Emit a warning when trying to set a non-existing config key

[leogr]

Motivation

Silently ignoring a non-existing config key in falco.yaml can hide problems and mislead users. A simple typo can make Falco completely ignore the value, which may be hard to spot.

For example:

stdout_output:
  enabled: false

vs.

stduot_output:
  enabled: true

(N.B. the typo in stduot_output)

Currently, Falco silently ignores the latter case.

Feature

Falco should emit a warning when the user sets a non-existent config key.

Alternatives

An alternative can be to emit an error and stop the Falco execution. Would this alternative be better? 🤔
On the other hand, a simple warning could help spot misconfiguration when upgrading to a new version without blocking the deployment.

Additional context

This idea came up while reviewing this PR #2413

[h4l0gen]

hey @leogr , i want to contribute on this issue, can you guide me to what changes required and how can i proceed in this. Thanks

[leogr]

hey @leogr , i want to contribute on this issue, can you guide me to what changes required and how can i proceed in this. Thanks

Hey @h4l0gen
Great! 🤩

I haven't looked into code details, but I guess that we should look for the existence of an option while parsing the YAML here 👇
https://github.com/falcosecurity/falco/blob/master/userspace/falco/configuration.cpp#L186

An alternative approach would be to create a YAML schema and validate the file before loading it (I wonder if it is worth keeping this approach).

@jasondellaluce any suggestion in this regard?

@h4l0gen let me know if this is ok for you. In case you plan to work on this, please /assign this issue to yourself, thank you!

[h4l0gen]

hey @leogr ,
it would be really great if you assign me this issue. am starting looking on code details and soon come up with required changes.

[h4l0gen]

/assign

[leogr]

Hey @h4l0gen

How is it going? :)

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale

[leogr]

I'd like to prioritize this tentatively for
/milestone 0.39.0