasons:

  • These fields have been broken on CRI runtimes (containerd, CRI-O) for 6+ years (only Docker ever returned real values)
  • No official Falco rules reference any of these 6 fields
  • There is existing precedent in this plugin: 20 k8s.* fields (k8s.rc.*, k8s.svc.*, k8s.rs.*, k8s.deployment.*) were deprecated the exact same way (deprecated + no-op in the same release)
  • User can still use the old plugin version if they need these fields

That said, if anyone disagrees with this approach, we can go with a strict two-phase deprecation instead: 0.7.0 = deprecated but still functional for Docker, next release = no-op. Let me know 🙏

@poiana
Copy link
Copy Markdown
Contributor

poiana commented Mar 24, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@github-actions
Copy link
Copy Markdown

Rules files suggestions

@leogr
Copy link
Copy Markdown
Member Author

leogr commented Mar 26, 2026

/hold

Waiting for double-checking

Comment on lines -614 to -617
field_id != TYPE_CONTAINER_DURATION &&
field_id != TYPE_IS_CONTAINER_HEALTHCHECK &&
field_id != TYPE_IS_CONTAINER_LIVENESS_PROBE &&
field_id != TYPE_IS_CONTAINER_READINESS_PROBE)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we left some handling code for these TYPE_* few lines after these ones, isn't it better to also leave these ones here? Another option could be to remove both these and the following ones.

@irozzo-1A irozzo-1A changed the title Deprecate container probe fields chore(plugins/container): deprecate container probe fields Mar 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Container plugin: container.liveness_probe is always NONE

3 participants