Driver for x86_64/falco_cos_5.10.133

[llabake]

Describe the bug

Falco installation keeps crashing after upgrading Kubernetes cluster to 1.24

How to reproduce it Launch falco 2.0 helm chart on GKE cluster with COS image type ================ Cleaning phase ================

• Looking for a falco module locally (kernel 5.10.133+)
• Trying to download a prebuilt falco module from https://download.falco.org/driver/2.0.0%2Bdriver/x86_64/falco_cos_5.10.133%2B_1.ko curl: (22) The requested URL returned error: 404 Unable to find a prebuilt falco module
• Trying to dkms install falco module with GCC /usr/bin/gcc DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"

Creating symlink /var/lib/dkms/falco/2.0.0+driver/source -> /usr/src/falco-2.0.0+driver

DKMS: add completed.

• Running dkms build failed, couldn't find /var/lib/dkms/falco/2.0.0+driver/build/make.log (with GCC /usr/bin/gcc)
• Trying to dkms install falco module with GCC /usr/bin/gcc-8 DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
• Running dkms build failed, couldn't find /var/lib/dkms/falco/2.0.0+driver/build/make.log (with GCC /usr/bin/gcc-8)
• Trying to dkms install falco module with GCC /usr/bin/gcc-6 DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
• Running dkms build failed, couldn't find /var/lib/dkms/falco/2.0.0+driver/build/make.log (with GCC /usr/bin/gcc-6)
• Trying to dkms install falco module with GCC /usr/bin/gcc-5 DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
• Running dkms build failed, couldn't find /var/lib/dkms/falco/2.0.0+driver/build/make.log (with GCC /usr/bin/gcc-5)
• Trying to load a system falco module, if present Consider compiling your own falco driver and loading it or getting in touch with the Falco community

Expected behaviour Drivers are found after new ones are compiled.

Screenshots

Environment

Kubernetes 1.24

• Falco version: Helm chart version: 2.0.12
• System info:
• Cloud provider or hardware configuration: GCP GKE
• OS:
• Kernel: x86_64 x86_64 x86_64 GNU/Linux
• Installation method: Kubernetes Helm chart

Additional context

[FedeDP]

Hi! It seems like it is trying to build the kmod on gke; we only support eBPF there; see https://falco.org/docs/getting-started/third-party/production/#gke. You need to use:

helm install falco falcosecurity/falco --set driver.kind=ebpf

Let me know if it works!

[llabake]

Thank you @FedeDP, changing the driver to ebpf fixed my error.

[xycloops123]

hey @FedeDP seems like the link is broken and missing drivers probably using ebpf as an option also doesnt work now.

[alacuku]

Hi @xycloops123, please open a new issue providing more info about your case since this issue has been solved and closed by the author. Thank you!