feat(ae): reattribute DNS via kubescape process tree (fixes #80) - #81

Open

entlein wants to merge 60 commits into

k8sstormcenter:feat/ae-query-runnerfrom

entlein:feat/ae-dns-ppid-attribution

Commits on Jun 21, 2026

adaptive_export: production AE — streaming export + write-integrity

Entlein
authored and
entlein
committed
adaptive_export: ADAPTIVE_PASSTHROUGH firehose loop
entlein
committed
ci: dx-image workflow — build + publish dx-daemon to ghcr
entlein
committed
Revert ci: dx-image workflow — wrong repo
entlein
committed
adaptive_export: unit-normalize trigger watermark cursor + load-test affordances

Entlein
authored and
entlein
committed
e2e_test/adaptive_export_loadtest: AE fixture-isolation load-test harness

Entlein
authored and
entlein
committed
e2e_test/adaptive_export_loadtest: document AE implied contracts (C1-C14) + diagrams

Entlein
authored and
entlein
committed
adaptive_export_loadtest: C15 write-duration contract + DX-steering diagram; gen sustained-DNS mode

Entlein
authored and
entlein
committed
adaptive_export/trigger: update test SQL substrings for multiIf normalisation
entlein
committed
adaptive_export_loadtest: exp_control uses real now_s event_time (no future-stamp watermark poison)

Entlein
authored and
entlein
committed
adaptive_export: ADAPTIVE_RECONCILE per-pull write-fidelity instrument

Entlein
authored and
entlein
committed
harness: exp_pipeline_reconcile — skip empty-key rows (0 rows != LOSS 1)

Entlein
authored and
entlein
committed
harness: log4shell_fire.sh — reliably fire + restart the log4j-chain log4shell

Entlein
authored and
entlein
committed
harness: log4shell_fire.sh — detection-signal framing (Cyber Verification)

Entlein
authored and
entlein
committed
adaptive_export(passthrough): precompiled + concurrent firehose, drop http2

Entlein
authored and
entlein
committed
adaptive_export: bazel BUILD deps for internal/reconcile + pxl compile.go

Entlein
authored and
entlein
committed
adaptive_export(pxl): raise Pixie 10k result cap via #px:set query flag

Entlein
authored and
entlein
committed
adaptive_export/sink: content_type silent-drop contract suite
entlein
committed
adaptive_export_loadtest: DX-steered-vs-ALL datavolume reduction harness

Entlein
authored and
entlein
committed
adaptive_export_loadtest: deep AE NFR benchmark harness

Entlein
authored and
entlein
committed
adaptive_export_loadtest: fix DX-reduction dead-arm (clear stale steering + live-pod guard)

Entlein
authored and
entlein
committed
nfr harness: fix lag (dateDiff) + drop racy broker-pct completeness

Entlein
authored and
entlein
committed
dx-reduction harness: report ROWS reduction (primary) + bytes (secondary)

Entlein
authored and
entlein
committed
ae deployment: add memory limit (1Gi) + raise cpu limit to 1 core

Entlein
authored and
entlein
committed
ae bootstrap: separate the secret from the re-applied infra bundle

Entlein
authored and
entlein
committed
dx-reduction harness: fire BOTH attack stages so DX steers the backend

Entlein
authored and
entlein
committed
adaptive_export: rename whitelist→allowlist across streaming path + add DX-steering diagnostics

Entlein
authored and
entlein
committed
ae(clickhouse): create forensic_db.dx_attack_graph at boot

Entlein
authored and
entlein
committed
ae(clickhouse): dx_attack_graph numeric cols Int64/Float64 (px-readable)

Entlein
authored and
entlein
committed
adaptive_export(streaming): add #px:set max_output_rows cap flag to scanner buildPxL

Entlein
authored and
entlein
committed
ae(clickhouse): create dx_attack_graph_malicious view at boot

authored and
entlein
committed
ae(control): /dx/attack_graph ingest endpoint -> ClickHouse

authored and
entlein
committed
adaptive_export: convention pass — consolidate CH HTTP, drop dead code, fix stale tests
entlein
committed
adaptive_export: restore executable bits on harness scripts (post-header)
entlein
committed
adaptive_export: lint pass + restore @px load prefix in cmd/BUILD.bazel
entlein
committed
adaptive_export: address user review #2 #4 #6 + 4 outstanding CodeRabbit items
entlein
committed
test(harness): consolidate to one run-picture + e2e CI workflow

pixie-agent
authored and
entlein
committed
revert(bazel): drop stray buildifier attribute-reorder in stirling container_images BUILD

pixie-agent
authored and
entlein
committed
ci: fix run-genfiles + run-container-lint on PR 53
entlein
committed
ci: apply gazelle's actual kwarg order to stirling container_images
entlein
committed
ci: fix container-lint Errors on e2e workflow + new harness scripts
entlein
committed
ci: silence 6 SHELLCHECK Warnings to clear container-lint exit code
entlein
committed
feat(ae-control): bearer-JWT auth + input validation (CodeRabbit followup)
pixie-agent
committed
fix(ae): remaining CodeRabbit Majors (#53 followup)
pixie-agent
committed

Commits on Jun 22, 2026

fix(ae-trigger): escape a PollLimit-saturated watermark boundary (from #67)
pixie-agent
committed

Commits on Jun 23, 2026

Commits on Jun 24, 2026

Commits on Jun 28, 2026

terraform: drop fork IaC from PR 68 — belongs on main, not this PR
pixie-agent
committed
fork-infra: drop cockpit, .sops.yaml, e2e workflow from PR 68
pixie-agent
committed
feat(adaptive_export): wire the /query runner — dx OrderQuery → forensic capture (dx#93)

authored and
entlein
committed

Commits on Jul 2, 2026

refactor(ae): rename dx_attack_graph → dx_evidence_graph (malignant view)
pixie-agent
committed
feat(ae): add /dx/evidence_manifest ingest → forensic_db.dx_evidence_manifest
pixie-agent
committed

Commits on Jul 8, 2026

feat(ae): reattribute DNS via kubescape process tree (pixie#80)

Entlein
and
claude
committed