You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am attempting to include additional rule files including the sandbox and incubating rules. I'm doing this in a Helm chart using the following documentation here to add the following config:
I have also tried this with falco Helm chart version 4.7.2 and with rules_files and that did not work either.
Expected behaviour
I expect the falco-incubating_rules.yaml, falco-sandbox_rules.yaml and k8s_audit_rules.yaml rule files to load in my pod, in addition to the default falco_rules.yaml. However, only falco_rules.yaml loads.
Here are my kubernetes pod logs to confirm that only falco_rules.yaml is being loaded:
Defaulted container "falco" out of: falco, falcoctl-artifact-follow, falco-driver-loader (init), falcoctl-artifact-install (init)
Fri Aug 9 02:15:21 2024: Using deprecated config key 'rules_file' (singular form). Please use new 'rules_files' config key (plural form).
Fri Aug 9 02:15:21 2024: Falco version: 0.38.1 (x86_64)
Fri Aug 9 02:15:21 2024: Falco initialized with configuration files:
Fri Aug 9 02:15:21 2024: /etc/falco/falco.yaml
Fri Aug 9 02:15:21 2024: System info: Linux version 5.10.219-208.866.amzn2.x86_64 (mockbuild@ip-10-0-35-201) (gcc10-gcc (GCC) 10.5.0 20230707 (Red Hat 10.5.0-1), GNU ld version 2.35.2-9.amzn2.0.1) falcosecurity/rules#1 SMP Tue Jun 18 14:00:06 UTC 2024
Fri Aug 9 02:15:21 2024: Loading rules from file /etc/falco/falco_rules.yaml
Environment
Falco version:
4.7.0 and 4.7.2
OS:
MacOS M1
Kernel:
Darwin VGW0681 23.6.0 Darwin Kernel Version 23.6.0: Fri Jul 5 17:56:41 PDT 2024; root:xnu-10063.141.1~2/RELEASE_ARM64_T6000 arm64
Installation method:
Kubernetes Helm
The text was updated successfully, but these errors were encountered:
Description
I am attempting to include additional rule files including the sandbox and incubating rules. I'm doing this in a Helm chart using the following documentation here to add the following config:
But my config is not being respected.
How to reproduce it
Here is my
Chart.yaml
:Here is my
values.yaml
file:I have also tried this with falco Helm chart version
4.7.2
and withrules_files
and that did not work either.Expected behaviour
I expect the
falco-incubating_rules.yaml
,falco-sandbox_rules.yaml
andk8s_audit_rules.yaml
rule files to load in my pod, in addition to the defaultfalco_rules.yaml
. However, onlyfalco_rules.yaml
loads.Here are my kubernetes pod logs to confirm that only
falco_rules.yaml
is being loaded:Environment
4.7.0 and 4.7.2
MacOS M1
Darwin VGW0681 23.6.0 Darwin Kernel Version 23.6.0: Fri Jul 5 17:56:41 PDT 2024; root:xnu-10063.141.1~2/RELEASE_ARM64_T6000 arm64
Kubernetes Helm
The text was updated successfully, but these errors were encountered: