falcosecurity/falco 0.30.0

on GitHub

Packages	Download
rpm
deb
tgz

Major Changes

• new: add --k8s-node command-line options, which allows filtering by a node when requesting metadata of pods to the K8s API server [#1671] - @leogr
• new(outputs): expose rule tags and event source in gRPC and json outputs [#1714] - @jasondellaluce
• new(userspace/falco): add customizable metadata fetching params [#1667] - @zuc

Minor Changes

• update: bump driver version to 3aa7a83bf7b9e6229a3824e3fd1f4452d1e95cb4 [#1744] - @zuc
• docs: clarify that previous Falco drivers will remain available at https://download.falco.org and no automated cleanup is run anymore [#1738] - @leodido
• update(outputs): add configuration option for tags in json outputs [#1733] - @jasondellaluce

Bug Fixes

• fix(scripts): correct standard output redirection in systemd config (DEB and RPM packages) [#1697] - @chirabino
• fix(scripts): correct lookup order when trying multiple gcc versions in the falco-driver-loader script [#1716] - @Spartan-65

Rule Changes

• rule(list miner_domains): add new miner domains [#1729] - @AlbertoPellitteri
• rule(list https_miner_domains): add new miner domains [#1729] - @AlbertoPellitteri

Non user-facing changes

• add Qonto as adopter [#1717] - @Issif
• docs(proposals): proposal for a libs plugin system [#1637] - @ldegio
• build: remove unused ncurses dependency [#1658] - @leogr
• build(.circleci): use new Debian 11 package names for python-pip [#1712] - @zuc
• build(docker): adding libssl-dev, upstream image reference pinned to debian:buster [#1719] - @michalschott
• fix(test): avoid output_strictly_contains failures [#1724] - @jasondellaluce
• Remove duplicate allowed ecr registry rule [#1725] - @TomKeyte
• docs(RELEASE.md): switch to 3 releases per year [#1711] - @leogr

Statistics

Release Manager @araujof