update(userspace/falco): improve falco termination #2012
Conversation
|
/test centos7 |
| } | ||
| m_state->engine->list_fields(m_options.list_source_fields, m_options.verbose, m_options.names_only, m_options.markdown); | ||
|
|
||
| ret.proceed = false; | ||
| return run_result::exit(); |
There was a problem hiding this comment.
This seems like to fix the case in which users use both the list-fields and list-syscall-events options! Just one of them is supposed to execute, but the code previously allowed running both.
| } | ||
| printf("%sOk\n", prefix.c_str()); | ||
| } | ||
| falco_logger::log(LOG_INFO, "Ok\n"); | ||
| return run_result::exit(); |
There was a problem hiding this comment.
This fixes the -V option. Apparently we didn't notice that Falco didn't terminate anymore on rule validation 😸
| #ifndef MINIMAL_BUILD | ||
| std::bind(&application::start_grpc_server, this), | ||
| std::bind(&application::start_webserver, this), | ||
| #endif | ||
| std::bind(&application::open_inspector, this), |
There was a problem hiding this comment.
This is good. The inspector should be opened right before starting processing its event to prevent the drivers from dropping events at the first iterations due to the additional delay of launching the webservers.
|
LGTM label has been added. Git tree hash: 43857c8ad38dc086598b79b5a20e9617316d24f1
|
Thank you @jasondellaluce for adding a little bit of context 😄 |
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
|
/hold |
|
/unhold |
|
LGTM label has been added. Git tree hash: 23e4def7bf1305e1be88fa4709ceb2b085d8bcaf
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Andreagit97, jasondellaluce, leogr The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Closing and reopening to trigger the CI /close |
|
@leogr: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/reopen |
|
@leogr: Reopened this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Signed-off-by: Andrea Terzolo andrea.terzolo@polito.it
What type of PR is this?
/kind cleanup
/kind feature
Any specific area of the project related to this PR?
/area engine
What this PR does / why we need it:
This PR adds new methods
fatal,exit, andoktorun_resultstruct in order to simplify the Falco termination phase.Which issue(s) this PR fixes:
Special notes for your reviewer:
Does this PR introduce a user-facing change?: