falco: Add base plugin by knrt10 · Pull Request #242 · headlamp-k8s/plugins

knrt10 · 2025-05-13T09:06:51Z

Add plugin for Falco.

TODO

Find a way and fix to get all rules configured by Falco

How to test

# clone Headlamp
git clone git@github.com:kubernetes-sigs/headlamp.git

# Run headlamp backend
cd backend && go run ./cmd -dev -enable-dynamic-clusters -proxy-urls=https://artifacthub.io/\*

# Run frontend
cd frontend && npm i && npm start

# Run app
cd app && npm run dev-only-app

# Have a k8s cluster up and running. See the readme of this PR

# Fetch this PR and go to falco directory
cd falco && npm i && npm start

Screenshots

This adds events, rule and settings page to the plugin. User can select the backend for the events. Default backend is file/volumes. They can easily configure redis as well and use that as backend. Signed-off-by: Kautilya Tripathi <ktripathi@microsoft.com>

gambtho · 2026-03-03T06:34:57Z

+      name: http
+  selector:
+    app: redis-rest-proxy
+


consider restricting to clusterIP or adding a network policy? currently i think anyone can read all events/inject fake events

illume

Thanks for these changes.

It looks like this PR has git conflicts. Can you please fix them?

Copilot

Pull request overview

Adds a new Falco Headlamp plugin to this plugins repository, providing UI pages for viewing Falco security events, exploring loaded rules, and configuring event storage (file vs Redis).

Changes:

Introduces Falco plugin navigation/routes plus Events, Rules, and Settings pages.
Adds services/utilities for pod exec, event parsing/formatting, and rule discovery/parsing from Falco configs.
Adds Redis helper manifests + Falco Helm values and documents setup; registers the plugin in the repo README.

Reviewed changes

Copilot reviewed 34 out of 36 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
falco/tsconfig.json	Plugin TypeScript config extending Headlamp plugin defaults.
falco/src/utils/storageUtils.ts	LocalStorage settings model + load/save helpers.
falco/src/utils/falcoRulesUtils.ts	YAML parsing + rules file discovery utilities.
falco/src/utils/falcoPodUtils.ts	Detect Falco file output path from Pod spec.
falco/src/utils/falcoEventUtils.ts	Event field extraction, formatting, and UI helpers.
falco/src/utils/constants.ts	Shared Falco namespace/label selector constants.
falco/src/types/FalcoRule.ts	Rule and rule-display types.
falco/src/types/FalcoEvent.ts	Falco event type definition.
falco/src/storybook.test.tsx	Storyshots test bootstrap.
falco/src/settings/index.tsx	Settings page export barrel.
falco/src/settings/Settings.tsx	Settings UI for selecting backend and Redis URL.
falco/src/services/podExecService.ts	Pod exec wrapper for reading files / command output.
falco/src/services/falcoRulesService.ts	Fetch pods/configs and aggregate rules from the cluster.
falco/src/rules/index.tsx	Rules page export barrel.
falco/src/rules/FalcoRules.tsx	Rules list page with loading/error handling.
falco/src/index.tsx	Plugin entry: icons, sidebar entries, and routes registration.
falco/src/headlamp-plugin.d.ts	Headlamp plugin type reference.
falco/src/events/index.tsx	Events page export barrel.
falco/src/events/FalcoEvents.tsx	Events viewer: file stream via exec + Redis polling backend.
falco/src/components/TagsCell.tsx	Colored tag rendering for event table.
falco/src/components/SeverityColumn.tsx	Colored severity pill renderer.
falco/src/components/RedisConnectionTester.tsx	Redis REST proxy ping/test UI.
falco/src/components/MessageCell.tsx	Clickable message cell with tooltip and keyboard support.
falco/src/components/LoadingIndicator.tsx	Shared loading + error UI component.
falco/src/components/K8sSourceCell.tsx	Attempts to link events to Kubernetes resources.
falco/src/components/EventDetailDialog.tsx	Event detail modal view.
falco/src/common/Table.tsx	Thin wrapper around Headlamp table component types/props.
falco/src/common/RulesTable.tsx	Rules table column definitions and table wrapper.
falco/redis/redis-server.yaml	Example Redis Deployment/Service for the Redis backend.
falco/redis/redis-rest-proxy.yaml	Example Redis REST proxy deployment (Flask) for browser access.
falco/package.json	Plugin package metadata and scripts (incl. redis setup script).
falco/falco-values.yaml	Example Helm values enabling Falco outputs/plugins.
falco/README.md	Plugin documentation and setup instructions.
falco/.gitignore	Plugin-local ignores (node_modules, dist, etc.).
README.md	Adds Falco plugin entry to the repository plugin list.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

