falco: Crashloopback on falco containers using using-falcosecuritydriver-loader-image
Describe the bug
The container falco fails to start without any clear message on the logs when I use falcosecuritydriver-loader-image
How to reproduce it
I deployed falco chart version 1.7.7 without ebpf using this documentation link
Expected behaviour
I expected to be up and running.
Screenshots
+ kubectl logs -f falco-6hbcr
Fri Mar 5 12:17:59 2021: Falco version 0.27.0 (driver version 5c0b863ddade7a45568c0ac97d037422c9efb750)
Fri Mar 5 12:17:59 2021: Falco initialized with configuration file /etc/falco/falco.yaml
Fri Mar 5 12:17:59 2021: Loading rules from file /etc/falco/falco_rules.yaml:
Fri Mar 5 12:18:00 2021: Loading rules from file /etc/falco/falco_rules.local.yaml:
Fri Mar 5 12:18:01 2021: Loading rules from file /etc/falco/k8s_audit_rules.yaml:
Fri Mar 5 12:18:02 2021: Starting internal webserver, listening on port 8765
{"output":"12:18:02.604161000: Notice Privileged container started (user=<NA> user_loginuid=0 command=container:30c0f74777de k8s.ns=kube-system k8s.pod=kube-proxy-hjc95 container=30c0f74777de image=602401143452.dkr.ecr.eu-west-1.amazonaws.com/eks/kube-proxy:v1.18.8-eksbuild.1) k8s.ns=kube-system k8s.pod=kube-proxy-hjc95 container=30c0f74777de k8s.ns=kube-system k8s.pod=kube-proxy-hjc95 container=30c0f74777de","priority":"Notice","rule":"Launch Privileged Container","time":"2021-03-05T12:18:02.604161000Z", "output_fields": {"container.id":"30c0f74777de","container.image.repository":"602401143452.dkr.ecr.eu-west-1.amazonaws.com/eks/kube-proxy","container.image.tag":"v1.18.8-eksbuild.1","evt.time":1614946682604161000,"k8s.ns.name":"kube-system","k8s.pod.name":"kube-proxy-hjc95","proc.cmdline":"container:30c0f74777de","user.loginuid":0,"user.name":null}}
Environment
-
Falco version: Falco version: 0.27.0 Driver version: 5c0b863ddade7a45568c0ac97d037422c9efb750
-
System info: { “machine”: “x86_64”, “nodename”: “ip-192-168-3-163.eu-west-1.compute.internal”, “release”: “4.14.219-161.340.amzn2.x86_64”, “sysname”: “Linux”, “version”: “#1 SMP Thu Feb 4 05:54:19 UTC 2021” }
-
Cloud provider or hardware configuration:
-
OS: cat /etc/os-release NAME=“Amazon Linux” VERSION=“2” ID=“amzn” ID_LIKE=“centos rhel fedora” VERSION_ID=“2” PRETTY_NAME=“Amazon Linux 2” ANSI_COLOR=“0;33” CPE_NAME=“cpe:2.3⭕amazon:amazon_linux:2” HOME_URL=“https://amazonlinux.com/”
-
Kernel: Linux ip-192-168-3-163.eu-west-1.compute.internal 4.14.219-161.340.amzn2.x86_64 #1 SMP Thu Feb 4 05:54:19 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux- Installation method:
I deployed the falco chart version 1.7.7
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Reactions: 1
- Comments: 18 (4 by maintainers)
Same issue.