Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update(falco): support latest changes in falco-driver-loader #735

Merged
merged 1 commit into from
Sep 17, 2024

Conversation

alacuku
Copy link
Member

@alacuku alacuku commented Sep 10, 2024

The init container when the driver kind is set to auto, automatically creates a new config file for falco and sets the engine kind that fits the environment where falco is running

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

If this PR will release a new chart version please make sure to also uncomment the following line:

/kind chart-release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area falco-chart

/area falco-exporter-chart

/area falcosidekick-chart

/area event-generator-chart

/area k8s-metacollector

What this PR does / why we need it:

The init container, when driver.kind=auto, automatically generates
a new Falco configuration file and selects the appropriate engine
kind based on the environment where Falco is deployed.

With this commit, along with falcoctl PR #630, the Helm charts now
support different driver kinds for Falco instances based on the
specific node they are running on. When driver.kind=auto is set,
each Falco instance dynamically selects the most suitable
driver (e.g., ebpf, kmod, modern_ebpf) for the node.

+-------------------------------------------------------+
| Kubernetes Cluster                                    |
|                                                       |
|  +-------------------+  +-------------------+        |
|  | Node 1             |  | Node 2             |        |
|  |                   |  |                   |        |
|  | Falco (eBPF probe) |  | Falco (kmod)       |        |
|  +-------------------+  +-------------------+        |
|                                                       |
|                 +-------------------+                |
|                 | Node 3             |                |
|                 |                   |                |
|                 | Falco (modern eBPF)|                |
|                 +-------------------+                |
+-------------------------------------------------------+

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Checklist

  • Chart Version bumped
  • Variables are documented in the README.md
  • CHANGELOG.md updated

  The init container, when driver.kind=auto, automatically generates
  a new Falco configuration file and selects the appropriate engine
  kind based on the environment where Falco is deployed.

  With this commit, along with falcoctl PR falcosecurity#630, the Helm charts now
  support different driver kinds for Falco instances based on the
  specific node they are running on. When driver.kind=auto is set,
  each Falco instance dynamically selects the most suitable
  driver (e.g., ebps, kmod, modern_ebpf) for the node.

  +-------------------------------------------------------+
  | Kubernetes Cluster                                    |
  |                                                       |
  |  +-------------------+  +-------------------+        |
  |  | Node 1             |  | Node 2             |        |
  |  |                   |  |                   |        |
  |  | Falco (ebpf) |  | Falco (kmod)       |        |
  |  +-------------------+  +-------------------+        |
  |                                                       |
  |                 +-------------------+                |
  |                 | Node 3             |                |
  |                 |                   |                |
  |                 | Falco (modern_ebpf)|                |
  |                 +-------------------+                |
  +-------------------------------------------------------+
Signed-off-by: Aldo Lacuku <[email protected]>
@alacuku
Copy link
Member Author

alacuku commented Sep 17, 2024

/unhold

@alacuku alacuku changed the title WIP update(falco): support latest changes in falco-driver-loader update(falco): support latest changes in falco-driver-loader Sep 17, 2024
@poiana
Copy link
Contributor

poiana commented Sep 17, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alacuku, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana
Copy link
Contributor

poiana commented Sep 17, 2024

LGTM label has been added.

Git tree hash: 22a6b13cd5005c2fc814f3627d3ca3eafd1dab83

@poiana poiana merged commit 4e87255 into falcosecurity:master Sep 17, 2024
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants