Error running in Kubernetes based on Kops AMI

[ApsOps]

Running as daemonset in Kubernetes v1.9.6 based on Kops debian stretch AMI.

~$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 9 (stretch)"
NAME="Debian GNU/Linux"
VERSION_ID="9"
VERSION="9 (stretch)"
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

Pods crashing. Logs:

* Setting up /usr/src links from host
* Unloading falco-probe, if present
rmmod: ERROR: Module falco_probe is not currently loaded
* Running dkms install for falco

Kernel preparation unnecessary for this kernel.  Skipping...

Building module:
cleaning build area...
make -j4 KERNELRELEASE=4.9.0-5-amd64 -C /lib/modules/4.9.0-5-amd64/build M=/var/lib/dkms/falco/0.10.0/build...(bad exit status: 2)
Error! Bad return status for module build on kernel: 4.9.0-5-amd64 (x86_64)
Consult /var/lib/dkms/falco/0.10.0/build/make.log for more information.
* Running dkms build failed, dumping /var/lib/dkms/falco/0.10.0/build/make.log
DKMS make.log for falco-0.10.0 for kernel 4.9.0-5-amd64 (x86_64)
Wed May 30 06:07:29 UTC 2018
make: Entering directory '/host/usr/src/linux-headers-4.9.0-5-amd64'
arch/x86/Makefile:140: CONFIG_X86_X32 enabled but no binutils support
/host/usr/src/linux-headers-4.9.0-5-common/scripts/gcc-version.sh: line 25: gcc-6: command not found
/host/usr/src/linux-headers-4.9.0-5-common/scripts/gcc-version.sh: line 26: gcc-6: command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
make[2]: gcc-6: Command not found
  LD      /var/lib/dkms/falco/0.10.0/build/built-in.o
  CC [M]  /var/lib/dkms/falco/0.10.0/build/main.o
/bin/sh: 1: gcc-6: not found
make[3]: *** [/host/usr/src/linux-headers-4.9.0-5-common/scripts/Makefile.build:298: /var/lib/dkms/falco/0.10.0/build/main.o] Error 127
make[3]: *** Waiting for unfinished jobs....
make[2]: *** [/host/usr/src/linux-headers-4.9.0-5-common/Makefile:1510: _module_/var/lib/dkms/falco/0.10.0/build] Error 2
make[1]: *** [Makefile:150: sub-make] Error 2
make: *** [Makefile:8: all] Error 2
make: Leaving directory '/host/usr/src/linux-headers-4.9.0-5-amd64'
* Trying to load a system falco-probe, if present
* Trying to find precompiled falco-probe for 4.9.0-5-amd64
Found kernel config at /host/boot/config-4.9.0-5-amd64
* Trying to download precompiled module from https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/falco-probe-0.10.0-x86_64-4.9.0-5-amd64-ee001c6bfb0cedce69a9bb978ba15926.ko
Download failed, consider compiling your own falco-probe and loading it or getting in touch with the sysdig community
Wed May 30 06:07:30 2018: Falco initialized with configuration file /etc/falco/falco.yaml
Wed May 30 06:07:30 2018: Loading rules from file /etc/falco/falco_rules.yaml:
Wed May 30 06:07:30 2018: Loading rules from file /etc/falco/falco_rules.local.yaml:
Wed May 30 06:07:30 2018: Unable to load the driver. Exiting.
Wed May 30 06:07:30 2018: Runtime error: error opening device /host/dev/falco0. Make sure you have root credentials and that the falco-probe module is loaded.. Exiting.

Tried both stable and dev falco image.

[mstemm]

Looks like you don't have gcc installed. Can you install it?

[ApsOps]

@mstemm Shouldn't gcc already be installed in the falco docker image? 🤔

[mfdii]

I was able to recreate the error using the k8s-1.9-debian-stretch-amd64-hvm-ebs-2018-03-11 AMI in EC2.

Manually installing gcc-6 inside the falco container and then rerunning the falco-probe-loader successfully builds the kernel module.