[TRACKING] Breaking changes in Falco 1.0.0

[Andreagit97]

This issue keeps track of all deprecated Falco features that will be removed in Falco 1.0.0:

• append in Falco rule is deprecated in favor of override (see update(rule_loader): deprecate the append flag in falco rules #2992)
• syntax like

  - rule: Write below etc
    enabled: false

  is deprecated in favor of override (see update(rule_loader): deprecate the append flag in falco rules #2992).

    - rule: Write below etc
      enabled: false
      override:
         enabled: replace

  Please note that the enabled key is only deprecated when used as an override! So a rule like this is perfectly legit:

  - rule: legit_rule
    desc: legit rule description
    condition: evt.type=open
    output: user=%user.name command=%proc.cmdline file=%fd.name
    priority: INFO
    enabled: false

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale

[FedeDP]

#3162 deprecated old rules_file config key in favor of new rules_files.