Cut 0.32.0 Release

[FedeDP]

Scheduled to happen: ~2022-05-31

Release Steps

Process is described in this document.

Release Blocking PRs

• new(libscap): add parsers for gVisor seccheck messages libs#318
• new(userspace/falco): added an option to listen to changes on the config file and rules files, and trigger a Falco reload #1991
• Include origin host in output json #1989
• New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-0492) #1969
• cleanup plugins rules files #1995
• fix(driver): initialize event_filler_arguments to fix is_socketcall on aarch64 libs#323
• update: updated driverkit to 0.8.0. test-infra#693
• refactor(userspace/libsinsp)!: refactor inspector interface for creating plugins libs#325
• new: port CI builds to github actions #2000
• fix: split filterchecks per source-idx #1999
• fix(libscap): add defines in userspace_flags_helpers.h for alpine-musl/centos7 builds that don't have them libs#331
• update(build): allow gvisor compilation toggle -DBUILD_LIBSCAP_GVISOR libs#330
• update(cmake): Update libcurl to 7.83.1 libs#349
• update(cmake): bump OpenSSL to 1.1.1o libs#348
• fix(userspace/engine): improve rule loader source checks #2010
• update(userspace/falco): improve falco termination #2012
• update(userspace/engine): introduce new check_plugin_requirements API #2009
• refactor(userspace): change falco engine design to properly support multiple sources #2017
• build: cmake components libs#350
• fix(userspace/falco): enable k8s and mesos clients only when syscall source is enabled #2019
• new: update plugins #2023
• fix: move definitions to inner CMakeLists.txt(s) and correct add_user/add_group libs#361
• update(build): updated libs to 1be924900a09cf2e4db4b4ae13d03d838959f350 #2024
• fix(falco-scripts): remove driver versions with dkms-3.0.3 #2027
• fix(userspace/libsinsp): immediately add synchronously spotted containers to list of containers libs#364
• update(build): updated libs to 39ae7d40496793cf3d3e7890c9bbdc202263836b for Falco 0.32.0 #2031
• chore(userpace/falco): do not print error code in process_events.cpp #2030
• update(build): updated plugins to latest versions. #2033

Nice-to-have PRs

• refactor(userspace/libsinsp)!: introducing plugin manager libs#313

Driverkit

• new(driverkit): allow configurable builder images driverkit#113

Action Items

• Pre-Release
  • Pick a final driver version in Falco: 39ae7d40496793cf3d3e7890c9bbdc202263836b
  • Release and publish plugins
  • Prebuilt drivers publish: new(driverkit/config): add driver version 39ae7d40496793cf3d3e7890c9bbdc202263836b test-infra#709
  • Milestones: https://github.com/falcosecurity/falco/milestone/22
  • Changelog: docs(changelog): added 0.32.0 release notes. #2035
• Release
  • Tag
  • Github Release
• Docs
• Website
• Announcements
  • new(content): added Falco 0.32 blog post falco-website#606
  • mailing list
  • slack channel
• Post-Release
  • update(config): archive 0.31. falco-website#611
  • update(config): set v0.31 branch for falco-website as protected. test-infra#711
  • update(config): updated website config for 0.32.0. falco-website#608
  • refactor(docs/plugins): update plugin documentation for 1.0.0 version changes falco-website#581
  • refactor(docs): update documentation of k8s audit events support falco-website#584
  • new(content): updated supported events for 0.32.0. falco-website#607
  • update(meeting-notes): added 0.32.0 release meeting notes. community#148

Open Questions

/milestone 0.32.0

/assign @FedeDP

/kind documentation

[poiana]

@FedeDP: You must be a member of the falcosecurity/maintainers GitHub team to set the milestone. If you believe you should be able to issue the /milestone command, please contact your Falco maintainers and have them propose you as an additional delegate for this responsibility.

In response to this:

Scheduled to happen: ~2022-05-31

Release Steps

Process is described in this document.

Release Blocking PRs

• [part 1/n] Introduce vtable-based dispatch
• wip: new(libscap): add parsers for gVisor seccheck messages
• new(userspace/falco): added an option to listen to changes on the config file and rules files, and trigger a Falco reload
• Include origin host in output json
• Falco Rules/Conditions update
• New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-0492)

Moreover, a new release of Driverkit is needed, because latest release (0.7.0) has a bug that prevents amazonlinux drivers builds.

Nice-to-have PRs

• wip: refactor(userspace/libsinsp)!: introducing plugin manager
• update(libsinsp): drop also untracked syscalls in kernel-side simple consumer mode
• new(docker,scripts): port all docker images to be multiarch ready
• Add job to generate configs from crawled kernels

Driverkit

• new(driverkit): allow configurable builder images
• new: arm64 support

Action Items

• Pre-Release
• Pick a final driver version in Falco
• Release and publish plugins
• Prebuilt drivers publish
• Milestones: https://github.com/falcosecurity/falco/milestone/22
• Changelog
• Release
• Tag
• Github Release
• Docs
• Website
• Announcements
• Post-Release

Open Questions

/milestone 0.32.0

/assign @FedeDP

/kind documentation

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[FedeDP]

/cc @leogr @jasondellaluce

[leogr]

Hey @FedeDP

Could you include #1994 too, please? 🙏

[FedeDP]

Of course!

[jasondellaluce]

Hey @FedeDP, I just opened a PR in falco-website to update the plugins documentation with the newest plugin API changes (falcosecurity/falco-website#581). Would you add it to the list of post-release actions? This is also tracked in #1948 as a backup.

[jasondellaluce]

@FedeDP, would you add falcosecurity/falco-website#584 to the list? This is the docs migration from the legacy k8s audit implementation to the plugin-based one. This would fit in the post-release actions.

[FedeDP]

Yay!

[leogr]

Hey @FedeDP

Since the upcoming release is very close, we don't have enough time to test the ARM support. Should we move it to the next release?

[FedeDP]

It's very sad to hear that :(
But i agree with you, we have no time to thoroughly test this! It would be great to have a patch release for this though, perhaps as soon as we are confident with the changes.

Providing arm64 artifacts for Falco has a huge value!

[leogr]

It would be great to have a patch release for this though, perhaps as soon as we are confident with the changes.

I totally agree. We are very close to achieving official support for ARM64, but we have some stuff to fix and try. I'm ok with releasing a patch release once we fix the pending issues.

[leogr]

This release looks very nice 😎

[FedeDP]

It's because of the release manager sir 👑

[FedeDP]

We have to bump driverversion unfortunately as during our tests we spotted some issues.

[leogr]

We have to bump driverversion unfortunately as during our tests we spotted some issues.

Just testing the fix 👉 falcosecurity/libs#361 😎

[FedeDP]

We will need to bump driverversion once more given that we found a couple of bugs during our tests :(

[leogr]

Quick update regarding plugins.

We performed some manual tests on plugins and found some issues. Because of that, we need to release a new version of the go SDK. Then we will have to release and bump all plugins again.

However, we are confident that we will complete those tasks today. I'll keep you posted.

[FedeDP]

New plugins are released and the PR to upgrade them in Falco is opened: #2033

[FedeDP]

The changelog PR is opened: #2035

[FedeDP]

Falco 0.32 is out! https://github.com/falcosecurity/falco/releases/tag/0.32.0

/close

[poiana]

@FedeDP: Closing this issue.

In response to this:

Falco 0.32 is out! https://github.com/falcosecurity/falco/releases/tag/0.32.0

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.