CODEWITHSUNDEEP
kubernetesfalco
OlehR
OlehR

Reputation: 11

Falco k8s, when add an exception, some fields become null

If I add an exception to the rule 'The docker client is executed in a container' like:

exceptions:
  - name: kube_mon
    fields: [container.image.repository, k8s.ns.name, k8s.pod.name]
    comps: [=, =, startswith]
    values:
      - [repo/myimg, myns, my-pod-]

I start receiving Warnings where the mentioned fields are null (instead of not receiving them at all) : screen: [1]: https://i.sstatic.net/1RTiJ.png

Same exceptions added to the rule 'Contact K8S API Server From Container' works ok and my pods are filtered out from logging.
How can I solve it?
Thanks.
Falco 0.31.1 Chart falco-1.17.4

Upvotes: 1

Views: 299

Answers (0)

Related Questions