illume · 2026-04-25T13:10:55Z

@copilot address open review comments

Co-authored-by: illume <9541+illume@users.noreply.github.com>

Agent-Logs-Url: https://github.com/headlamp-k8s/plugins/sessions/f37e2a66-7f0d-4912-84fe-550e61db55c0 Co-authored-by: illume <9541+illume@users.noreply.github.com>

Co-authored-by: illume <9541+illume@users.noreply.github.com>

Copilot · 2026-04-25T13:28:53Z

Thanks for these changes.
...

Fixed the merge conflict in README.md in commit abc0b00. The falco entry is now properly placed alongside radius and volcano, with duplicated cert-manager/minikube entries removed.

@copilot address open review comments

All review comments addressed in individual atomic commits:

a648abd — Return fresh copy of defaultSettings in loadSettings()
2f7a7a6 — Pass pendingSettings.redisUrl to RedisConnectionTester
ef327fe — Reuse shared utilities from storageUtils and constants
a2a9f1c — Cap file-stream events array at 300 to match Redis behavior
5ed48af — Replace deprecated onKeyPress with onKeyDown
8da1fde — Include default namespace in getNamespace extraction
9feb677 — Scope pod listing to FALCO_NAMESPACE
2f0f3ed — Preserve Unicode in cleanYamlText, only strip control characters
68157e2 — Handle both namespace and namespaces kind in K8sSourceCell
cfff4b2 — Use @property instead of @param in FalcoEvent JSDoc
5e4496b — Pin Python dependencies in redis-rest-proxy

Also added:

11fa2ef — Unit tests for all utility functions (72 tests passing)
aee829f — Storybook stories for SeverityColumn, TagsCell, MessageCell, LoadingIndicator, and EventDetailDialog

Copilot

Pull request overview

Copilot reviewed 46 out of 48 changed files in this pull request and generated 11 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

illume · 2026-04-25T14:05:52Z

@copilot address open review comments

Co-authored-by: illume <9541+illume@users.noreply.github.com>

…lco container name Co-authored-by: illume <9541+illume@users.noreply.github.com>

Co-authored-by: illume <9541+illume@users.noreply.github.com>

Agent-Logs-Url: https://github.com/headlamp-k8s/plugins/sessions/d4ccc1bc-0993-4000-8406-a019a52c3952 Co-authored-by: illume <9541+illume@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 46 out of 48 changed files in this pull request and generated 10 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

illume · 2026-04-25T15:02:12Z

@copilot Address open review comments

Co-authored-by: illume <9541+illume@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 46 out of 48 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-25T20:10:05Z

+- **Falco Events Viewer:**
+
+  - Real-time streaming and display of Falco security events from all cluster namespaces.
+  - Powerful search and filter UI for namespaces, pods, containers, and severity.


README claims a "search and filter UI for namespaces, pods, containers" but the current Events view uses SectionFilterHeader with noNamespaceFilter and there are no explicit pod/container filters in the UI (only free-text search). Please adjust the wording to match the current UX to avoid confusing users.

Suggested change

- Powerful search and filter UI for namespaces, pods, containers, and severity.

- Free-text search across events, with severity-based filtering in the current UI.

Copilot · 2026-04-25T20:10:06Z

+  // Reconstruct without trailing slash on the path, preserving any query/hash.
+  const base = `${parsed.protocol}//${parsed.host}${parsed.pathname.replace(/\/+$/, '')}`;
+  return base + (parsed.search || '') + (parsed.hash || '');


normalizeRedisUrl returns base + search + hash, but callers build endpoints by string-concatenating paths (e.g. ${normalized}/events). If the user enters a URL containing ?query or #hash, the resulting request URL becomes malformed (query/hash ends up before /events). Consider stripping search/hash in normalizeRedisUrl, or have callers use new URL('/events', normalizedUrlObject) so path joining is correct and predictable.

