search

falcosecurity / charts

Community managed Helm charts for running Falco with Kubernetes
Apache License 2.0
236 stars 285 forks source link

The README is outdated regarding handling of multiple event sources #447

Closed trallnag closed 1 year ago

trallnag commented 1 year ago

This README contains the following section:

Note that multiple event sources can not be handled in the same Falco instance. It means, you can not have Falco deployed leveraging drivers for syscalls events and at the same time loading plugins. Here you can find the https://github.com/falcosecurity/falco/issues/2074 about multiple event sources in the same Falco instance. If you need to handle syscalls and plugins events than consider deploying different Falco instances, one for each use case.

Checking the linked issue and related PRs I'm seeing that now multiple event sources are supported.

So the README should be updated. From what I understand now a single instance of Falco as a daemon set is enough? Or is it still recommended to use a deployment for plugins and a daemon set for drivers?

alacuku commented 1 year ago

Hi @trallnag, the README has been updated. Thanks for reporting it!

trallnag commented 1 year ago

Fixed in https://github.com/falcosecurity/charts/pull/453