How to produce Reports and ClusterReports

[christianhuth]

What to document

According to the docs of OpenReports Falco is a producer for the Report and ClusterReport CRs. But I cannot find a way to configure Falco Sidekick to produce these CRs - only to produce the deprecated PolicyReport and ClusterPolicyReport CRs.

[Issif]

Falcosidekick has integrated PolicyReport as output a long time ago, they became OpenReports since and just kept the name in the list. The output requires an update for sure.

[AkashKumar7902]

I’d like to work on this. I propose migrating the existing policyreport output to OpenReports v0.2.1 Report/ClusterReport, while preserving its configuration and event mapping. I’ll add client tests, update the documentation, and validate it with a disposable Kind cluster. Please let me know if legacy dual-resource support is expected instead of direct replacement.

[AkashKumar7902]

One cross-repository dependency surfaced during the code trace: the current falcosecurity/charts Falcosidekick ClusterRole grants only wgpolicyk8s.io access to policyreports/clusterpolicyreports. A direct OpenReports replacement therefore also needs chart RBAC for openreports.io reports/clusterreports before the next image is used with the standard Helm service account. I plan to keep the source change focused, preserve the existing policyreport configuration/object names, and call out the required companion chart update in the draft PR. Please let me know if you prefer transitional dual-API support instead.

[Issif]

I think we can have both, keep the policyReport as is (just add the mention "Deprecated" in the docs, README and config example, and add a new output OpenReport. Wdyt?

[AkashKumar7902]

That makes sense. I will keep the existing policyreport output and its wgpolicyk8s.io behavior unchanged, mark it Deprecated in the README, config example, and output docs, and add an independent OpenReport output backed by OpenReports v0.2.1 Report/ClusterReport. I will expose it through openreport.* / OPENREPORT_*, use falco-report and falco-cluster-report for the new resources, and add behavior tests plus dual-output Kind validation. The source PR will also call out the companion chart values/RBAC needed for standard Helm deployment.

[christianhuth]

Thanks for your work @AkashKumar7902. Looks very promising! :)