Copilot · 2026-04-25T20:10:06Z

+  it('should load stored settings', () => {
+    const stored: FalcoSettings = { backend: 'redis', redisUrl: 'http://localhost:8080' };
+    localStorage.setItem('falco_event_storage_settings', JSON.stringify(stored));
+    const settings = loadSettings();
+    expect(settings).toEqual(stored);


Tests hardcode the localStorage key string in multiple places instead of using FALCO_SETTINGS_KEY. This makes the tests unnecessarily brittle if the key is ever renamed. Prefer importing and using the exported constant so production code and tests stay in sync.

Copilot · 2026-04-25T20:10:06Z

+        if ('rule' in obj) {
+          rules.push({
+            name: String(obj.rule),
+            desc: obj.desc || '',
+            source,
+          });


extractRulesFromYaml assigns desc: obj.desc || '', which can yield a non-string (e.g. number/object) and violates the FalcoRule.desc: string contract. Coerce to string (similar to name: String(obj.rule)) so the returned data is consistently typed.

Copilot · 2026-04-25T20:10:06Z

+      return await PodExecService.execCommand(
+        pod,
+        pod.spec?.containers?.[0]?.name || 'falco',
+        ['cat', filePath],
+        { tty: true }


readFile always execs in pod.spec.containers[0] (fallback 'falco'). If the Falco chart adds sidecars/init containers (e.g. falcoctl), the first container may not be the one that has /etc/falco/* mounted, causing reads to fail. Prefer selecting the container named falco when present (fall back to the first only when not found).

Copilot · 2026-04-25T20:10:07Z

+      console.error('Falco exec error:', msg);
+    };
+    try {
+      const containerName = pod.spec?.containers?.[0]?.name || 'falco';


The file-stream backend execs tail in pod.spec.containers[0] (fallback 'falco'), but the Falco daemonset can include sidecars (e.g. falcoctl). If the first container isn't the Falco one (or doesn't have the file mount), the stream will fail. Consider selecting the container named falco when present (similar to detectFalcoFileOutputPath).

Suggested change

const containerName = pod.spec?.containers?.[0]?.name || 'falco';

const containers = pod.spec?.containers ?? [];

const falcoContainer = containers.find(container => container?.name === 'falco');

const containerName = falcoContainer?.name || containers[0]?.name || 'falco';

Copilot · 2026-04-25T20:10:07Z

+                      # If can't parse as JSON, try getting raw data
+                      if data is None:
+                          data = request.get_data(as_text=True)
+                          # Log what we received
+                          print(f"Received raw data: {data}", file=sys.stderr)
+                          try:
+                              # Try to parse it as JSON
+                              data = json.loads(data)
+                          except:
+                              # If not valid JSON, store as is
+                              _store_event(json.dumps({"rule":"Raw Event", "output":data}))
+                              return jsonify(status='ok'), 201
+
+                      # Store proper JSON data
+                      print(f"Storing JSON: {json.dumps(data)}", file=sys.stderr)
+                      _store_event(json.dumps(data))


The redis-rest-proxy container prints full received event payloads (Received raw data / Storing JSON) to stderr. Falco events can contain sensitive details (command lines, paths, usernames), so logging full payloads by default is a data exposure risk and can also bloat logs. Consider removing these prints or gating them behind an explicit debug env var.

knrt10 force-pushed the falco-plugin branch from 3b3a88d to 6f4619b Compare May 13, 2025 09:11

falco: Add base plugin

83a1279

This adds events, rule and settings page to the plugin. User can select the backend for the events. Default backend is file/volumes. They can easily configure redis as well and use that as backend. Signed-off-by: Kautilya Tripathi <ktripathi@microsoft.com>

knrt10 force-pushed the falco-plugin branch from 6f4619b to 83a1279 Compare May 14, 2025 03:49

illume added the falco label May 16, 2025

illume self-assigned this May 20, 2025

gambtho reviewed Mar 3, 2026

View reviewed changes

illume requested a review from Copilot April 25, 2026 12:53

illume requested changes Apr 25, 2026

View reviewed changes

Copilot started reviewing on behalf of illume April 25, 2026 12:54 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Copilot started work on behalf of illume April 25, 2026 13:11 View session

