search

falcosecurity / evolution

Evolution process of The Falco Project
Apache License 2.0
48 stars 37 forks source link

falco-kubernetes installation on debian fails #43

Closed balasu closed 3 years ago

balasu commented 3 years ago

Description of the issue

I am setting up falco on Linode kubernetes engine, and was deploying through https://github.com/falcosecurity/evolution.git falco. Falco pod is not coming and auditsink yaml is failing to install.

How to reproduce it once clone the evolution repo, deploy yamls from below path https://github.com/falcosecurity/evolution/tree/master/deploy/kubernetes/kernel-and-k8s-audit image auditsink yaml will fail to deploy as there is no kind image falco pod will fail, due to local package linux-headers-5.8.0-1-cloud-amd64 not available and same is not available on https://download.falco.org/?prefix=driver/2aa88dcf6243982697811df4c1b484bcbe9488a2/

Expected behaviour Falco pods should get deployed

Screenshots falco pod failing image aduitsink yaml doesnt deploy image

Environment

leodido commented 3 years ago

Investigated this a bit.

PR test-infra#276 introduced YAML configuration for driverkit to build the above mentioned Falco drivers.

Anyways, by looking at the Falco Infra logs I noticed that driverkit is not really able to build them.

Because it's not able to find the relative kernel headers.

Screenshot 2021-01-13 at 17 39 19

Thus, first, we need to solve this problem on driverkit.

I'm gonna open an issue there too to track it.

poiana commented 3 years ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana commented 3 years ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

poiana commented 3 years ago

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

poiana commented 3 years ago

@poiana: Closing this issue.

In response to [this](https://github.com/falcosecurity/evolution/issues/43#issuecomment-860138706): >Rotten issues close after 30d of inactivity. > >Reopen the issue with `/reopen`. > >Mark the issue as fresh with `/remove-lifecycle rotten`. > >Provide feedback via https://github.com/falcosecurity/community. >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.