falcosecurity/falcosidekick v3.0.0-beta.1

falcosidekick 3.0.0-beta.1

on GitHub

Changelog

• 7bd6c44 docs: rewrite the README for v3 with the web UI screenshots and date the 3.0.0-beta.1 changelog
• fb65e69 test(e2e): expect the rejected count in the Elasticsearch bulk error
• cae1520 chore: tighten the older comments of the files the beta fixes touch
• 1ef931a chore: tighten the comments of recent v3 code
• a6e14e4 docs: prepare the 3.0.0-beta.1 changelog, owners, readme and install notes
• 9f2e461 fix: bound runtime values, decode every input alike, coordinate reloads, bound kafka and policyreport writes, report partial batch failures
• 3ff42f8 build: require go 1.26.11 for GO-2026-6859
• 46cd56a ci: pin and time-box every job, sign by digest, restore provenance, lint and install the chart, fail e2e on missing services
• d2915ee feat(chart): refuse credentials and contradictions at render, add a startup probe, test pod and extra output files
• a7874a1 fix(database): wait for postgres within connect_timeout instead of failing on the first refused connection
• cf5dc2d fix: apply the review findings on outputs, metrics, API and docs
• e478954 feat(chart): add the v3 Helm chart, UI on and read-only by default, tested over every combination of its values
• 230c925 feat(outputs)!: follow each destination's own API and vocabulary instead of v2's
• 62e862e test: count invalid ingest posts at the handler and bracket IPv6 listener addresses
• 6fe2178 feat!: run on distroless, listen on IPv4 and IPv6, drain on SIGTERM, and name metrics for what they count
• 8699e0d fix(outputs): suggest Falco branding instead of defaulting to it, key Kafka partitions, date Elasticsearch indexes by event time
• 063f5cd docs(outputs): add a page per output, with settings tables generated from the output schema
• 0882c3f ci: publish v3 images to Docker Hub only and build them on every pull request
• 9210351 chore: send v2 fixes and Dependabot docker updates to the 2.x branch
• f1806cb fix(api): take list filters as one parameter per value so rule names, hosts and tags may contain commas
• 9af6ea9 feat(ui): draw the configured event source under Sidekick, written to and read back, with the events it stores
• fced24f fix(ui): free the export's object URL after the browser has read it, not right after the click
• 3315b9b feat(ui): draw the event source with a second lane back into Sidekick and mark it in the pipeline list
• 3d75e42 fix(ui): keep stored header and query secrets on edit, save edits against the version they started from, never show unknown or stale counts as current, and inherit runtime defaults
• 15449e2 fix: serve the secret listing only with writes on, read file digests before outputs are built, expose runtime defaults in the config API, and make the UI contract fixtures deterministic
• f12f921 fix(ui): put the timeline on the shared chart container, align card sizes and time window controls, name each browser tab, and use shared code components
• 299623e feat(ui): show live Falco activity with the snippet that connects it, and live delivery for Sidekick, leaving build and settings to Configuration
• 6fa308c fix(ui): keep driver search and categories fixed while only the driver list scrolls
• 9558a9a fix(ui): cut long output errors with a way to show them whole, say just now for fresh times, and fix dashboard headings and spacing
• 1348600 fix(ui): give every driver tile the same height, keep driver search on top, and size the config view to its panel
• 41ac4b0 feat(ui): mark the drivers that can be the event source, say which output feeds the Events page, and fit the driver grid on phones
• f8f8902 fix(ui): keep focus visible and returned, never show unknown data as zero, keep the canvas readable, honor reduced motion, and use shared empty and error states
• 39d4054 feat(outputs): declare which output types can be the UI event source and refuse any other at startup
• 57137d1 feat(ui): select events to copy or export as JSON, export every matching event, and center the table rows
• fcb9e3e feat(ui): show each event's output and clock time, filter by priority with counts, and page with shadcn pagination
• eafe9e4 feat(ui): expand or collapse every configuration section at once and start over for each output
• 6704dd3 refactor(ui): build the configuration page from shared settings components
