[WIP] update(CI): Integration of modern BPF probe into Falco

[Andreagit97]

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area build

/area CI

What this PR does / why we need it:

This PR tries to integrate the modern BPF probe into Falco, 3 main aspects will be evaluated:

1. CI integration
2. build integration
3. code integration (If Falco needs some fixes to work correctly with the modern probe)

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

update(CI): Integration of modern BPF probe into Falco

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Andreagit97]

cc @leogr

[incertum]

@Andreagit97: Would building on ubuntu-22.04 work for example for running Falco w/ modern_bpf on let's say a centos7 6.0 kernel? When we debugged the possible "heisenbug" I recall it would need to be built in a centos7 container because of old GLIBC version 2.17 constraints (given the modern probe is baked into scap). In that case need to build newer clang versions from source in the centos7 container or maybe curl pre-built clang artifacts from Falco's Artifact store?

[incertum]

Or given below when you use the centos7 container this is all not a problem and it works. In that case please disregard.

[Andreagit97]

yeah, the trick here is to build the header file (so the BPF skeleton) on a recent machine with the latest clang/llvm versions like ubuntu 22.04 since building it directly on centos7 would be a real pain. After that, we use this header file to build Falco on centos7 in this way the modern probe should be compliant with lower versions of GLIBC like 2.17 as you mentioned :)

[Andreagit97]

Just a quick update:
This PR will be used to ship the packages (x86, aarch64) thanks to the Circle CI jobs. The CI doesn't generate the docker images until the PR is merged, for this reason, I will manually download the tag.gz packages for both architectures, create the docker images locally and push them to my personal dockerhub :) We will notify you on the Falco slack channel when all is in place.

After a short period of testing, we will merge this PR and the modern probe will be regularly shipped into Falco 0.34 as another possible syscall source 🥳

[Andreagit97]

/milestone 0.34.0

[Andreagit97]

/hold

[Andreagit97]

We will leave this PR open until Falco 0.34 is released after that we will close it. The PR with the modern probe integration within Falco is this one #2320

[Andreagit97]

You can find the new packages and docker images directly on the master branch
/close

[poiana]

@Andreagit97: Closed this PR.

In response to this:

You can find the new packages and docker images directly on the master branch
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.