Review

Dockerfile

@@ -0,0 +1,40 @@
+FROM golang:1.16-buster as builder
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+
+RUN go mod download
+
+COPY . .
+
+RUN make bin/pc
+
+FROM debian:buster-slim
+
+ARG VERSION=0.0.1
+ARG BUILD_DATE=2021-05-1
+
+LABEL \
+  org.opencontainers.image.created="$BUILD_DATE" \
+  org.opencontainers.image.authors="[email protected]" \
+  org.opencontainers.image.homepage="https://github.com/NissesSenap/falcosidekick-tekton" \
+  org.opencontainers.image.documentation="https://github.com/NissesSenap/falcosidekick-tekton" \
+  org.opencontainers.image.source="https://github.com/NissesSenap/falcosidekick-tekton" \
+  org.opencontainers.image.version="$VERSION" \
+  org.opencontainers.image.vendor="GitHub" \
+  org.opencontainers.image.licenses="MIT" \
+  summary="Kubernetes response Engine deletes pods after commands from falcosidekick" \
+  description="Kubernetes response Engine delete pods is meant to be run inside k8s and delete pods after getting instructions from falcosidekick." \
+  name="podDeleter"
+
+RUN apt-get update && apt-get upgrade -y \
+ && rm -rf /var/lib/apt/lists/*
+
+USER 1001
+
+WORKDIR /app
+
+COPY --from=builder /app/bin/poddeleter .
+
+CMD ["/app/poddeleter"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Edvin N
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,28 @@
+BUILD_FILES = $(shell go list -f '{{range .GoFiles}}{{$$.Dir}}/{{.}}\
+{{end}}' ./...)
+
+GH_VERSION ?= $(shell git describe --tags 2>/dev/null || git rev-parse --short HEAD)
+DATE_FMT = +%Y-%m-%d
+BUILD_DATE = $(shell date "$(DATE_FMT)")
+IMAGE_REPO = "quay.io/nissessenap/poddeleter"
+
+print-%  : ; @echo $* = $($*)
+
+bin/pc: $(BUILD_FILES)
+	@go build -trimpath -o bin/poddeleter ./main.go
+
+bin/container:
+	docker build --build-arg BUILD_DATE=$(BUILD_DATE) --build-arg VERSION=$(GH_VERSION) . -t $(IMAGE_REPO):$(GH_VERSION)
+.PHONY: bin/container
+
+bin/push:
+	docker push $(IMAGE_REPO):$(GH_VERSION)
+.PHONY: bin/push
+
+clean:
+	rm -rf ./bin ./share
+.PHONY: clean
+
+test:
+	go test ./...
+.PHONY: test

NOTES.md

@@ -0,0 +1,16 @@
+# Ideas
+
+## TODO
+
+- Create a super simple go app that works with the incoming data.
+  - probably just a single body for now, then discuss with falco community.
+- Create a Dockerfile
+- Push dockerfile to quay.io
+- Verify e2e workflow
+
+## Output example
+
+This is how I can easily test my go application.
+This output is from a command that is not okay in falco.
+
+export BODY='{"output":"17:30:51.428027354: Notice A shell was spawned in a container with an attached terminal (user=root user_loginuid=-1 k8s.ns=falcoresponse k8s.pod=alpine container=ac7c5359a04b shell=sh parent=runc cmdline=sh -c cat /etc/resolv.conf terminal=34816 container_id=ac7c5359a04b image=alpine) k8s.ns=falcoresponse k8s.pod=alpine container=ac7c5359a04b k8s.ns=falcoresponse k8s.pod=alpine container=ac7c5359a04b","priority":"Notice","rule":"Terminal shell in container","time":"2021-05-02T17:30:51.428027354Z", "output_fields": {"container.id":"ac7c5359a04b","container.image.repository":"alpine","evt.time":1619976651428027354,"k8s.ns.name":"falcoresponse","k8s.pod.name":"alpine","proc.cmdline":"sh -c cat /etc/resolv.conf","proc.name":"sh","proc.pname":"runc","proc.tty":34816,"user.loginuid":-1,"user.name":"root"}}'