feat(k8saudit): file watching

[RichardoC]

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area plugins

What this PR does / why we need it:
Add continuous file watching capability for audit logs using the
tail:// URL scheme. This allows monitoring files for new entries
and handles log rotation via inode detection and file truncation.

Which issue(s) this PR fixes:

Fixes #191

Special notes for your reviewer: Generated with Claude Code. Full transcript attached
claude-log.txt

[poiana]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: RichardoC
Once this PR has been reviewed and has the lgtm label, please assign leogr for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Rules files suggestions

rules

Comparing b4696a614148482909f4e483c2906685abfe2151 with latest tag plugins/k8saudit/v0.16.0

No changes detected

[irozzo-1A]

Hi @RichardoC, thanks for your contribution. I suggest using file instead of tail to have a more standard URI, and using an event based approach instead of polling.

[irozzo-1A]

Suggested change

	case "tail":
	case "file":

[irozzo-1A]

Suggested change

	The expected way of using the plugin with Falco is through a Webhook. File reading support can be used with Stratoshark or testing and development. The `tail://` scheme enables continuous file watching with log rotation support, useful for reading audit logs written to disk by the API server.
	The expected way of using the plugin with Falco is through a Webhook. File reading support can be used with Stratoshark or testing and development. The `file://` scheme enables continuous file watching with log rotation support, useful for reading audit logs written to disk by the API server.

[irozzo-1A]

Suggested change

	- `tail://<filepath>`: Opens an event stream by continuously watching a file for new audit events, similar to `tail -f`. Handles log rotation (inode changes) and file truncation automatically. Example: `tail:///var/log/kube-apiserver/audit.log`
	- `file://<filepath>`: Opens an event stream by continuously watching a file for new audit events, similar to `tail -f`. Handles log rotation (inode changes) and file truncation automatically. Example: `file:///var/log/kube-apiserver/audit.log`

[irozzo-1A]

We can avoid this if we use an event based approach e.g. inotify

[irozzo-1A]

Polling and opening the file each time is not very efficient way of tailing the file content, what about using fsnotify. You can take inspiration from the snippet below:

package main

import (
	"fmt"
	"io"
	"os"

	"github.com/fsnotify/fsnotify"
)

func main() {
	filePath := "test.log"
	
	watcher, _ := fsnotify.NewWatcher()
	defer watcher.Close()

	// 1. Open the file and seek to the end
	file, _ := os.Open(filePath)
	file.Seek(0, io.SeekEnd)

	// 2. Start watching the file for changes
	watcher.Add(filePath)

	fmt.Println("Tailing test.log... (supports rotation/truncation)")

	for {
		select {
		case event, ok := <-watcher.Events:
			if !ok {
				return
			}

			// Handle Write: New data added
			if event.Op&fsnotify.Write == fsnotify.Write {
				io.Copy(os.Stdout, file)
			}

			// Handle Rename/Remove: This is Log Rotation
			if event.Op&(fsnotify.Rename|fsnotify.Remove) == fsnotify.Remove || event.Op&fsnotify.Rename == fsnotify.Rename {
				fmt.Println("\n[File rotated, re-opening...]")
				file.Close()
				
				// Wait/Retry until the new file exists
				for {
					newFile, err := os.Open(filePath)
					if err == nil {
						file = newFile
						watcher.Add(filePath) // Re-watch the new file
						break
					}
                     // backoff
				}
			}

		case err, ok := <-watcher.Errors:
			if !ok {
				return
			}
			fmt.Println("Error:", err)
		}
	}
}

[RichardoC]

Hi @RichardoC, thanks for your contribution. I suggest using file instead of tail to have a more standard URI, and using an event based approach instead of polling.

Thank you for the thorough review @irozzo-1A , making those changes now

[RichardoC]

Claude log for the changes
Uploading claude-log-1.txt…

[RichardoC]

The cargo install issue in ci seems unrelated to my changes

[leogr]

Why // indirect? 🤔

This should be a direct dependency since it's explicitly imported in source.go

[leogr]

Since there's no filewatch package, why is this file here? 🤔