False positives in Azure Kubernetes Service

[AlexDCraig]

Describe the bug

Spinning up Falco on AKS yields this alert:

{
  "output": "16:43:01.393393906: Notice Namespace change (setns) by unexpected program (user=<NA> command=<NA> parent=<NA> k8s.ns=<NA> k8s.pod=<NA> container=host container_id=host image=<NA>:<NA>) k8s.ns=<NA> k8s.pod=<NA> container=host k8s.ns=<NA> k8s.pod=<NA> container=host",
  "priority": "Notice",
  "rule": "Change thread namespace",
  "time": "2020-05-01T16:43:01.393393906Z",
  "output_fields": {
    "container.id": "host",
    "container.image.repository": null,
    "container.image.tag": null,
    "evt.time": 1588351381393394000,
    "k8s.ns.name": null,
    "k8s.pod.name": null,
    "proc.cmdline": "<NA>",
    "proc.pname": null,
    "user.name": null
  }
}

How to reproduce it

Install Falco 0.21.0 in a AKS 1.16.7 cluster. Check the daemonset logs.

Expected behaviour

To not fire an alert for this behavior.

Environment

Azure AKS, Kubernetes 1.16.7

• Falco version:
  0.21.0

• Installation method:
  Helm

Additional context

This is really similar to this issue: #439

[fntlnz]

@AlexDHoffer can you please update to Falco 0.22.0 and maybe post here the flags you start Falco with? We need to understand why that False positive happens in the first place and the output line is filled with NAs which is a thing we put a lot of effort to solve in 0.22.0 with both Falco and configuration changes.

[AlexDCraig]

@fntlnz upgrading to 0.22.0 seemed to help.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[fntlnz]

I think we can close this, we are on 0.23.0 now and 0.24.0 will contain even more fixes on NAs.

Thanks for your help @AlexDHoffer

/close

[poiana]

@fntlnz: Closing this issue.

In response to this:

I think we can close this, we are on 0.23.0 now and 0.24.0 will contain even more fixes on NAs.

Thanks for your help @AlexDHoffer

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.