chore!: upgrade falco to 2.4.2

CHANGELOG.md

@@ -30,6 +30,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - feat(events)!: add config.merge option [#2643]
 - feat(terraform)!: expect load_config_file to be not set [#2648]
 - feat(otellogs)!: add config.merge option [#2652]
+- chore!: upgrade falco to 2.4.2 [#2659]
 
 ### Changed
 
@@ -92,6 +93,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#2649]: https://github.com/SumoLogic/sumologic-kubernetes-collection/pull/2649
 [#2654]: https://github.com/SumoLogic/sumologic-kubernetes-collection/pull/2654
 [#2652]: https://github.com/SumoLogic/sumologic-kubernetes-collection/pull/2652
+[#2659]: https://github.com/SumoLogic/sumologic-kubernetes-collection/pull/2659
 [Unreleased]: https://github.com/SumoLogic/sumologic-kubernetes-collection/compare/v2.17.0...main
 [telegraf_operator_comapare_1.3.5_and_1.3.10]: https://github.com/influxdata/helm-charts/compare/telegraf-operator-1.3.5...telegraf-operator-1.3.10
 [cert-manager-1.4]: https://github.com/cert-manager/cert-manager/releases/tag/v1.4.0

deploy/helm/sumologic/Chart.yaml

@@ -21,7 +21,7 @@ dependencies:
     repository: https://prometheus-community.github.io/helm-charts
     condition: kube-prometheus-stack.enabled,sumologic.metrics.enabled
   - name: falco
-    version: 1.18.6
+    version: 2.4.2
     repository: https://falcosecurity.github.io/charts
     condition: falco.enabled
   - name: metrics-server

deploy/helm/sumologic/values.yaml

@@ -4267,40 +4267,21 @@ falco:
     repository: sumologic/falco
     # pullSecrets: []
 
-  ## Add kernel-devel package through MachineConfig, required to enable building of missing falco modules (only for OpenShift)
-  addKernelDevel: true
-  ## Add initContainers to Falco pod
-  extraInitContainers:
-    ## Add initContainer to wait until kernel-devel is installed on host
-    - name: init-falco
-      image: public.ecr.aws/docker/library/busybox
-      command:
-        - 'sh'
-        - '-c'
-        - |
-          while [ -f /host/etc/redhat-release ] && [ -z "$(ls /host/usr/src/kernels)" ] ; do
-          echo "waiting for kernel headers to be installed"
-          sleep 3
-          done
-      volumeMounts:
-        - mountPath: /host/usr
-          name: usr-fs
-          readOnly: true
-        - mountPath: /host/etc
-          name: etc-fs
-          readOnly: true
   ## Enable eBPF support for Falco instead of falco-probe kernel module.
   ## Set to true for GKE, for details see:
   ## https://github.com/SumoLogic/sumologic-kubernetes-collection/blob/main/docs/troubleshoot-collection.md#falco-and-google-kubernetes-engine-gke
   # ebpf:
   #   enabled: true
   falco:
-    jsonOutput: true
+    load_plugins:
+      - json
+      - k8saudit
+    json_output: true
     ## The location of the rules file(s). This can contain one or more paths to
     ## separate rules files.
     ## Explicitly add missing /etc/falco/rules.available/application_rules.yaml
     ## before https://github.com/falcosecurity/charts/issues/230 gets resolved.
-    rulesFile:
+    rules_file:
       - /etc/falco/falco_rules.yaml
       - /etc/falco/falco_rules.local.yaml
       - /etc/falco/k8s_audit_rules.yaml

docs/v3-migration-doc.md

@@ -32,6 +32,8 @@ In this document we detail the changes as well as the exact steps for migration.
   or overwrite default configuration `metadata.metrics.config.override`
 - Removing support for `sumologic.cluster.load_config_file`.
   Leaving this configuration will result in setup job failure.
+- Upgrading Falco helm chart to `v2.4.2` which changed their configuration:
+  Please validate and adjust your configuration to new version according to [Falco documentation]
 
 ## How to upgrade
 
@@ -120,3 +122,5 @@ If you're using `otelcol` as the logs/metrics metadata provider, please run one
   kubectl delete sts --namespace=my-namespace --cascade=false my-release-sumologic-otelcol-logs
   kubectl delete sts --namespace=my-namespace --cascade=false my-release-sumologic-otelcol-metrics
   ```
+
+[Falco documentation]: https://github.com/falcosecurity/charts/tree/falco-2.4.2/falco