Skip to content

chore(plugins/container): deprecate container probe fields#1265

Merged
poiana merged 4 commits intomainfrom
deprecate-container-probe-fields
Apr 16, 2026
Merged

chore(plugins/container): deprecate container probe fields#1265
poiana merged 4 commits intomainfrom
deprecate-container-probe-fields

Conversation

@leogr
Copy link
Copy Markdown
Member

@leogr leogr commented Mar 24, 2026

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area plugins

/area registry

/area build

/area documentation

What this PR does / why we need it:

Deprecate container.healthcheck, container.liveness_probe, container.readiness_probe and the related proc.is_container_* fields.

These fields rely on the kubectl.kubernetes.io/last-applied-configuration annotation, which is fragile and K8s-specific. Moreover, liveness/readiness probes never worked for CRI runtimes, they just were implemented only for Docker.

As discussed in #1218 (which I'm going to close in favor of this), the consensus is to deprecate them here and eventually move the functionality to the k8smeta plugin.

Which issue(s) this PR fixes:

Fixes #1017

Special notes for your reviewer:

The Falco deprecation policy for stable features technically requires 1 release cycle of functioning-while-deprecated before removal. However, I believe deprecating and making these fields no-op in the same release is acceptable here for the following reasons:

  • These fields have been broken on CRI runtimes (containerd, CRI-O) for 6+ years (only Docker ever returned real values)
  • No official Falco rules reference any of these 6 fields
  • There is existing precedent in this plugin: 20 k8s.* fields (k8s.rc.*, k8s.svc.*, k8s.rs.*, k8s.deployment.*) were deprecated the exact same way (deprecated + no-op in the same release)
  • User can still use the old plugin version if they need these fields

That said, if anyone disagrees with this approach, we can go with a strict two-phase deprecation instead: 0.7.0 = deprecated but still functional for Docker, next release = no-op. Let me know 🙏

@github-actions
Copy link
Copy Markdown

Rules files suggestions

@leogr
Copy link
Copy Markdown
Member Author

leogr commented Mar 26, 2026

/hold

Waiting for double-checking

Comment thread plugins/container/src/caps/extract/extract.cpp
@irozzo-1A irozzo-1A changed the title Deprecate container probe fields chore(plugins/container): deprecate container probe fields Mar 31, 2026
@leogr leogr force-pushed the deprecate-container-probe-fields branch from df5d393 to 567e1ce Compare April 15, 2026 16:04
leogr and others added 4 commits April 16, 2026 10:31
…hcheck, readiness, liveness)

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
…lated fields

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
…rd for consistency with switch cases

Co-authored-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
@leogr leogr force-pushed the deprecate-container-probe-fields branch from 567e1ce to 1e11ee1 Compare April 16, 2026 08:31
@leogr leogr requested a review from ekoops April 16, 2026 08:31
@github-actions
Copy link
Copy Markdown

Rules files suggestions

@ekoops
Copy link
Copy Markdown
Contributor

ekoops commented Apr 16, 2026

Deprecating and making these fields no-op in the same release is fine by me for the reasons you mentioned 💪

Copy link
Copy Markdown
Contributor

@ekoops ekoops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Copy Markdown
Contributor

poiana commented Apr 16, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@leogr
Copy link
Copy Markdown
Member Author

leogr commented Apr 16, 2026

/hold cancel

@poiana poiana merged commit 9028e8d into main Apr 16, 2026
24 checks passed
@poiana poiana deleted the deprecate-container-probe-fields branch April 16, 2026 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Container plugin: container.liveness_probe is always NONE

3 participants