Improve -pk as needed by latest "Style Guide of Falco Rules"

[leogr]

Motivation

See falcosecurity/falco-website#1094 (review).

Feature

Change the -p behavior as follow:

• when only -pc 👉 container_id=%container.id container_image=%container.image.repository container_image_tag=%container.image.tag container_name=%container.name
• when -pk 👉 as above plus k8s_ns=%k8s.ns.name k8s_pod_name=%k8s.pod.name

Alternatives

🤔

Additional context

cc @falcosecurity/falco-maintainers

See falcosecurity/falco-website#1094

falco/userspace/falco/app/actions/init_falco_engine.cpp

Lines 23 to 58 in 743c7c4

	void configure_output_format(falco::app::state& s)
	{
	std::string output_format;
	bool replace_container_info = false;
	if(s.options.print_additional == "c" || s.options.print_additional == "container")
	{
	output_format = "container=%container.name (id=%container.id)";
	replace_container_info = true;
	}
	else if(s.options.print_additional == "cg" || s.options.print_additional == "container-gvisor")
	{
	output_format = "container=%container.name (id=%container.id) vpid=%proc.vpid vtid=%thread.vtid";
	replace_container_info = true;
	}
	else if(s.options.print_additional == "k" || s.options.print_additional == "kubernetes")
	{
	output_format = "k8s.ns=%k8s.ns.name k8s.pod=%k8s.pod.name container=%container.id";
	replace_container_info = true;
	}
	else if(s.options.print_additional == "kg" || s.options.print_additional == "kubernetes-gvisor")
	{
	output_format = "k8s.ns=%k8s.ns.name k8s.pod=%k8s.pod.name container=%container.id vpid=%proc.vpid vtid=%thread.vtid";
	replace_container_info = true;
	}
	else if(!s.options.print_additional.empty())
	{
	output_format = s.options.print_additional;
	replace_container_info = false;
	}
	if(!output_format.empty())
	{
	s.engine->set_extra(output_format, replace_container_info);
	}
	}

falco/userspace/engine/rule_loader_compiler.cpp

Lines 302 to 316 in 743c7c4

	static void apply_output_substitutions(
	rule_loader::configuration& cfg,
	std::string& out)
	{
	if (out.find(s_container_info_fmt) != std::string::npos)
	{
	if (cfg.replace_output_container_info)
	{
	out = replace(out, s_container_info_fmt, cfg.output_extra);
	return;
	}
	out = replace(out, s_container_info_fmt, s_default_extra_fmt);
	}
	out += cfg.output_extra.empty() ? "" : " " + cfg.output_extra;
	}

[incertum]

This is great, thank you!