falco: Falco pod failure for GKE 5.10.133+ kernel
Describe the bug
Helm chart installation fails for container optimized OS for GKE kernel 5.10.133+
How to reproduce it
helm install falco-gke falcosecurity/falco --set driver.kind=ebpf
NAME: falco-gke
LAST DEPLOYED: Fri Dec 16 04:20:38 2022
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Falco agents are spinning up on each node in your cluster. After a few
seconds, they are going to start monitoring your containers looking for
security issues.
Pod deployment is still unstable after doing a shell to one of the pods below is the error I am seeing. After hitting the driver url https://download.falco.org/driver/3.0.1%2Bdriver/x86_64/falco_cos_5.10.133%2B_1.o I see the file is missing.
* Filename 'falco_cos_5.10.133+_1.o' is composed of:
- driver name: falco
- target identifier: cos
- kernel release: 5.10.133+
- kernel version: 1
* Trying to download a prebuilt eBPF probe from https://download.falco.org/driver/3.0.1%2Bdriver/x86_64/falco_cos_5.10.133%2B_1.o
curl: (7) Failed to connect to download.falco.org port 443: Connection timed out
Unable to find a prebuilt falco eBPF probe
* COS detected (build 16623.227.33), using COS kernel headers
* Found kernel config at /proc/config.gz
* Downloading https://storage.googleapis.com/cos-tools/16623.227.33/kernel-headers.tgz
* Setting up /usr/src links from host
* Running falco-driver-loader for: falco version=0.33.0, driver version=3.0.1+driver, arch=x86_64, kernel release=5.10.133+, kernel version=1
* Running falco-driver-loader with: driver=bpf, compile=yes, download=yes
* Mounting debugfs
mount: /sys/kernel/debug: cannot mount nodev read-only.
* Filename 'falco_cos_5.10.133+_1.o' is composed of:
- driver name: falco
- target identifier: cos
- kernel release: 5.10.133+
- kernel version: 1
Screenshots

Environment
falco version=0.33.0, driver version=3.0.1+driver, arch=x86_64, kernel release=5.10.133+, kernel version=1
Additional context
Tried the driverkit repo build as well but still failing with below error:
go run main.go docker -c gke-driver.yaml
INFO using config file file=gke-driver.yaml
ERRO error validating build options error="target must be a valid target ([fedora vanilla amazonlinux2 debian centos rocky ubuntu almalinux amazonlinux photon redhat arch opensuse minikube amazonlinux2022 flatcar])"
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Comments: 15 (7 by maintainers)
@leogr I can actually close it unless @eljefedelrodeodeljefe wants it to still keep it open.
Hey @ronniee007
Is this still an issue?