[TRACKING] Breaking changes in Falco 0.37.0

[Andreagit97]

This issue keeps track of all deprecated Falco features that will be removed in Falco 0.37

• [x] rate-limiter mechanism
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2762
  • breaking change PR: https://github.com/falcosecurity/falco/pull/2841
• [x] --userspace CLI option
  • deprecation PR: https://github.com/falcosecurity/falco/pull/2761
  • breaking change PR: https://github.com/falcosecurity/falco/pull/2839
• [x] falco-driver-loader script will be removed and embedded into falcoctl
  • deprecation issue: https://github.com/falcosecurity/falco/issues/2675
  • breaking change PR: https://github.com/falcosecurity/falco/pull/2905
  • About falco-driver-loader; the new falcoctl driven implementation will drop:
    • --source-only
    • BPF_USE_LOCAL_KERNEL_SOURCES
    • DRIVER_CURL_OPTIONS
    • FALCO_BPF_PROBE environment variable won't be considered by new falcoctl driver loader, since it is already deprecated (above points, Falco 0.37.0) and going to be removed in Falco 0.38.0
  • Also, some env vars were renamed:
    • DRIVERS_REPO env variable has been replaced by FALCOCTL_DRIVER_NAME, or --name command line argument for falcoctl driver tool
    • DRIVERS_NAME env variable has been replaced by FALCOCTL_DRIVER_REPOS, or --repo command line argument for falcoctl driver tool
    • DRIVER_KERNEL_RELEASE env variable has been replaced by --kernelrelease command line argument for falcoctl driver install command
    • DRIVER_KERNEL_VERSION env variable has been replaced by --kernelversion command line argument for falcoctl driver install command
    • DRIVER_INSECURE_DOWNLOAD env variable has been replaced by --http-insecure command line argument for falcoctl driver install command
• [x] remove -K/-k options from Falco in favor of the new k8s plugin:
  • deprecation issue: https://github.com/falcosecurity/falco/issues/2973
  • breaking change PR: https://github.com/falcosecurity/falco/pull/2914
• [x] Falco config yaml env var expansion: https://github.com/falcosecurity/falco/pull/2918; following the new feature, we have small breaking changes:
  • in https://github.com/falcosecurity/falco/pull/2562 env var that resolved to empty string (both non-set env vars and env vars set to "") returned default value. This was in constrast with everything else in our yaml impl (ie: we only returned default value if node is not defined). Now expanded env vars retain the same behavior of all other variables.
  • now we will return default value for nodes that cannot be parsed to chosen type
  • program_output command will be env-expanded at init time, instead of letting popen and thus the sh shell expand it. This is technically a breaking change even if no behavioral change is expected. Also, you can avoid env var expansion by using ${{FOO}} instead of ${FOO}. It will resolve to ${FOO} and won't be resolved to the env var value.
• [x] Plugins shipped inside Falco bundled were dropped; since we now rely on falcoctl to install and eventually follow plugins, there is no need to ship them bundled anymore.

DEPRECATION (probably will be removed with Falco 1.0.0):

• append in Falco rule is deprecated in favor of override (see https://github.com/falcosecurity/falco/pull/2992)
• syntax like

  - rule: Write below etc
  enabled: false

  is deprecated in favor of override (see https://github.com/falcosecurity/falco/pull/2992).

  - rule: Write below etc
    enabled: false
    override:
       enabled: replace

  Please note that the enabled key is only deprecated when used as an override! So a rule like this is perfectly legit:

  - rule: legit_rule
  desc: legit rule description
  condition: evt.type=open
  output: user=%user.name command=%proc.cmdline file=%fd.name
  priority: INFO
  enabled: false

[Andreagit97]

We cannot use tasklists at the moment since indented tasks (i.e. nested tasklist) are not supported

[leogr]

/assign @Andreagit97

[FedeDP]

About falco-driver-loader; the new falcoctl driven implementation will drop:

• --source-only
• BPF_USE_LOCAL_KERNEL_SOURCES
• DRIVER_CURL_OPTIONS

[FedeDP]

Added notes about https://github.com/falcosecurity/falco/pull/2918!

[FedeDP]

https://github.com/falcosecurity/falco/pull/2997 might add a new deprecation: it will drop:

• k8saudit plugin
• k8saudit-rules
• cloudtrail plugin
• cloudtrail-rules
• json plugin

out of Falco bundle, since they are meant to be installed through falcoctl. Will update OP once there is an agreement by the maintainers.

[leogr]

2997 might add a new deprecation: it will drop:

• k8saudit plugin
• k8saudit-rules
• cloudtrail plugin
• cloudtrail-rules
• json plugin

out of Falco bundle, since they are meant to be installed through falcoctl. Will update OP once there is an agreement by the maintainers.

The PR is merged, so yes! We need to inform our users regarding this change.

[FedeDP]

Already added to OP

[FedeDP]

https://github.com/falcosecurity/falco-website/pull/1240 addresses documentation updates for:

• new falco-driver-loader
• dropped --userspace CLI option
• new driver selection config option in config file: https://github.com/falcosecurity/falco/pull/2413

[Andreagit97]

Falco 0.37.0 is out we can close it!