search

falcosecurity / test-infra

Falco workflow & testing infrastructure
https://prow.falco.org
Apache License 2.0
31 stars 110 forks source link

Prow fails to upload some probes #585

Closed Issif closed 1 year ago

Issif commented 2 years ago

By running my script for testing if drivers are available before trying to install Falco (see here) I noticed that for some kernel versions, the module is available but not the probe, even if the driverkit config is correct.

For example, we have falco_debian_5.10.0-9-amd64_1.ko but not falco_debian_5.10.0-10-amd64_1.o.

I checked Prow logs and saw this behavior are full of this kind of error:

 INFO using config file                             file=config/3aa7a83bf7b9e6229a3824e3fd1f4452d1e95cb4/debian_5.10.0-9-amd64_1.yaml
INFO driver building, it will take a few seconds   processor=docker
INFO kernel module available                       path=output/3aa7a83bf7b9e6229a3824e3fd1f4452d1e95cb4/falco_debian_5.10.0-9-amd64_1.ko
FATA exiting                                       error="Error: No such container:path: d4d6e3669a68547893466dea135fff3dfef2071611f84c1c94437c7a1bacc38e:/tmp/driver/bpf/probe.o"

Source: https://prow.falco.org/view/s3/falco-prow-logs/logs/rebuild-all-drivers-debian-periodic/1478924491085058048

cc @zuc @leogr

leogr commented 2 years ago

Have you tried to build them using a local installation of driverkit?

Note, there's no 100% guarantee that all probes can be built by driverkit (headers might be missing, wrong compiler version, etc..).

Issif commented 2 years ago

I tried myself and faced the same issue. I'm not the only one, here a PR from @LucaGuerra for fixing the issue.

poiana commented 2 years ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

zuc commented 2 years ago

/remove-lifecycle stale

poiana commented 2 years ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

leogr commented 2 years ago

cc @maxgio92 @zuc

I believe this has not been fixed yet?

maxgio92 commented 2 years ago

Exactly. The issue I think needs to be replicated and debugged. @LucaGuerra do you have more info on this?

To be noted that in the meantime Driverkit evolved and different issues have been solved.

leogr commented 2 years ago

/remove-lifecycle stale

poiana commented 1 year ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana commented 1 year ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

poiana commented 1 year ago

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

poiana commented 1 year ago

@poiana: Closing this issue.

In response to [this](https://github.com/falcosecurity/test-infra/issues/585#issuecomment-1343397734): >Rotten issues close after 30d of inactivity. > >Reopen the issue with `/reopen`. > >Mark the issue as fresh with `/remove-lifecycle rotten`. > >Provide feedback via https://github.com/falcosecurity/community. >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.