Policy Report Creation Error: "<nil>" namespace not found

[gsingh737]

Describe the bug

When Falcosidekick attempts to create Policy Reports, it encounters errors indicating that the namespace is not found, particularly when dealing with resources that might not be associated with a Kubernetes namespace, such as node OS-related events.

2024/03/01 18:10:15 [INFO]  : PolicyReport - Policy Report falco-policy-report-78d6f447 in namespace falco has been updated
2024/03/01 18:10:17 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:17 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:18 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:18 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:18 [INFO]  : Teams - Post OK (200)
2024/03/01 18:10:18 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:18 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:19 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:19 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:19 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:19 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:19 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:20 [ERROR] : PolicyReport - Can't create Policy Report namespaces "<nil>" not found in namespace <nil>
2024/03/01 18:10:20 [INFO]  : Teams - Post OK (200)

How to reproduce it

The issue occurs during the Policy Report generation process, particularly when events not associated with a Kubernetes resource (like node OS events) are processed. Exact reproduction steps are unclear and need further investigation.

Expected behaviour

Falcosidekick should handle cases where no specific Kubernetes namespace is associated with an event more gracefully. If no namespace can be identified, it could default to creating these policy reports in the Falco namespace or handle the error without repeatedly attempting to create a report.

Possible solution
A potential solution could involve checking if the namespace is nil and, if so, assigning a default namespace or skipping the report generation with an appropriate log message that indicates the action taken.

Screenshots

Environment

• Falco version:
  • helm chart version: 4.2.2
  • app version: 0.37.1
• Falcosidekick version:
• helm chart version: 0.7.11
• app version: 2.28.0
• Installation method: Kubernetes, Helm

Additional context
This issue seems to arise when Falcosidekick processes events that do not map directly to a Kubernetes resource. Improving error handling for such cases could enhance Falcosidekick's robustness and prevent log flooding with error messages.

[Issif]

This issue can linked with the #803, I will work on both at the same time.

[Issif]

Will be fixed in the upcoming 2.29