Use vanilla Falco #1343

Molter73 · 2023-09-22T13:13:40Z

Description

This change makes it so collector compiles and runs using upstream Falco directly. There are a few minor tweaks still required in Falco itself, but they are things that are either on their way to upstream or should be real ease to upstream.

List of changes needed for vanilla to be compatible:

Remove sinsp-wrapper and link directly to sinsp.
Remove sinsp_filter_check_iface in favor of sinsp_filter_check.
Use MINIMAL_BUILD instead of MINIMAL_BUILD_WITH_EBPF.
Remove g_bpf_drop_syscalls.
eBPF probe is compiled directly instead of via cmake.

Checklist

Investigated and inspected CI test results
Updated documentation accordingly

Automated testing

Added unit tests
Added integration tests
Added regression tests

If any of these don't apply, please comment below.

Testing Performed

TODO(replace-me)
Use this space to explain how you tested your PR, or, if you didn't test it, why you did not do so. (Valid reasons include "CI is sufficient" or "No testable changes")
In addition to reviewing your code, reviewers must also review your testing instructions, and make sure they are sufficient.

For more details, ref the Confluence page about this section.

openshift-ci · 2023-09-22T13:13:44Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2023-10-02T21:29:17Z

Kernel	Method	Without Collector Time (secs)	With Collector Time (secs)	Baseline median (secs)	Collector median (secs)	PValue

Needed to include the arm64 builder image

One side effect of [1] is that procexit is not included by default any more if ppm_sc is not empty. Which means to continue receiving procexit we need to explicitly add it into the list of interesting events. procexit is essential for memory management, as its handlers perform threadinfo cache clean up. [1]: falcosecurity/libs#1001

Turn on Falco assert logging for all build types. Make _DEBUG dependent on the Debug build type, it would impact asserts logic when asserts logging is disabled.

If CMAKE_BUILD_TYPE is debug, the condition for stripping the binary is not invoked, and the resulting exit code is 1, stopping the build. Ignore this branch and return exit code 0.

- s390x images are now built natively - ppc64le core-bpf is enabled - VM creation is consolidated in GHA - numerous improvements to ansible variables and multiarch VM creation

.github/workflows/collector-builder.yml

Makefile-constants.mk

ansible/ci-build-collector-full.yml

ovalenti

This overall looks good to me. Some parts are so much simpler 👍

ansible/group_vars/all.yml

.github/workflows/integration-tests.yml

ansible/roles/run-test-target/tasks/main.yml

Co-authored-by: Olivier Valentin <ovalenti@redhat.com>

openshift-ci bot added the do-not-merge/work-in-progress label Sep 22, 2023

Molter73 added build-legacy-probes all-integration-tests and removed do-not-merge/work-in-progress labels Sep 22, 2023

Molter73 force-pushed the mauro/use-falco-upstream branch from a16b87a to 376214b Compare September 22, 2023 13:25

Molter73 added the build-full-images label Sep 22, 2023

Molter73 force-pushed the mauro/use-falco-upstream branch from 376214b to db09a19 Compare September 22, 2023 13:25

Molter73 added the skip-multiarch-builds label Sep 22, 2023

Molter73 force-pushed the mauro/use-falco-upstream branch from 808394b to f8a8eed Compare September 22, 2023 14:34

Molter73 added the integration-tests-trace-logging Turn on additional logging in Collector label Oct 2, 2023

Molter73 force-pushed the mauro/use-falco-upstream branch from 0617786 to 068c0f2 Compare October 2, 2023 16:22

Molter73 force-pushed the mauro/use-falco-upstream branch 6 times, most recently from ff480e3 to 88e1c15 Compare October 11, 2023 07:53

erthalion force-pushed the mauro/use-falco-upstream branch from 0f329f0 to b834dd2 Compare October 17, 2023 15:49

Molter73 added run-multiarch-builds Run steps for non-x86 archs. and removed skip-multiarch-builds labels Oct 19, 2023

Molter73 force-pushed the mauro/use-falco-upstream branch 3 times, most recently from b6837ad to 2700d87 Compare October 25, 2023 11:25

Molter73 mentioned this pull request Oct 25, 2023

Facing issue while trying to build ebpf on power Rhel 8 #1391

Open

erthalion force-pushed the mauro/use-falco-upstream branch from 3eb4593 to ead8ac4 Compare October 31, 2023 13:24

Molter73 mentioned this pull request Nov 9, 2023

Configure ring buffer depth at build time #625

Closed

11 tasks

Molter73 force-pushed the mauro/use-falco-upstream branch from ead8ac4 to a8f6517 Compare November 10, 2023 11:05

Stringy force-pushed the mauro/use-falco-upstream branch from 071b476 to d9a6a31 Compare November 21, 2023 13:15

Molter73 and others added 4 commits January 3, 2024 08:33

Build builder image

d77321f

Needed to include the arm64 builder image

Assert logging

4a445d8

Turn on Falco assert logging for all build types. Make _DEBUG dependent on the Debug build type, it would impact asserts logic when asserts logging is disabled.

Fix exit code in the debug mode

08f1f2e

If CMAKE_BUILD_TYPE is debug, the condition for stripping the binary is not invoked, and the resulting exit code is 1, stopping the build. Ignore this branch and return exit code 0.

Stringy removed build-legacy-probes run-multiarch-tests run-multiarch-builds Run steps for non-x86 archs. skip-built-drivers labels Jan 3, 2024

Fix falco main commit

61f438b

Stringy force-pushed the mauro/use-falco-upstream branch from dd22a13 to 61f438b Compare January 3, 2024 08:39

Native s390x builds and multi-arch testing (#1448)

16fa1e4

- s390x images are now built natively - ppc64le core-bpf is enabled - VM creation is consolidated in GHA - numerous improvements to ansible variables and multiarch VM creation