falcosecurity/falcoctl

Add support for more index hosting backends (e.g., GCS, S3, etc.)

Closed this issue · 2 comments

What would you like to be added:

Support for retrieving index files from storage backends using protocols other than plain HTTP/S. For example GCS or S3 storage for cloud native environments. Additionally support for authentication mechanisms for HTTP/S backends would also be helpful for private rule sets/plugins hosted via HTTP/S.

Why is this needed:

Currently index files can only be retrieved via HTTP/S (no authentication). This is useful for public rule sets, but private rule sets would require both some sort of authentication support and ideally support for different more cloud native storage backends.

#301 would be my suggested first step to implementing/making it easy for the community to add support for new index backend support.

Adding comment here as well for visibility
#301 (comment)

Thinking out loud here some potential future backends might be using HTTP/S as their protocol language but could require more complex requests (i.e., not only a simple GET request).
So instead of adding this URL scheme based approach adding a backend option to index configurations might be better. This could default to simple HTTP/S for backward compatibility and would probably more flexible.