Add Azure Blob and ADLS support by ddl-ebrown · Pull Request #1279 · falcosecurity/falcosidekick

ddl-ebrown · 2025-11-18T17:57:35Z

First take on adding Azure Blob and ADLS Gen 2 write support as backends for sidekick. We're testing this internally right now to make sure everything works as expected, since there are no tests in this repo that could properly vet things.

What type of PR is this?

/kind feature

/area outputs

What this PR does / why we need it:

Azure supports two different types of blob storage:
- Blob
- ADLS Gen2
The setup and configuration of these alternatives varies, as do the Azure SDKs used to access them.

Provide support for both of these options to sidekick

Which issue(s) this PR fixes:

Fixes # 1209

Special notes for your reviewer:

poiana · 2025-11-18T17:57:39Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ddl-ebrown
Once this PR has been reviewed and has the lgtm label, please assign fjogeleit for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

- Azure supports two different types of blob storage: * Blob * ADLS Gen2 - The setup and configuration of these alternatives varies, as do the Azure SDKs used to access them. Provide support for both of these options to sidekick Signed-off-by: ddl-ebrown <ethan.brown@dominodatalab.com>

poiana · 2026-02-16T22:24:28Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

ddl-ebrown · 2026-02-16T23:48:01Z

/remove-lifecycle stale

leogr

Hi @ddl-ebrown

Thanks for this PR and sorry for the long delay.

I reviewed this PR and found some issues (see my suggestions below).

Moreover, every output has its defaults set via v.SetDefault(...) and its MinimumPriority validated via checkPriority() in config.go.

This is missing for Blob/ADLS configs.

You should add something like the following near the other Azure defaults:

  v.SetDefault("Azure.Blob.Account", "")
  v.SetDefault("Azure.Blob.Prefix", "falco")
  v.SetDefault("Azure.Blob.Container", "")
  v.SetDefault("Azure.Blob.MinimumPriority", "")

  v.SetDefault("Azure.ADLS.Account", "")
  v.SetDefault("Azure.ADLS.Prefix", "falco")
  v.SetDefault("Azure.ADLS.Container", "")
  v.SetDefault("Azure.ADLS.MinimumPriority", "")

And validation near the other checkPriority calls:

  c.Azure.Blob.MinimumPriority = checkPriority(c.Azure.Blob.MinimumPriority)
  c.Azure.ADLS.MinimumPriority = checkPriority(c.Azure.ADLS.MinimumPriority)

leogr · 2026-02-27T09:37:45Z

outputs/azure.go

+	if err != nil {
+		c.setBlobErrorMetrics()
+		utils.Log(utils.ErrorLvl, c.OutputType+" Blob",
+			fmt.Sprintf("Error with acccount %s: %v", serviceURL, err))


Suggested change

fmt.Sprintf("Error with acccount %s: %v", serviceURL, err))

fmt.Sprintf("Error with account %s: %v", serviceURL, err))

leogr · 2026-02-27T09:40:15Z

outputs/azure.go

 		attribute.String("status", Error)).Inc()
 }
+
+func (c *Client) UploadBlob(falcopayload types.FalcoPayload) {


Every output function in the codebase starts by incrementing the Total counter (e.g., EventHubPost at line 37 does c.Stats.AzureEventHub.Add(Total, 1)). Please add at the top of the function: c.Stats.AzureBlob.Add(Total, 1)

Same for UploadADLS: c.Stats.AzureADLS.Add(Total, 1)

leogr · 2026-02-27T09:41:29Z

outputs/azure.go

+		prefix = c.Config.Azure.Blob.Prefix
+	}
+
+	serviceURL := fmt.Sprintf("https://%s.dfs.core.windows.net/", c.Config.Azure.Blob.Account)


Shouldn't it be https://%s.blob.core.windows.net/ ?

leogr · 2026-02-27T09:42:52Z

outputs/azure.go

+
+	// upload the file to the specified container with the specified blob name
+	// TODO: should any part of the response be validated here? aws s3 client performs a few checks
+	_, err = client.UploadStream(context.TODO(), c.Config.Azure.Blob.Container, key, bytes.NewReader(f), nil)


Without a timeout, a hanging upload will block the goroutine indefinitely. Please add a timeout to this and UploadADLS as well

leogr · 2026-02-27T09:45:09Z

outputs/azure.go

+		c.PromStats.Outputs.With(map[string]string{"destination": "azdatalake", "status": Error}).Inc()
+		c.OTLPMetrics.Outputs.With(attribute.String("destination", "azdatalake"),
+			attribute.String("status", Error)).Inc()
+		utils.Log(utils.ErrorLvl, c.OutputType+" S3", err.Error())


