falco: Falco crashing on Kubernetes with connection timeout
What happened:
Falco crashing. ~Once every 15mins.
What you expected to happen:
Falco not crash and handle and prevent connection timeouts gracefully.
How to reproduce it (as minimally and precisely as possible):
helm install --name falco -f deployment/falco_config.yaml stable/falco
cat deployment/falco_config.yaml
ebpf:
enabled: true
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
memory: 600Mi
image:
tag: dev
falco:
jsonOutput: true
fakeEventGenerator:
enabled: false
customRules:
rules-fluentd.yaml: |-
- rule: Clear Log Activities
append: true
condition: and not k8s.ns.name=kube-system
Environment:
- Falco version (use
falco --version): - System info <!-- Falco has a built-in support command you can use “falco --support | jq .system_info” -->
- Cloud provider or hardware configuration: Google (GKE)
- OS (e.g:
cat /etc/os-release): COS (build 11647.121.0) - Install tools (e.g. in kubernetes, rpm, deb, from source): Kubernetes 1.13.5-gke.10
- Node type: g1-small
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Comments: 15 (11 by maintainers)
I can’t use 0.15.3 on COOS because it doesn’t contain the fix for https://github.com/falcosecurity/falco/issues/425#issuecomment-497986111
Dev apparently fixes the issue.
Output:
Mon Jul 1 09:35:58 2019: Runtime error: Socket handler (k8s_daemonset_handler_event) an error occurred while connecting to https://10.104.0.1: Connection timed out. Exiting.@hus787 I think @fntlnz was referring to the output provided by
falco --support | jq .system_infoandfalco --versionin first instance 😃