Copilot AI and others added 17 commits April 25, 2026 13:12

Resolve merge conflict in README.md

abc0b00

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: return fresh copy of defaultSettings in loadSettings

a648abd

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: pass pendingSettings.redisUrl to RedisConnectionTester

2f7a7a6

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: reuse shared utilities from storageUtils and constants

ef327fe

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: cap file-stream events array to prevent unbounded growth

a2a9f1c

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: replace deprecated onKeyPress with onKeyDown

5ed48af

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: include default namespace in getNamespace extraction

8da1fde

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: scope pod listing to FALCO_NAMESPACE

9feb677

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: preserve Unicode in cleanYamlText, only strip control chars

2f0f3ed

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: handle both namespace and namespaces kind in K8sSourceCell

68157e2

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: use @Property instead of @param in FalcoEvent JSDoc

cfff4b2

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: pin Python dependencies in redis-rest-proxy

5e4496b

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: add unit tests for utility functions

11fa2ef

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: add Storybook stories for components

aee829f

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: fix lint issues in tests and stories

b1da464

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: add tests and stories

e276aae

Agent-Logs-Url: https://github.com/headlamp-k8s/plugins/sessions/f37e2a66-7f0d-4912-84fe-550e61db55c0 Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: add .eslintcache to .gitignore

54dfcd1

Co-authored-by: illume <9541+illume@users.noreply.github.com>

illume requested a review from Copilot April 25, 2026 13:43

Copilot started reviewing on behalf of illume April 25, 2026 13:44 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Copilot started work on behalf of illume April 25, 2026 14:06 View session

Copilot started work on behalf of illume April 25, 2026 14:09 View session

Copilot AI and others added 6 commits April 25, 2026 14:15

falco: remove debug console.log statements from rules loaders

92514b7

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: validate and normalize Redis URL, reuse FALCO_NAMESPACE in tester

e1902a2

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: validate redisUrl, decode ArrayBufferView correctly, detect Fa…

e6ec931

…lco container name Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: map kinds to Headlamp routeNames explicitly in K8sSourceCell

fa9ffe6

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: allow API server ingress to redis-rest-proxy NetworkPolicy

6cae79b

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: preserve URL hash fragment in normalizeRedisUrl

4f5b498

Agent-Logs-Url: https://github.com/headlamp-k8s/plugins/sessions/d4ccc1bc-0993-4000-8406-a019a52c3952 Co-authored-by: illume <9541+illume@users.noreply.github.com>

Copilot finished work on behalf of illume April 25, 2026 14:18

illume requested a review from Copilot April 25, 2026 14:24

Copilot started reviewing on behalf of illume April 25, 2026 14:24 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Copilot started work on behalf of illume April 25, 2026 15:02 View session

Copilot AI and others added 7 commits April 25, 2026 15:09

falco: clear save-status setTimeout on unmount

1d5561d

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: bump @kinvolk/headlamp-plugin to ^0.13.1 and add i18n script

06db667

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: parallelize fetchAllRules with Promise.all

9aa8050

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: fix non-root pip install and cap falco:events with LTRIM

8b58d1f

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: handle ns/ms/s epoch and short namespace names in falcoEventUtils

73339b9

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: remove duplicate path from logo SVG

61874c0

Co-authored-by: illume <9541+illume@users.noreply.github.com>

falco: wire useFilterFunc into FalcoRules header search

df25cc7

Co-authored-by: illume <9541+illume@users.noreply.github.com>

Copilot finished work on behalf of illume April 25, 2026 15:12

illume requested a review from Copilot April 25, 2026 20:03

Copilot started reviewing on behalf of illume April 25, 2026 20:04 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

	- Powerful search and filter UI for namespaces, pods, containers, and severity.
	- Free-text search across events, with severity-based filtering in the current UI.

-      const containerName = pod.spec?.containers?.[0]?.name || 'falco';
+      const containers = pod.spec?.containers ?? [];
+      const falcoContainer = containers.find(container => container?.name === 'falco');
+      const containerName = falcoContainer?.name || containers[0]?.name || 'falco';

Conversation

knrt10 commented May 13, 2025

TODO

How to test

Screenshots

Uh oh!

gambtho Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

illume commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

illume commented Apr 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

illume commented Apr 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Copilot AI commented Apr 25, 2026 •

edited

Loading