pipeline: inputs: add AegisBPF input plugin - #2670
Conversation
Documents the in_aegisbpf plugin (fluent/fluent-bit#12272): streams AegisBPF runtime-security (OCSF) events from the agent's control socket. Signed-off-by: Eren Arı <erenari27@gmail.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdded AegisBPF input-plugin documentation, linked it from the Data pipeline input table of contents, and updated validation and Vale exceptions for the new page. ChangesAegisBPF documentation
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to This PR adds documentation and navigation for the AegisBPF input plugin along with supporting documentation checks; no actionable merge-blocking risk remains beyond normal checks and review. Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
pipeline/inputs/aegisbpf.md (1)
38-58: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse named configuration tabs for these examples.
Wrap the YAML and classic examples in tabs titled
fluent-bit.yamlandfluent-bit.conf. This gives each example a filename and allows configuration validation to discover both examples.Proposed change
-```yaml +{% tabs %} +{% tab title="fluent-bit.yaml" %} pipeline: inputs: - name: aegisbpf socket_path: /var/run/aegisbpf/aegisbpf.sock outputs: - name: stdout match: '*' -``` +{% endtab %} -```ini +{% tab title="fluent-bit.conf" %} [INPUT] name aegisbpf socket_path /var/run/aegisbpf/aegisbpf.sock @@ name stdout match * -``` +{% endtab %} +{% endtabs %}Based on learnings:
scripts/test-config.shonly discovers tabs titledfluent-bit.yamlandfluent-bit.conf.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pipeline/inputs/aegisbpf.md` around lines 38 - 58, Wrap the YAML and classic configuration examples in the documentation with named tabs using the exact titles “fluent-bit.yaml” and “fluent-bit.conf”. Preserve each example’s existing content and remove the individual code fences as needed so the tab structure is valid and discoverable by scripts/test-config.sh.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@pipeline/inputs/aegisbpf.md`:
- Around line 38-58: Wrap the YAML and classic configuration examples in the
documentation with named tabs using the exact titles “fluent-bit.yaml” and
“fluent-bit.conf”. Preserve each example’s existing content and remove the
individual code fences as needed so the tab structure is valid and discoverable
by scripts/test-config.sh.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d58270a8-17fd-4925-9635-9eb37c0c7835
📒 Files selected for processing (2)
SUMMARY.mdpipeline/inputs/aegisbpf.md
|
@eschabell hi can you look at it |
Docs + example config for streaming AegisBPF OCSF events into any Fluent Bit output via the native `aegisbpf` input plugin. Links the upstream plugin PR (fluent/fluent-bit#12272) and docs PR (fluent/fluent-bit-docs#2670), with a generic-input fallback until the plugin ships in a release. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
eschabell
added
waiting-on-code-merge
waiting-on-review
Unwrap hard line breaks, spell out BPF, LSM, and OCSF on first use, sort the parameter table, and note the plugin is Linux only. Wrap the config examples in GitBook tabs so they render as a tabbed pair and are picked up by the example validation, using the repo conventions of a text fence, 2-space indentation, and Title_Case keys for the classic config. Suppress example validation for the page since the plugin is not in the released container image used for validation yet, and add AegisBPF and Cybersecurity to the Vale exception lists. Signed-off-by: Eric D. Schabell <eric@schabell.org>
|
Thanks for the review and the cleanup, @eschabell , much appreciated. Agreed on gating the merge behind the code PR (fluent/fluent-bit#12272); I'll keep this in sync if anything changes there. |
Documents the
aegisbpfinput plugin proposed in fluent/fluent-bit#12272.Adds
pipeline/inputs/aegisbpf.md(configuration parameters, prerequisites, CLI + YAML + classic config examples) and the nav entry inSUMMARY.md.The plugin streams runtime-security events from a co-located AegisBPF BPF-LSM agent over its Unix control socket (
GET /events→ newline-delimited OCSF JSON) into the pipeline.Summary by CodeRabbit