feat(alert-forwarder): replace Python with Go implementation by calghar · Pull Request #18 · dynatrace-oss/koney

calghar · 2025-07-11T23:55:28Z

Description

This PR replaces the Python alert-forwarder with a high-performance Go implementation.

Type of Change

Bug fix
[] New feature
Performance improvement
[] Breaking change
Documentation update

Motivation

The Python alert-forwarder works well but has some limitations:

High memory footprint for a simple service
Large container image increases deployment time
Runtime interpretation overhead
Prevents all components of Koney being in Go

The Go implementation addresses all these issues while maintaining 100% compatibility.

Changes

Replaced alert-forwarder/*.py with Go implementation
Added proper Go module structure with go.mod
Updated Dockerfile for multi-arch builds
Maintained identical API endpoints and behavior
Preserved all existing functionality

Testing

Tested on:

Kind cluster (Kubernetes 1.29)
M1 Mac (arm64)
Linux amd64 (CI)

Compatibility

✅ No breaking changes
✅ Same configuration (PORT env var)
✅ Same API endpoints
✅ Same JSON output format
✅ Same Kubernetes RBAC requirements

Checklist

Additional Notes

The Go implementation uses the official Kubernetes client-go library, providing better compatibility with future Kubernetes versions. The code structure follows Go best practices with clear separation of concerns.

Happy to make any adjustments based on review feedback.

dynatrace-cla-bot · 2025-07-11T23:55:33Z

All committers have signed the CLA.

blu3r4y

Thanks @f4r00q for the PR, looks like a great rewrite of the Python source. I worked through the code and made plenty of suggestions. Let me know if you find the time to integrate them, otherwise, I might also be able to take care of some of them.

blu3r4y · 2025-07-18T21:08:00Z

README.md

[ISSUE] Please don't delete README.md

Not sure how this got deleted

blu3r4y · 2025-07-18T21:08:58Z

alert-forwarder/Dockerfile

@@ -1,19 +1,32 @@
-FROM python:3.13-slim@sha256:21e39cf1815802d4c6f89a0d3a166cc67ce58f95b6d1639e68a394c99310d2e5
+# Copyright (c) 2025 Dynatrace LLC


[ISSUE] License header should only be added to source code files. Please remove it from the Dockerfile.

blu3r4y · 2025-07-18T21:11:11Z

alert-forwarder/Dockerfile

+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.

+FROM --platform=$BUILDPLATFORM golang:1.21-alpine AS builder


[Q] What is --platform=$BUILDPLATFORM doing? If this is useful, should we also add it to the main Dockerfile?

Its to enable easy cross-platform build. It would make sense to add it to the main file as well

blu3r4y · 2025-07-18T21:11:53Z

alert-forwarder/Dockerfile

+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.

+FROM --platform=$BUILDPLATFORM golang:1.21-alpine AS builder


[ISSUE] Please use Go 1.24 as this is the most recent version

blu3r4y · 2025-07-18T21:13:32Z

alert-forwarder/Dockerfile

-# can be seen more easily (they are logged regardless)
-ENV UVICORN_LOG_LEVEL=error
-
+FROM alpine:latest


[Q] Could you use gcr.io/distroless/static:nonroot here?

blu3r4y · 2025-07-21T12:59:36Z

alert-forwarder/tetragon.go

+		functionName, _ := processKprobe["function_name"].(string)
+		fileAccessFns := []string{"security_file_permission", "security_mmap_file"}
+
+		for _, fn := range fileAccessFns {


[NIT] Those two lines (the for and the if) could be simplified to the following:

if slices.Contains(fileAccessFns, functionName) { trapType = TrapTypeFilesystemHoneytoken // ... }

blu3r4y · 2025-07-21T13:13:45Z

alert-forwarder/tetragon.go

+		for _, fn := range fileAccessFns {
+			if functionName == fn {
+				trapType = TrapTypeFilesystemHoneytoken
+				if args, ok := processKprobe["args"].([]interface{}); ok && len(args) > 0 {


[NIT] That piece of code looks very hard to read - actually, also, in the Python version. However, in my recent PR I tried to extract this field resolution for honeytokens into their own method. Could you try to do the same for the Golang version here? For reference: https://github.com/dynatrace-oss/koney/blob/feat/TR-4934-dynatrace-ingest/alert-forwarder/forwarder/tetragon.py#L121

blu3r4y · 2025-07-21T13:14:50Z

alert-forwarder/tetragon.go

+
+	timestamp, _ := event["time"].(string)
+	if timestamp == "" {
+		timestamp = time.Now().Format(time.RFC3339)


[ISSUE] No, please not default to the current time, let the field be empty if we cannot resolve it.

blu3r4y · 2025-07-21T13:23:37Z

alert-forwarder/tetragon.go

+func resolveDeceptionPolicyName(kubeClient *kubernetes.Clientset, tracingPolicyName string) (string, error) {
+	ctx := context.Background()
+
+	// Create a dynamic client for the custom resource


[ISSUE] Hmm, well, if we add github.com/cilium/tetragon as a dependency in go.mod we could use the typed client. If this code is integrated with the main controller, we would already have it.

Anyways, maybe we want to still stick with the untyped client here. But then, I think we shouldn't initialize the client here in tetragon.go but rather in main.go, and then pass the dynamic client. Reason being that client initialization should be decoupled from using them, I dislike that tetragon.go is reading the cluster config again and creating a new client here.

blu3r4y · 2025-07-21T13:27:48Z

alert-forwarder/tetragon.go

+}
+
+// Helper functions
+func getStringValue(m map[string]interface{}, key string) string {


[PRAISE] Useful stuff!

calghar · 2025-07-21T20:30:32Z

Thanks @f4r00q for the PR, looks like a great rewrite of the Python source. I worked through the code and made plenty of suggestions. Let me know if you find the time to integrate them, otherwise, I might also be able to take care of some of them.

I can take care of this. Give me a few days to get to it. 😊

feat(alert-forwarder): replace Python with Go implementation

b9ca9bc

calghar requested a review from blu3r4y as a code owner July 11, 2025 23:55

blu3r4y mentioned this pull request Jul 21, 2025

Redesign how both alerts and errors are emitted in the alerts container #21

Open

blu3r4y requested changes Jul 21, 2025

View reviewed changes

NO-ISSUE Addressed reviewer feedback

b3cb666

blu3r4y assigned calghar Aug 12, 2025

blu3r4y mentioned this pull request Dec 24, 2025

Migrate Kustomize templates to Helm chart [TR-5528] #39

Merged

		@@ -1,19 +1,32 @@
		FROM python:3.13-slim@sha256:21e39cf1815802d4c6f89a0d3a166cc67ce58f95b6d1639e68a394c99310d2e5
		# Copyright (c) 2025 Dynatrace LLC

Conversation

calghar commented Jul 11, 2025

Description

Type of Change

Motivation

Changes

Testing

Compatibility

Checklist

Additional Notes

Uh oh!

dynatrace-cla-bot commented Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

blu3r4y left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

calghar commented Jul 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dynatrace-cla-bot commented Jul 11, 2025 •

edited

Loading