My first merged contribution to Falco
Fixing a reliability bug in the OVH audit-log plugin, and what I learned getting a patch through CNCF maintainers.
Falco can read Kubernetes audit events through plugins. We run on OVH, so we use the k8saudit-ovh plugin, which receives audit logs from OVHcloud’s managed Kubernetes over a WebSocket. It is the kind of component you rely on and forget, until it silently stops delivering.
The problem
A detection pipeline is only as good as its input. If the connection drops and the plugin does not come back, Falco keeps running and looks healthy while receiving nothing. That is worse than a crash, because nothing alerts you.
The fix
Three focused changes in the plugin:
- a proper reconnection loop for the WebSocket,
- a retry when a connection attempt fails,
- better handling of JSON errors, so a malformed message does not take the stream down.
It was reviewed by the Falco maintainers, merged into falcosecurity/plugins (pull request #1270), and released as v0.4.1.
What helped
- Keep the patch small and about one thing. Reviewers can say yes quickly.
- Explain the failure, not just the diff. The description should let someone who has never seen your cluster understand why it matters.
- Follow the project’s rules. Falco projects expect signed-off commits (DCO), so use
git commit -s. - Treat review as part of the work. The feedback made the change better.
Why it was worth it
Beyond the satisfaction, there is a practical reason: I no longer carry a private patch. Every Falco user on OVH gets the fix, and I get to upgrade normally.
If you run something open source in production and you have ever worked around a bug, consider sending the fix upstream.