Suggested change

utils.Log(utils.ErrorLvl, c.OutputType+" S3", err.Error())

utils.Log(utils.ErrorLvl, c.OutputType+" Blob", err.Error())

leogr · 2026-02-27T09:47:22Z

outputs/azure.go

+	}
+
+	go c.CountMetric("outputs", 1, []string{"output:azblob", "status:ok"})
+	c.PromStats.Outputs.With(map[string]string{"destination": "azblob", "status": "ok"}).Inc()


Suggested change

c.PromStats.Outputs.With(map[string]string{"destination": "azblob", "status": "ok"}).Inc()

c.PromStats.Outputs.With(map[string]string{"destination": "azblob", "status": OK}).Inc()

leogr · 2026-02-27T09:47:41Z

outputs/azure.go

+	if err != nil {
+		c.setADLSErrorMetrics()
+		utils.Log(utils.ErrorLvl, c.OutputType+" ADLS Gen2 Blob",
+			fmt.Sprintf("Error with acccount %s: %v", serviceURL, err))


Suggested change

fmt.Sprintf("Error with acccount %s: %v", serviceURL, err))

fmt.Sprintf("Error with account %s: %v", serviceURL, err))

leogr · 2026-02-27T09:48:27Z

outputs/azure.go

+	}
+
+	go c.CountMetric("outputs", 1, []string{"output:azdatalake", "status:ok"})
+	c.PromStats.Outputs.With(map[string]string{"destination": "azdatalake", "status": "ok"}).Inc()


Suggested change

c.PromStats.Outputs.With(map[string]string{"destination": "azdatalake", "status": "ok"}).Inc()

c.PromStats.Outputs.With(map[string]string{"destination": "azdatalake", "status": OK}).Inc()

leogr · 2026-02-27T09:50:12Z

handlers.go

 		go azureClient.EventHubPost(falcopayload)
 	}

+	if config.Azure.Blob.Container != "" && (falcopayload.Priority >= types.Priority(config.Azure.Blob.MinimumPriority) || falcopayload.Rule == testRule) {


The azureClient is only created in main.go when config.Azure.EventHub.Name != "".

If a user configures only Blob or only ADLS (without EventHub), azureClient will be nil, and these lines will panic with a nil pointer dereference.

The initialization in main.go needs to be updated so azureClient is also created when config.Azure.Blob.Container != "" or config.Azure.ADLS.Container != "". See how awsClient is created when any AWS sub-service is configured.

Also, EnabledOutputs needs to be appended for each enabled sub-service (e.g., "AzureBlob", "AzureADLS")

leogr · 2026-02-27T09:51:06Z

types/types.go

+	AzureBlob         *expvar.Map
+	AzureADLS         *expvar.Map


AzureBlob and AzureADLS should be initialized in getInitStats() in stats.go

poiana added kind/feature New feature or request dco-signoff: no labels Nov 18, 2025

poiana added the area/outputs label Nov 18, 2025

poiana requested review from Issif and leogr November 18, 2025 17:57

poiana added the size/L label Nov 18, 2025

ddl-ebrown force-pushed the azure-blob-alds-support-upstream branch from 4da5fd0 to 6b9a0d0 Compare November 18, 2025 19:31

poiana added dco-signoff: yes and removed dco-signoff: no labels Nov 18, 2025

poiana added the lifecycle/stale label Feb 16, 2026

leogr reviewed Feb 27, 2026

View reviewed changes

	fmt.Sprintf("Error with acccount %s: %v", serviceURL, err))
	fmt.Sprintf("Error with account %s: %v", serviceURL, err))

	utils.Log(utils.ErrorLvl, c.OutputType+" S3", err.Error())
	utils.Log(utils.ErrorLvl, c.OutputType+" Blob", err.Error())

	c.PromStats.Outputs.With(map[string]string{"destination": "azblob", "status": "ok"}).Inc()
	c.PromStats.Outputs.With(map[string]string{"destination": "azblob", "status": OK}).Inc()

Conversation

ddl-ebrown commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

poiana commented Nov 18, 2025

Uh oh!

poiana commented Feb 16, 2026

Uh oh!

ddl-ebrown commented Feb 16, 2026

Uh oh!

leogr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ddl-ebrown commented Nov 18, 2025 •

edited

Loading