fix(plugins/k8saudit-ovh): add WebSocket reconnect loop and improve resilience

[elprofessor-de]

Problem

When the LDP WebSocket connection drops (timeout, network blip, server-side close), the plugin logged "Will try to reconnect after 1s..." but actually exited the goroutine without reconnecting. This caused eventC to be closed permanently, and Falco stopped receiving Kubernetes audit events indefinitely — until the pod was manually restarted.

Changes

Reconnect loop: wrapped the dial + read loop in an outer for loop so the connection is re-established automatically after any failure
Dial retry: on initial connection failure, the plugin now retries instead of pushing the error to eventC and exiting
Ping failure handling: if writing a ping fails after a timeout, the inner loop now breaks to trigger a reconnection instead of continuing on a dead connection
JSON error handling: added proper error checking on both json.Unmarshal calls — malformed messages are now logged and skipped cleanly
Magic number removed: replaced the hardcoded [12:] slice (which assumed a fixed-length _appID) with a strings.SplitN on the "> " separator — prevents potential panics on short strings

Testing

Tested against an OVHcloud MKS cluster with intentional WebSocket disconnections — the plugin reconnects automatically and resumes event ingestion without restarting the Falco pod.

[poiana]

Welcome @elprofessor-de! It looks like this is your first PR to falcosecurity/plugins 🎉

[irozzo-1A]

Hey @elprofessor-de, thanks for your contribution. I have two preliminary comments:

1. You should sign-off your commits
2. Your fixed formatting on the go file, but this made your change hard to review. Would you mind keeping the actual fix and the formatting fix in distinct commits to make the review easier?

Thanks!

[elprofessor-de]

Done! I've split the commits and added the sign-off.
Let me know if anything else needs to be adjusted.

[irozzo-1A]

Thanks for your PR, I suggested a few changes to improve error handling

[ekoops]

I guessed you squashed together the commit you spllited 😄

[elprofessor-de]

Sorry about that!
I've re-split the commits — one for the fix and one for the CHANGELOG 🙏

[irozzo-1A]

Thanks @elprofessor-de for addressing the review comments, sorry for being picky but there are some formatting changes again in the diff, if you could keep the changes to the bare minimum it would be good for tracking.
I would address the formatting change in a dedicated commit or even better with a dedicated PR.
After this change for me it's ready to go.

[ekoops]

Yes... I guess it's IDE setting fault 😅

[irozzo-1A]

Yes... I guess it's IDE setting fault 😅

definitely, not @elprofessor-de fault, it's annoying to deal with not well formatted code. We have to enforce formatting check in the CI

[elprofessor-de]

Applied gofmt — the diff should now be clean. Let me know if anything else needs to be adjusted 🙏

[ekoops]

Thank you for updating also the changelog, but this should be automatically generated by issuing make changelog/k8saudit-ovh on the root folder of the project. Also, since you are updating the changelog, could you please also update the plugin version? The new version should be 0.4.1, since this is a non-breaking fix. You should update it also in plugins/k8saudit-ovh/plugin/main.go

[elprofessor-de]

Good to know about make changelog/k8saudit-ovh! I'll regenerate it properly and bump the version to 0.4.1 in main.go. 🙏

[scraly]

Thanks for the PR ♥️💪
About the new version, you can change it here: https://github.com/falcosecurity/plugins/blob/main/plugins/k8saudit-ovh/plugin/main.go#L32C2-L32C36

[elprofessor-de]

Done! Regenerated the CHANGELOG using make changelog/k8saudit-ovh and bumped the version to v0.4.1 in main.go. 🙏

[scraly]

Tested in a MKS cluster in 3AZ Paris, and it's OK 💪
Thanks :)

[poiana]

LGTM label has been added.

Details

Git tree hash: b1a3e1849f0965b2fe9f83f521fbe6e9225bd51f

[irozzo-1A]

/lgtm

[ekoops]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, elprofessor-de, irozzo-1A, scraly

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• plugins/k8saudit-ovh/OWNERS [ekoops,scraly]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment