new: falcoctl driver loader #2905

FedeDP · 2023-11-09T11:34:09Z

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area build

What this PR does / why we need it:

This PR drops old falco-driver-loader script in favor of new falcoctl driver command.

Which issue(s) this PR fixes:

Fixes #2675

Special notes for your reviewer:

This is wip because falcoctl's PR (falcosecurity/falcoctl#343) is still to be merged and this will need some more work.
I opened this one to give an idea of the final look.

Does this PR introduce a user-facing change?:

new!: dropped falco-driver-loader script in favor of new falcoctl driver command

FedeDP · 2023-11-09T11:34:27Z

cmake/modules/falcoctl.cmake

@@ -28,8 +28,9 @@ endif()

 ExternalProject_Add(
        falcoctl
-        URL "https://github.com/falcosecurity/falcoctl/releases/download/v${FALCOCTL_VERSION}/falcoctl_${FALCOCTL_VERSION}_${FALCOCTL_SYSTEM_NAME}_${FALCOCTL_SYSTEM_PROC_GO}.tar.gz"
-        URL_HASH "SHA256=${FALCOCTL_HASH}"
+        URL "https://github.com/falcosecurity/falcoctl/archive/555594a2860284947ff83eefd4bd9a5abc6e9fe1.zip"


Download zip from my own falcoctl PR.

FedeDP · 2023-11-09T11:34:43Z

docker/driver-loader-legacy/docker-entrypoint.sh

@@ -26,4 +26,5 @@ do
    ln -s "$i" "/usr/src/$base"
 done

-/usr/bin/falco-driver-loader "$@"
+/usr/bin/falcoctl driver config "$@"


This will need some more work, i am not sure what we want to do.

Same goes for other occurrences.

This will need some more work, i am not sure what we want to do.

What do you mean? what do we miss here?

Oh the parameters being passed to falco-driver-loader were surely different from the one being passed to falcoctl driver; also config might be wrong there, since we may want to let users decide which subcmd to invoke.

We decided to reimplement a similar switch logic to the one supported by falco-driver-loader (https://github.com/falcosecurity/falco/blob/master/scripts/falco-driver-loader#L752) managing each flag.

docker/no-driver/Dockerfile

FedeDP · 2023-11-09T11:35:49Z

scripts/debian/postinst.in

-# If needed, try to load/compile the driver through falco-driver-loader
+# If needed, try to load/compile the driver through falcoctl
+echo "[POST-INSTALL] Configure falcoctl driver type:"
+falcoctl driver config --type $chosen_driver


We now configure the desired driver type, and then build/download the driver using falcoctl.

FedeDP · 2023-11-09T11:36:09Z

scripts/falcoctl/falcoctl.yaml.in

falcoctl config file must now be configured properly.

leogr

Nice!

Just did a first look and left a few comments.

docker/no-driver/Dockerfile

docker/no-driver/Dockerfile.distroless

scripts/falcoctl/falcoctl.yaml.in

FedeDP · 2023-11-10T10:00:27Z

Note: once #2413 gets merged, this should be at least ready for local testing with the CI produced packages.

FedeDP · 2023-11-10T10:52:17Z

build-packages is failing with:

CMake Error at /__w/falco/falco/build/cmake_install.cmake:294 (file):
  file INSTALL cannot find
  "/__w/falco/falco/build/falcoctl-prefix/src/falcoctl/falcoctl": No such
  file or directory.

that is because our falcoctl.cmake file expects falcoctl releases (and is not able to build falcoctl from sources since it would add the huge dep on go), but is now pointing to a falcoctl commit hash zip file.
I would love to fix the CI to be able to test; perhaps we will need to tag a falcoctl alpha release once falcosecurity/falcoctl#343 is merged.

FedeDP · 2023-11-14T11:40:36Z

TODO:

once new: driver selection in falco.yaml #2413 is merged, update deb/rpm scripts using new chosen_driver names (ie: "kmod", "ebpf" and "modern-ebpf").
also, are per-driver systemd units still needed? Btw they should enforce a driver.kind, like -o driver.kind=kmod
-> we might want to deprecate current units and add a new falco@.service templated unit that enables the requested driver.

FedeDP · 2023-11-27T14:11:57Z

also, are per-driver systemd units still needed? Btw they should enforce a driver.kind, like -o driver.kind=kmod
-> we might want to deprecate current units and add a new falco@.service templated unit that enables the requested driver.

Done.
About the single unit (deprecating existing ones), i haven't got strong opinions.

FedeDP · 2023-11-27T14:12:14Z

We just need an alpha tag of falcoctl 0.7.0 to be tested within this PR.

FedeDP · 2023-11-27T15:34:10Z

Done: https://github.com/falcosecurity/falcoctl/releases/tag/v0.7.0-alpha1

FedeDP · 2023-11-29T16:34:16Z

falcosecurity/testing#34 + falcosecurity/testing#33 should allow test-dev-packages checks to pass fine.

FedeDP · 2023-12-01T12:49:56Z

The only failing test left is

TestFalcoLegacyBPF

that will be fixed by falcosecurity/testing#34

…coctl driver` command. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2023-12-06T09:39:57Z

cmake/modules/falcoctl.cmake

@@ -16,14 +16,14 @@ include(ExternalProject)

 string(TOLOWER ${CMAKE_HOST_SYSTEM_NAME} FALCOCTL_SYSTEM_NAME)

-set(FALCOCTL_VERSION "0.6.2")
+set(FALCOCTL_VERSION "0.7.0-alpha2")


Will need to bump to beta1 once it is out.

…onfig key. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

…nd `FALCOCTL_ENABLED` . Also, env variables always have precedence over dialog (ie: if they are set, we always skip dialog). Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2023-12-06T11:20:03Z

scripts/debian/postinst.in

+                  CHOICE=4
+                  ;;
+        esac     
+        if [ -z $CHOICE ] && [ -x /usr/bin/dialog ] && [ "${FALCO_FRONTEND}" != "noninteractive" ]; then          


Env var has always precedence.

I think this needs to be documented cc @falcosecurity/falco-website-maintainers

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2023-12-06T11:50:53Z

Bumped falcosecurity-testing to latest dev to (hopefully) fixup dev test-packages ci.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2023-12-06T14:38:39Z

Ops, we need falcosecurity/testing#37 too ;)

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2023-12-06T16:50:21Z

Also need falcosecurity/falcoctl#369 because compiled eBPF probe is expected to be symlinked to /root/.falco/falco-bpf.o : https://github.com/falcosecurity/falco/blob/master/scripts/falco-driver-loader#L662 and https://github.com/falcosecurity/falco/blob/master/falco.yaml#L321

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2023-12-06T18:08:44Z

Tests are finally passing! 🚀

leogr

Just a couple of minor issues found (see comments below), which we can fix in a follow-up PR.
Thus, it's ok for me to merge this so we can start more accurate testing.

leogr · 2023-12-11T09:33:31Z

docker/driver-loader-legacy/docker-entrypoint.sh

+print_usage() {
+	echo ""
+	echo "Usage:"
+	echo "  falco-driver-loader [driver] [options]"


Suggested change

echo " falco-driver-loader [driver] [options]"

echo " falco-driver-loader [driver] [options]"

This is misleading since there's no falco-driver-loader executable anymore.

Still trying to figure out how to fix it. May we print the container image usage help message instead? 🤔

You are right! Will fix in a follow up PR

leogr · 2023-12-11T09:33:46Z

docker/driver-loader/docker-entrypoint.sh

+print_usage() {
+	echo ""
+	echo "Usage:"
+	echo "  falco-driver-loader [driver] [options]"


Same as above

leogr · 2023-12-11T09:34:27Z

docker/falco/docker-entrypoint.sh

+print_usage() {
+	echo ""
+	echo "Usage:"
+	echo "  falco-driver-loader [driver] [options]"


same as above

leogr · 2023-12-11T09:36:02Z

scripts/debian/postinst.in

+                  CHOICE=4
+                  ;;
+        esac     
+        if [ -z $CHOICE ] && [ -x /usr/bin/dialog ] && [ "${FALCO_FRONTEND}" != "noninteractive" ]; then          


I think this needs to be documented cc @falcosecurity/falco-website-maintainers

Andreagit97

/approve

poiana · 2023-12-11T15:37:11Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Andreagit97,FedeDP,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

poiana added dco-signoff: yes do-not-merge/work-in-progress release-note kind/feature area/build approved labels Nov 9, 2023

poiana requested review from Kaizhe and leogr November 9, 2023 11:34

poiana added the size/XXL label Nov 9, 2023

FedeDP commented Nov 9, 2023

View reviewed changes

leogr reviewed Nov 9, 2023

View reviewed changes

docker/no-driver/Dockerfile Outdated Show resolved Hide resolved

docker/no-driver/Dockerfile.distroless Outdated Show resolved Hide resolved

scripts/falcoctl/falcoctl.yaml.in Outdated Show resolved Hide resolved

FedeDP mentioned this pull request Nov 10, 2023

[TRACKING] Breaking changes in Falco 0.37.0 #2763

Closed

6 tasks

leogr added this to the 0.37.0 milestone Nov 24, 2023

FedeDP mentioned this pull request Nov 27, 2023

Add use of FALCO_DRIVER_CHOICE and FALCOCTL_ENABLED env vars #2773

Merged

FedeDP force-pushed the new/falcoctl_driver_loader branch from 96a4b38 to d2ebe43 Compare November 27, 2023 14:02

This was referenced Nov 28, 2023

chore(tests/falcoctl): updated tests to latest main output. falcosecurity/testing#33

Merged

new(pkg,tests): port falco driver loader tests to use falcoctl. falcosecurity/testing#34

Merged

FedeDP force-pushed the new/falcoctl_driver_loader branch 3 times, most recently from c294151 to 05dd35a Compare December 1, 2023 12:17

FedeDP force-pushed the new/falcoctl_driver_loader branch from 05dd35a to 5a919ff Compare December 4, 2023 11:23

new(docker,scripts): dropped falco-driver-loader in favor of new `fal…

ec4f26b

…coctl driver` command. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

update(cmake): bump falcoctl to v0.7.0-alpha2.

8b099c8

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP force-pushed the new/falcoctl_driver_loader branch from 5a919ff to d3422d6 Compare December 6, 2023 09:29

FedeDP commented Dec 6, 2023

View reviewed changes

FedeDP force-pushed the new/falcoctl_driver_loader branch from d3422d6 to c071285 Compare December 6, 2023 10:41

FedeDP added 3 commits December 6, 2023 12:16

chore(scripts): use new default value for falcoctl driver.host-root c…

278bc1c

…onfig key. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

chore(scripts): integrate back master changes FALCO_DRIVER_CHOICE a…

65f88ab

…nd `FALCOCTL_ENABLED` . Also, env variables always have precedence over dialog (ie: if they are set, we always skip dialog). Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

chore(cmake): bumped falcoctl to v0.7.0-beta1.

678ca39

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP force-pushed the new/falcoctl_driver_loader branch from c071285 to 678ca39 Compare December 6, 2023 11:17

FedeDP commented Dec 6, 2023

View reviewed changes

update(submodules): bumped falcosecurity-testing to latest dev.

ac71895

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP added 2 commits December 6, 2023 13:49

update(cmake): bump falcoctl to 0.7.0-beta2.

c78be5b

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

update(cmake): bumped falcoctl to v0.7.0-beta3.

d2795c5

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

update(submodules): bumped falcosecurity/testing to latest master.

73be5e9

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

update(cmake): bumped falcoctl to v0.7.0-beta4.

dc49d5d

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP changed the title ~~wip: new: falcoctl driver loader~~ new: falcoctl driver loader Dec 6, 2023

poiana removed the do-not-merge/work-in-progress label Dec 6, 2023

FedeDP mentioned this pull request Dec 7, 2023

build(deps): Bump submodules/falcosecurity-testing from 3e2d5e2 to 930170b #2953

Closed

leogr approved these changes Dec 11, 2023

View reviewed changes

poiana assigned leogr Dec 11, 2023

poiana added the lgtm label Dec 11, 2023

Andreagit97 approved these changes Dec 11, 2023

View reviewed changes

poiana assigned Andreagit97 Dec 11, 2023

poiana merged commit e177898 into master Dec 11, 2023
20 checks passed

poiana deleted the new/falcoctl_driver_loader branch December 11, 2023 15:37

FedeDP mentioned this pull request Dec 12, 2023

fix(docker): small fixes in docker entrypoints for new driver loader. #2966

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

new: falcoctl driver loader #2905

new: falcoctl driver loader #2905

FedeDP commented Nov 9, 2023

FedeDP Nov 9, 2023

FedeDP Nov 9, 2023

FedeDP Nov 9, 2023

Andreagit97 Nov 10, 2023

FedeDP Nov 10, 2023

FedeDP Dec 1, 2023

FedeDP Nov 9, 2023

FedeDP Nov 9, 2023

leogr left a comment

FedeDP commented Nov 10, 2023

FedeDP commented Nov 10, 2023

FedeDP commented Nov 14, 2023 •

edited

Loading

FedeDP commented Nov 27, 2023

FedeDP commented Nov 27, 2023

FedeDP commented Nov 27, 2023

FedeDP commented Nov 29, 2023

FedeDP commented Dec 1, 2023

FedeDP Dec 6, 2023

FedeDP Dec 6, 2023

leogr Dec 11, 2023

FedeDP commented Dec 6, 2023

FedeDP commented Dec 6, 2023

FedeDP commented Dec 6, 2023

FedeDP commented Dec 6, 2023

leogr left a comment

leogr Dec 11, 2023

FedeDP Dec 11, 2023

leogr Dec 11, 2023

leogr Dec 11, 2023

leogr Dec 11, 2023

Andreagit97 left a comment

poiana commented Dec 11, 2023

	echo " falco-driver-loader [driver] [options]"
	echo " falco-driver-loader [driver] [options]"

new: falcoctl driver loader #2905

new: falcoctl driver loader #2905

Conversation

FedeDP commented Nov 9, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leogr left a comment

Choose a reason for hiding this comment

FedeDP commented Nov 10, 2023

FedeDP commented Nov 10, 2023

FedeDP commented Nov 14, 2023 • edited Loading

FedeDP commented Nov 27, 2023

FedeDP commented Nov 27, 2023

FedeDP commented Nov 27, 2023

FedeDP commented Nov 29, 2023

FedeDP commented Dec 1, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FedeDP commented Dec 6, 2023

FedeDP commented Dec 6, 2023

FedeDP commented Dec 6, 2023

FedeDP commented Dec 6, 2023

leogr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Andreagit97 left a comment

Choose a reason for hiding this comment

poiana commented Dec 11, 2023

FedeDP commented Nov 14, 2023 •

edited

Loading