• 047e7f0 test(cmd): rotate the secret file atomically so the watcher test never reads it half written
• 142d03e feat(ui): lay out the configuration page as settings sections with what each setting does and copyable values
• 9017b51 feat(ui): show one problem per output and its full configuration with defaults in the pipeline detail
• cde8c2f feat(ui): draw events by severity as stacked curves
• a4ce6fc feat(ui): redesign the dashboard around what needs attention, delivery and events by severity with shadcn cards, tables and charts
• 8e31e5f feat(outputs): pick each output category from a closed set defined in the output domain
• 863035d feat(reload): rebuild an output when a certificate or other file it reads at build changes, and collect file paths in the output domain
• 48d9c88 feat(ui): add, edit and remove outputs from the pipeline with a driver wizard that picks secret files from api.secret_dirs
• 9e01d91 feat(reload): reload when a secret file changes under api.secret_dirs or next to a file an output reads, without SIGHUP
• f1b243a feat(api): list the secret files under api.secret_dirs by name with GET /api/v1/secrets
• 0a1ae6b feat(ui): replace Settings with a read-only Configuration page that shows the running configuration with secrets masked
• 48022d5 feat(ui): mark each output as file or API provisioned with an icon and tooltip instead of a subtitle
• a7af94d feat(ui): spread the pipeline outputs evenly around the Sidekick line using each node's measured height
• 8c8a4b0 feat(ui): match the backend contract, make every page responsive and accessible, share components, and show official driver logos
• 9f20d8d test: cover inline secrets on sqlite, every replica change, the events API without its source, SIGHUP rotation and database validation in core
• 8df7c7d fix(api): bound API requests and cancel them at shutdown, and delete only provisioned rows when provisioning
• 3a69ed9 docs: describe the sqlite and postgres databases in install, known limits and migration, and state that the UI only reads
• 45bc0f0 ci: run the database, replica and startup tests on postgres 17 and 18, failing if the database is missing
• 28daac7 test(reload): read reload counters by source with one helper
• e794bd7 feat(reload): count the reconciles with other instances under source replica
• 2e548e0 feat(database): keep postgres replicas in step through change notifications and a periodic reconcile
• a92d02a feat(config): configure and open the sqlite and postgres databases, masking the postgres password
• 154c06f feat(database): add the sqlite and postgres stores with embedded migrations and one conformance suite for every backend
• fc0a41f feat(reload): reread the secret files of API outputs at each reload and accept SIGHUP without output files
• 2bc4114 feat(config): refuse inline secrets in output files and API writes when the database keeps what it stores
• 8abd13c fix(reload): store file outputs before switching to them and provision a new secret path even when its content is unchanged
• 476e4a4 test(config): drop the check for the removed disable_deletion key
• 431940b refactor(config): remove provisioning.disable_deletion so outputs dropped from the files always stop
• 9ae8e20 fix(api): answer 503 without database text for every database failure and let shutdown wait for the write in progress
• 2f329cc refactor(database): stop storing the core configuration and serve each instance's own from GET /api/v1/config
• 34cce45 feat(database): start without stored outputs that do not build and report them as failed
• 962c388 feat(database): make output writes conditional on the stored version and apply them only after the database accepts
• e10b813 refactor(output): move the schema secret visitor next to the schema types
• 4bc1ca1 feat(database): store secret file references and read the files only to build outputs
• 8c23675 ci: build the v3 images on every pull request
• 83aa5f3 docs(migration): note the cap on metric label values taken from events
• 60c802b test(outputs): check every registered output against echoed secrets, permanent rejections and repeated close
• 9fec1f1 ci: publish the minor, major and v3-latest aliases only for the highest stable release
• 8a2a867 docs(otlp): state how many counted events the metric remembers across retries
• dbaccc4 fix(config): refuse an empty management listen address instead of listening on every interface
