Merge pull request #1 from n3wscott/broker

Use broker

README.md

@@ -23,7 +23,7 @@
 
 1. Go try to do bad things on that pod:
    ```
-   kubectl exec -it mysql-db-d5dc6b85d-77hrm -- bash -il  # Replace with the mysql pod name you have
+   kubectl exec -it $(kubectl get pods --selector="app=mysql-db" --output=jsonpath={.items..metadata.name}) -- bash -il
    ```
 
 ### Expected Results

config/drop/trigger.yaml

@@ -0,0 +1,16 @@
+apiVersion: eventing.knative.dev/v1
+kind: Trigger
+metadata:
+  name: drop
+  namespace: default
+spec:
+  broker: default
+  filter:
+    attributes:
+      source: falco.org
+      type: falco.rule.output.v1
+  subscriber:
+    ref:
+      apiVersion: serving.knative.dev/v1
+      kind: Service
+      name: drop

config/sidekick/sidekick.yaml

@@ -11,4 +11,5 @@ spec:
             - name: LISTENPORT
               value: "8080"
             - name: CLOUDEVENTS_ADDRESS
-              value: http://drop.default.svc.cluster.local
+              value: http://broker-ingress.knative-eventing.svc.cluster.local/default/default # this needs to be updated to your broker url
+

config/sidekick/sinkbinding.yaml

@@ -0,0 +1,15 @@
+apiVersion: sources.knative.dev/v1beta1
+kind: SinkBinding
+metadata:
+  name: falcosidekick
+  namespace: default
+spec:
+  subject:
+    apiVersion: serving.knative.dev/v1
+    kind: Service
+    name: falcosidekick
+  sink:
+    ref:
+      apiVersion: eventing.knative.dev/v1
+      kind: Broker
+      name: default

config/sockeye/trigger.yaml

@@ -0,0 +1,18 @@
+# The depends on having Sockeye installed: https://github.com/n3wscott/sockeye
+
+apiVersion: eventing.knative.dev/v1
+kind: Trigger
+metadata:
+  name: falco-sockeye
+  namespace: default
+spec:
+  broker: default
+  filter:
+    attributes:
+      source: falco.org
+      type: falco.rule.output.v1
+  subscriber:
+    ref:
+      apiVersion: serving.knative.dev/v1
+      kind: Service
+      name: sockeye

go.mod

@@ -6,6 +6,8 @@ require (
 	github.com/cloudevents/sdk-go/v2 v2.3.1
 	github.com/falcosecurity/falcosidekick v0.0.0-20201231190542-0403fbd02572
 	github.com/nats-io/nats-streaming-server v0.20.0 // indirect
-	k8s.io/apimachinery v0.18.12
+	k8s.io/apimachinery v0.20.1
 	knative.dev/pkg v0.0.0-20210107211936-93874f0ea7c0
 )
+
+replace github.com/falcosecurity/falcosidekick => ../../falcosecurity/falcosidekick