Handle truncated Kubernetes audit logs

[Haihan-Jiang]

Fixes #193.

Summary:

• read the GKE audit log audit.k8s.io/truncated label into the Kubernetes audit field set
• skip manifest reconstruction for truncated audit entries so partial payloads are not shown as full resource revisions
• keep the previous known manifest revision available for later non-truncated events

Tests:

• go test ./pkg/task/inspection/googlecloudlogk8saudit/contract ./pkg/task/inspection/commonlogk8saudit/contract ./pkg/task/inspection/commonlogk8saudit/impl

[gemini-code-assist]

Code Review

This pull request introduces support for handling truncated Kubernetes audit logs. It adds a Truncated boolean field to the K8sAuditLogFieldSet struct and updates the GCP audit log reader to parse the audit.k8s.io/truncated label. The manifest generator is updated to return a placeholder message and avoid advancing the resource revision when a log is truncated. Relevant unit tests have been added to verify this behavior. There are no review comments to address.

[Haihan-Jiang]

This is ready for maintainer review from my side. The remaining github-deploy-ondemand check appears to require project-side approval/run permissions; could someone take a look or trigger it when convenient?

[kyasbal]

I'm sorry to reply late. I should have write our roadmap somewhere,but this part would be rewritten a lot in the next upcoming big release concerning a file format improvement to make KHI much more scalable.

I would also implement this with the similar codes as you did if I would implement the feature on the current main implementation. But I would like to consider the best shape after the file format change being placed. It will take 2 weeks to a month.

Could we hold this until the change?

[Haihan-Jiang]

Thanks for explaining the roadmap. Holding this until the file format change lands sounds good to me. If the new shape needs a different implementation, I can revisit this PR or open a smaller follow-up after that work is in place.

[kyasbal]

Our new version 0.56.0 is released. We no longer need to hold this PR. Are you still willing to contribute this feature?

Unfortunately, there would be a lot of efforts needed to this PR works. I saw this PR just added truncated field in the fieldset struct. However, the parser result would be differ if a subsequent log is truncated within the series of audit logs for a single resource. The main problem we need to address the truncated issue is that. I'm actually estimating this is a bit complex issue.