• e50a10d fix(api): require the read version on DELETE and check it under the reloader lock
• 546ec68 fix(database): keep the version of provisioned outputs whose settings did not change
• c0748a5 fix(policyreport): keep the event UUID in the uuid property that deduplicates retried results
• bccca25 fix(policyreport): read the kubeconfig as a bounded regular file before handing it to client-go
• 1a22ebc fix(aws): keep the output TLS settings for the destination and let credential calls trust the system CAs
• 6b32764 fix(otlp): take the HTTP scheme and timeout from the endpoint configuration, never from OTEL variables
• ba9715e fix(api): read map fields written as lists like the output decoder before checking file paths
• e0e04e5 ci: tag v3 images by version with minor, major and v3-latest aliases for stable releases and publish master as v3-main
• 2c0c643 ci: publish master as the v3-dev channel, gate releases on e2e, sign dockers_v2 images and pin the base image
• 347fe6e fix(outputs): probe the Kafka topic, keep idempotent writes in async, count OTLP metrics once per event and add each PolicyReport result once
• 550f750 fix(outputs): bind prepared requests to the delivery context, accept SMTP IPv6 hosts and refuse ambiguous auth and TLS settings
• 5618513 fix(outputs): list SNS message attributes explicitly, refuse FIFO queues and topics and stop startup when STS refuses the role
• 9e7d63a fix(outputs): refuse Pub/Sub credentials with a credential_source in API writes
• 6ab9da9 fix(api): confine API file paths to api.secret_dirs, version output writes and bound every file an output reads
• cc08405 fix(pipeline): share one delivery record across replacements and classify every failed part of a batch
• 89fbcaf feat(api): serve the API and the UI on a separate management listener bound to loopback by default
• 1161a28 fix(outputs): let a delivery waiting on the Elasticsearch template or a PolicyReport write follow its context
• 1a2794e fix(pipeline): switch reloaded outputs together and retire their predecessors under one deadline
• e1d7f70 fix(config): normalize minimum_priority and reject negative runtime overrides
• f3011e8 feat(metrics): count output events per event and cap label values taken from events
• a8e45ac fix(outputs): bound each Pub/Sub RPC and Kubernetes API request
• 496f817 feat(pipeline): pause workers while the circuit is open instead of failing queued events
• 8f58238 fix(outputs): share the HTTP transport policy with AWS and OTLP and release connections on close
• a1e371c fix(outputs): retry every failure the destination's protocol does not mark as permanent
• d713562 fix: keep YAML parser text, secret file paths and broker text out of diagnostics
• bc809c6 fix(reload): let only watched files postpone a pending reload
• 53f923f fix: keep submitted values and file paths out of validation and API errors
• a66a8ff test(e2e): expect the classified Kafka TLS and AWS probe failure texts
• 115b908 refactor(outputs): report every delivery failure through one classified error type
• 12fb0f9 feat(pipeline): stop retrying deliveries that the destination rejects for good
• 34a9120 build(deps): replace archived mapstructure, copystructure and yaml.v3, update viper, fiber, franz-go, client_golang and fsnotify
• 63e94b3 fix(kafka): keep producing to a topic deleted and recreated under the same name
• 0d09cd7 fix(reload): compare output config symlink targets when the debounce fires
• 1427d2c fix(elasticsearch): name date-suffixed indices in UTC
• f6a9fb0 refactor: keep code comments short and limited to non-obvious facts
• 5caf31f fix(syslog): report the context deadline when the socket write deadline expires first
• 5a2bbdb feat(outputs): register S3, SQS, SNS, Pub/Sub, Syslog, SMTP, Redis, OTLP and PolicyReport
• a3c3c0b feat(outputs): add PolicyReport output on openreports.io
• ecfb038 feat(outputs): add OTLP output for traces, logs and metrics
• 532a8df feat(outputs): add Redis output with list, hash and stream storage
• 1b20d7d feat(outputs): add SMTP output
• e0c1fae feat(outputs): add Syslog output with RFC 5424 over UDP, TCP and TLS
• c5b09a8 feat(outputs): add Google Cloud Pub/Sub output
• 4903171 feat(outputs): add AWS SNS output
• 2500102 feat(outputs): add AWS SQS output
• 6bb9a10 feat(outputs): add AWS S3 output
• 6d57f72 feat(outputs): add shared AWS configuration, credentials and error classification
