1

If I add an exception to the rule 'The docker client is executed in a container' like:

exceptions:
  - name: kube_mon
    fields: [container.image.repository, k8s.ns.name, k8s.pod.name]
    comps: [=, =, startswith]
    values:
      - [repo/myimg, myns, my-pod-]

I start receiving Warnings where the mentioned fields are null (instead of not receiving them at all) : screen: [1]: https://i.stack.imgur.com/1RTiJ.png

Same exceptions added to the rule 'Contact K8S API Server From Container' works ok and my pods are filtered out from logging.
How can I solve it?
Thanks.
Falco 0.31.1 Chart falco-1.17.4

OlehR
  • 11
  • 2
  • Are you still facing this issue? If so, you could ask in the falco channel in the Kubernetes slack or open an issue on GitHub – trallnag Jan 20 '23 at 22:26
  • 1
    @trallnag I dont know because I moved to another project. Probably its solved in more recent version. thanks for your suggestion. – OlehR Jan 23 '23 at 09:49

0 Answers0