feat(plugins/k8saudit): extract pod name

Signed-off-by: Sanja Kosier <[email protected]>
falcosecurity · May 21, 2024 · ab63a13 · ab63a13
1 parent 1a559ef
commit ab63a13
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/plugins/k8saudit/pkg/k8saudit/extract.go b/plugins/k8saudit/pkg/k8saudit/extract.go
@@ -172,6 +172,15 @@ func (e *Plugin) ExtractFromJSON(req sdk.ExtractRequest, jsonValue *fastjson.Val
 		return e.extractFromKeys(req, jsonValue, "objectRef", "resource")
 	case "ka.target.subresource":
 		return e.extractFromKeys(req, jsonValue, "objectRef", "subresource")
+	case "ka.target.pod.name":
+		resource := string(jsonValue.Get("objectRef").Get("resource").GetStringBytes())
+		if resource == "pods" {
+			subresource := string(jsonValue.Get("objectRef").Get("subresource").GetStringBytes())
+			if subresource == "" {
+				// if pods; return pod name
+				return e.extractFromKeys(req, jsonValue, "responseObject", "metadata", "name")
+			}
+		}
 	case "ka.req.binding.subjects":
 		return e.extractFromKeys(req, jsonValue, "requestObject", "subjects")
 	case "ka.req.binding.role":