• 5aedaa5 build(deps): add AWS SDK, Pub/Sub, Redis, OpenTelemetry, Kubernetes and SMTP client libraries
• 211f4e8 fix(outputs): use a neutral host:port example in address validation errors
• 272388a test(outputs): share silent-destination helpers and derive the example check from the output registry
• e6b23eb feat(outputs): register Teams, Discord, Grafana OnCall, PagerDuty, Opsgenie, Datadog, Talon and CloudEvents
• 81cf508 feat(outputs): add CloudEvents output in HTTP binary mode
• 3f63d5e feat(outputs): add Falco Talon output
• 9f89b20 feat(outputs): add Datadog output for Events API v1 and v2
• 4c26474 feat(outputs): add Opsgenie output
• e7a0afb feat(outputs): add PagerDuty output for Events API v2
• 67310d5 feat(outputs): add Grafana OnCall output
• e97cf2e feat(outputs): add Discord output
• bc259bb feat(outputs): add Microsoft Teams output with Adaptive Cards for Workflows webhooks
• 2664557 feat(outputs): add shared helpers for region hosts, URL checks, byte truncation and test capture servers
• e2fc170 docs: describe current behavior only
• 0f63a49 fix(elasticsearch): start when the server is unreachable and create the index template before the first delivery
• b9cd5d8 refactor(outputs): share the validation of credentials sent in their own header
• 3c1bf33 fix(pipeline): keep output counters when an output is replaced by a reload or an API change
• 7c008b3 feat(pipeline): probe destinations concurrently and allow skipping the probe with runtime.health_check
• 0926bbc fix(pipeline): keep status counters consistent with the last delivery outcome
• 2730d25 feat(metrics): add output fields as labels of the event counter with metrics.extra_labels
• f892b96 build: drop the v3 suffix from workflows, release config, Dockerfile and make targets
• 6440fc6 docs: add install, configuration, outputs, migration and known limits for v3
• 173b293 fix(reload): reload on Kubernetes ConfigMap updates and make watcher tests deterministic
• d4fc1f0 fix(kafka): return from the health check when its context ends on a silent broker
• 23c5b9b test(hack): fail when a publishing job loses its repository guard
• d62c054 test(e2e): cover startup health failures and fail fast when the process exits
• 1649469 feat(ui): show the warning of a degraded output
• 05096f1 fix(pipeline): close drivers in parallel within the shutdown deadline
• fe8ca94 feat(pipeline)!: check destinations at startup and report degraded delivery as a warning
• 83dda9a fix(outputs): fix template, shard default, acks and label defects found end to end
• a0634d6 test(e2e): cover every output end to end in CI against real servers
• 088d5bd feat(api)!: disable configuration writes unless api.allow_writes is set
• 2635205 test(e2e): add binary harness, webhook end-to-end tests and Elasticsearch TLS cases
• 6427b8b fix(kafka): bound delivery time, flush on close and count async failures
• 4c9417f test(elasticsearch): run live delivery and auth tests against supported servers
• 1871527 fix(elasticsearch): report failed bulk items and retry without duplicates
• 66f7e6d feat!: remove v2 from master and publish v3 from falcosecurity
• 04eb434 feat: Falcosidekick v3 replaces v2 on master
• 065486d fix(outputs): close the SMTP connection after each message
• c9f2e44 fix(outputs): report GCP Cloud Functions and AWS Security Lake metrics under their own names
• 1e9aa65 docs(OWNERS): add c2ndev as approver
• 3a1bcdc fix(outputs): sanitize Loki label names built from output fields
• ab9afbe chore: disable origin detection for StatsD and DogStatsD clients
• 94ad757 chore: revert formatting
• a268ed2 chore: upgrade datadog-go to v5
• a977946 fix(outputs): log the right error for 500 and 502 responses
• 4b4ba21 fix(config): register viper defaults for env vars that were ignored
• b30e93b Do not assert output_fields values are strings
• 40260d3 fix(outputs): escape special characters in the InfluxDB line protocol payload
• 9264f0c fix(handlers): skip outputs whose client was not created
• 39218ef fix(config): separate default alertmanager drop event thresholds with commas
• 3069548 build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6
• 6fb23a6 build(deps): bump the gomod group across 1 directory with 3 updates
• 73b91da build(deps): bump the actions group across 1 directory with 6 updates
• 3b64728 fix: fail on CA cert files with no valid PEM certificates