search

falcosecurity / falco

Cloud Native Runtime Security
https://falco.org
Apache License 2.0
7.25k stars 893 forks source link

falco-driver-loader module URL 404 #2176

Closed vamshi05 closed 1 year ago

vamshi05 commented 2 years ago

We run falco-driver-loader ECS container prior to falco-no-driver container. Since Aug 23, 11:50 am PST, the falco-driver-loader image (0.31.1) was trying to download the falco module with URL Trying to download a prebuilt falco module from https://download.falco.org/driver/b7eb0dd65226a8dc254d228c8d950d07bf3521d2/falco_amazonlinux2_4.14.287-215.504.amzn2.x86_64_1.ko which doesn't exist in the following location https://download.falco.org/?prefix=driver/b7eb0dd65226a8dc254d228c8d950d07bf3521d2

We tried using the newer versions of falco-driver-loader image (until 0.32.2) but see same issue which points to the file https://download.falco.org/driver/2.0.0%2Bdriver/x86_64/falco_amazonlinux2_4.14.287-215.504.amzn2.x86_64_1.ko in a different archive than the former but same release version name 4.14.287 that doesn't exist.

Is there anything that we're missing here as we don't control the image itself as we just use FROM falcosecurity/falco-driver-loader:<version>

vamshi05 commented 2 years ago

/kind bug

jasondellaluce commented 2 years ago

cc @FedeDP

FedeDP commented 2 years ago

@vamshi05 i think that nobody is actually building your driver. Have a look at https://github.com/falcosecurity/test-infra/tree/master/driverkit/config to add the new config for all the suppported driver versions. Our kernel-crawler indeed has already found the new kernel, as you can see here, but we still did not build it. If you wait a couple of days we should be hopefully able to build the driver :)

vamshi05 commented 2 years ago

@FedeDP Thanks for your response. We can certainly wait for couple of days in this case but I'm concerned that we would end up in same situation in future. Is there an alternate approach to how we should be using the falco-driver-loader since we don't have control on the module URL that it's trying to download?

FedeDP commented 2 years ago

Well, we have a kernel-crawler build just for this :) It runs weekly and crawls all the kernels supported by multiple distros, therefore this kind of issues should become more and more uncommon. This specific issues comes from the fact that kernel-crawler and test-infra (the infra that actually builds and publishes the drivers) are blocked since end of july on a new feature and therefore we did not build nor publish new drivers since end of july :)

vamshi05 commented 2 years ago

@FedeDP I see. Thanks for the details. Please keep us posted once the driver is built. Any specific eta?

FedeDP commented 2 years ago

I think we are gonna unblock kernel-crawler likely next week, therefore i expect end of next week eta :)

FedeDP commented 2 years ago

The driver is now there: https://download.falco.org/driver/2.0.0%2Bdriver/x86_64/falco_amazonlinux2_4.14.287-215.504.amzn2.x86_64_1.ko :D

poiana commented 1 year ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana commented 1 year ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

poiana commented 1 year ago

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

poiana commented 1 year ago

@poiana: Closing this issue.

In response to [this](https://github.com/falcosecurity/falco/issues/2176#issuecomment-1408291995): >Rotten issues close after 30d of inactivity. > >Reopen the issue with `/reopen`. > >Mark the issue as fresh with `/remove-lifecycle rotten`. > >Provide feedback via https://github.com/falcosecurity/community. >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.