Documentation Updates

- Add KubeArmorOperator docs
- Update FAQs
- Misc: Unused operator values removal

Signed-off-by: Rudraksh Pareek <rudraksh@accuknox.com>

getting-started/FAQ.md

@@ -8,9 +8,16 @@
 
 <details><summary><h4>I am applying a blocking policy but it is not blocking the action. What can I check?</h4></summary>
 
+### Checkout Platform Support
 Check `karmor probe` output and check whether `Container Security` is false. If it is false, the KubeArmor enforcement is not supported on that platform. You should check the [KubeArmor Support Matrix](support_matrix.ma) and if the platform is not listed there then raise a new issue or connect to kubearmor community of slack.
 
+### Checkout Default Posture
 If you are applying an Allow-based policies and expecting unknown actions to be blocked, please make sure to check the [default security posture](default_posture.md). The default security posture is set to Audit by default since KubeArmor v0.7.
+
+### Checkout Binary Path
+If the path in your process rule is not an absolute path but a symlink, policy enforcement won't work. This is because KubeArmor sees the actual executable path in events received from kernel space and is not aware about symlinks.
+
+So policy enforcement on symbolic links like `/usr/bin/python` doesn't work and one has to specify the path of the actual executable that they link to.
 </details>
 
 <details><summary><h4>How is KubeArmor different from PodSecurityPolicy/PodSecurityContext?</h4></summary>
@@ -62,13 +69,30 @@ The logs are also exportable in OpenTelemetry format using [kubearmor/OTel-recei
 
 </details>
 
-<details><summary><h4>How to visualize KubeArmor visibility logs</h4></summary>
+<details><summary><h4>How to visualize KubeArmor visibility logs?</h4></summary>
 
 There are a couple of community maintained dashboards available at [kubearmor/kubearmor-dashboards](https://github.com/kubearmor/kubearmor-dashboards).
 
 If you don't find an existing dashboard particular to your needs, feel free to create an issue. It would be really great if you could also contribute one!
 </details>
 
+<details><summary><h4>How to fix `karmor logs` timing out?</h4></summary>
+
+`karmor logs` internally uses Kubernetes' client's port-forward. Port forward is not meant for long running connection and it times out if left idle. Checkout this [StackOverflow answer](https://stackoverflow.com/questions/47484312/kubectl-port-forwarding-timeout-issue) for more info.
+
+If you want to stream logs reliably there are a couple of solutions you can try:
+1. Modiy the `kubearmor` service in `kube-system` namespace and change the service type to `NodePort`. Then run karmor with:
+```bash
+karmor logs --gRPC=<address of the kubearmor node-port service>
+```
+This will create a direct, more reliable connection with the service, without any internal port-forward.
+
+2. If you want to stream logs to external tools (fluentd/splunk/ELK etc) checkout [Streaming KubeArmor events](https://github.com/kubearmor/kubearmor-relay-server#streaming-kubearmor-events-to-external-siem-tools).
+
+The community has created adapters and dashboards for some of these tools which can be used out of the box or as reference for creating new adapters. Checkout the previous question for more information.
+
+</details>
+
 <details><summary><h4>How to get process events in the context of a specific pods?</h4></summary>  
 
 Following command can be used to to get pod specific events:  
@@ -163,4 +187,6 @@ There is some problem with AppArmor due to which ICMP rules don't work as expect
 The KubeArmor team has brought this to the attention of the [AppArmor community](https://stackoverflow.com/questions/76768503/apparmor-deny-icmp-issue) on StackOverflow and await their response.
 
 In the same environment we've found that ICMP rules with BPFLSM work as expected.
+
+For more such differences checkout [Enforce Feature Parity Wiki](https://github.com/kubearmor/KubeArmor/wiki/Enforcer-Feature-Parity).
 </details>