Support reading events from Kafka

.github/workflows/reusable_build_packages.yaml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       matrix:
         arch: [x86_64, aarch64]
-    container: golang:1.21
+    container: golang:1.22
     steps:
       - name: Install deps
         run: |

OWNERS

@@ -6,4 +6,3 @@ emeritus_approvers:
   - ldegio
   - leodido
   - fntlnz
-

plugins/kafka/Makefile

@@ -0,0 +1,19 @@
+SHELL=/bin/bash -o pipefail
+GO ?= go
+
+NAME := kafka
+OUTPUT := lib$(NAME).so
+
+ifeq ($(DEBUG), 1)
+    GODEBUGFLAGS= GODEBUG=cgocheck=1
+else
+    GODEBUGFLAGS= GODEBUG=cgocheck=0
+endif
+
+all: $(OUTPUT)
+
+clean:
+	@rm -f $(OUTPUT)
+
+$(OUTPUT):
+	@$(GODEBUGFLAGS) $(GO) build -buildmode=c-shared -o $(OUTPUT) ./plugin

plugins/kafka/OWNERS

@@ -0,0 +1,2 @@
+reviewers:
+  - hmadison

plugins/kafka/README.md

@@ -0,0 +1,57 @@
+# Kafka Events Plugin
+
+This repository contains the `kafka` plugin for `Falco`.
+
+# Event Source
+
+The event source for `kafka` events is `kafka`.
+
+# Supported Fields
+
+This plugin does not provide field extraction.
+
+# Development
+## Requirements
+
+You need:
+* `Go` >= 1.22.2
+
+## Build
+
+```shell
+make
+```
+
+# Settings
+
+Only `init` accepts settings:
+
+* `brokers`: The list of Kafka brokers to consume messages from.
+* `groupId`: The consumer group identifier.
+* `topics`: The topics to consume from.
+* `tlsConfig`: Configuration for TLS encryption.
+
+# Configurations
+
+* `falco.yaml`
+
+  ```yaml
+  plugins:
+    - name: kafka
+      library_path: /usr/share/falco/plugins/libkafka.so
+      init_config:
+        init_config: |
+          {
+            "brokers": ["host.docker.internal:9094"],
+            "topics": ["example2"],
+            "groupId": "example1",
+            "tlsConfig": {
+              "caCertPath": "/mnt/certs/ca.pem",
+              "userCertPath": "/mnt/certs/user.pem",
+              "userKeyPath": "/mnt/certs/key.pem"
+            }
+          }
+      open_params: ''
+
+  load_plugins: [kafka]
+  ```

plugins/kafka/go.mod

@@ -0,0 +1,64 @@
+module github.com/falcosecurity/plugins/plugins/kafka
+
+go 1.22.2
+
+require (
+	github.com/alecthomas/jsonschema v0.0.0-20220216202328-9eeeec9d044b
+	github.com/falcosecurity/plugin-sdk-go v0.7.3
+	github.com/segmentio/kafka-go v0.4.47
+	github.com/testcontainers/testcontainers-go/modules/kafka v0.30.0
+)
+
+require (
+	dario.cat/mergo v1.0.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/Microsoft/hcsshim v0.11.4 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/containerd/containerd v1.7.12 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/cpuguy83/dockercfg v0.3.1 // indirect
+	github.com/distribution/reference v0.5.0 // indirect
+	github.com/docker/docker v25.0.5+incompatible // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-ole/go-ole v1.2.6 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
+	github.com/klauspost/compress v1.16.7 // indirect
+	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/magiconair/properties v1.8.7 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/sys/sequential v0.5.0 // indirect
+	github.com/moby/sys/user v0.1.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/pierrec/lz4/v4 v4.1.18 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
+	github.com/shirou/gopsutil/v3 v3.23.12 // indirect
+	github.com/shoenig/go-m1cpu v0.1.6 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/testcontainers/testcontainers-go v0.30.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.12 // indirect
+	github.com/tklauser/numcpus v0.6.1 // indirect
+	github.com/yusufpapurcu/wmi v1.2.3 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
+	go.opentelemetry.io/otel v1.24.0 // indirect
+	go.opentelemetry.io/otel/metric v1.24.0 // indirect
+	go.opentelemetry.io/otel/trace v1.24.0 // indirect
+	golang.org/x/exp v0.0.0-20230510235704-dd950f8aeaea // indirect
+	golang.org/x/mod v0.16.0 // indirect
+	golang.org/x/sys v0.16.0 // indirect
+	golang.org/x/tools v0.13.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
+	google.golang.org/grpc v1.58.3 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
+)