falco: falco failed to run in kind

I have finally found the problem, below the steps to make it work.

1. Install the driver on the host machine

Clone the Falco project and checkout the tag corresponding to the same Falco version used within the helm chart (0.20.0 in my case), then:

mkdir build
cd build
cmake ..
sudo make install_driver

2. Mount /dev on kind-control-plane To make the driver work, the host’s /dev must be accessible from within the container. To do that, kind requires the following:

kind-config.yaml

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  extraMounts:
  - hostPath: /dev
    containerPath: /dev

Then create the cluster so:

kind create cluster --config=./kind-config.yaml

3. DONE! You can now deploy Falco to kind’s cluster as usual. You should notice that the driver will automatically be loaded with modprobe:

* Trying to load a system falco-probe, if present
falco-probe found and loaded with modprobe
Fri Mar  6 14:54:49 2020: Falco initialized with configuration file /etc/falco/falco.yaml
Fri Mar  6 14:54:49 2020: Loading rules from file /etc/falco/falco_rules.yaml:
Fri Mar  6 14:54:51 2020: Loading rules from file /etc/falco/falco_rules.local.yaml:
Fri Mar  6 14:54:54 2020: Starting internal webserver, listening on port 8765

@oke-py @markyjackson-taulia can you please take a look and let me know if that works for you too?

At last, it worked fine! Thank you so much. I used ubuntu-18.04 on EC2.

install go

$ sudo add-apt-repository ppa:longsleep/golang-backports
$ sudo apt update
$ sudo apt install golang-go
$ go version
go version go1.14 linux/amd64

install docker

$ sudo apt-get update
$ sudo apt-get install apt-transport-https ca-certificates curl gnupg-agent software-properties-common
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
$ sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) \
  stable"
$ sudo apt-get update
$ sudo apt-get install docker-ce docker-ce-cli containerd.io
$ sudo usermod -aG docker `whoami`
$ exit

re-login

set env-var

$ export GOPATH=~/go
$ export PATH=$PATH:$GOPATH/bin
$ export GO111MODULE="on"

install kernel module

$ docker pull falcosecurity/driverkit-builder
$ go get github.com/falcosecurity/driverkit
$ uname -v
#59-Ubuntu SMP Wed Dec 4 10:02:00 UTC 2019
$ uname -r
4.15.0-1057-aws
$ driverkit docker --output-module /tmp/falco.ko --kernelversion=59 --kernelrelease=4.15.0-1057-aws --driverversion=dev --target=ubuntu-aws
$ sudo cp /tmp/falco.ko /lib/modules/`uname -r`/falco.ko
$ sudo depmod
$ sudo modprobe falco
$ lsmod | grep -i falco

install kubectl & helm

$ curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl
$ chmod +x ./kubectl
$ sudo mv ./kubectl /usr/local/bin/kubectl
$ curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | sudo bash
$ helm repo add stable https://kubernetes-charts.storage.googleapis.com/

install kind & create cluster

$ go get sigs.k8s.io/kind@v0.7.0
$ cat <<EOF | kind create cluster --config=-
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  extraMounts:
  - hostPath: /dev
    containerPath: /dev
EOF 

install & run falco

$ helm install stable/falco --generate-name
$ kubectl get po -w
NAME                     READY   STATUS    RESTARTS   AGE
falco-1584781190-f5wdw   1/1     Running             0          30s

Hey @yashbhutwala as far as I know, Falco on Docker for Mac has a different kind of issue that’s related to linuxkit and @leodido is working on that. Feel free to open another issue in the falco repo and add more details.

Thanks @leogr for stepping up and helping with this.

I’ll call it solved 😃

/close

@oke-py here you find further details on how to install the kernel module using driverkit. Let me know!

Related to this, I think we want to get the manifests for newer kubernetes versions in the Falco repo.

Also @oke-py thanks for getting this done on the helm charts! 👇 https://github.com/helm/charts/pull/17339