new: driver selection in falco.yaml

[therealbobo]

Signed-off-by: Roberto Scolaro roberto.scolaro21@gmail.com

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area tests

/area proposals

/area CI

What this PR does / why we need it:

It might be useful to configure the driver mode via the configuration file falco.yaml

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

new: driver selection in falco.yaml

[Andreagit97]

Thank you for this! @therealbobo
We discussed many times to uniform how we open engines and this could be a possible way
cc @leogr

[leogr]

Thank you for this! @therealbobo We discussed many times to uniform how we open engines and this could be a possible way cc @leogr

It could be a possible solution. However, how could that option interact with other ways to select the driver?
I specifically refer to the FALCO_BPF_PROBE env var and other esoteric options like -u or how we enable the gVisor support.

Let's discuss it!

[therealbobo]

I think that the driver selected in falco.yaml should be considered if and only if the driver to be used is not specified in any other way (e.g. env variable or args). Moreover, using the config file, it will possibile to simplify the service management. 🤔

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[FedeDP]

/reopen

/remove-lifecycle stale

[poiana]

@FedeDP: Reopened this PR.

In response to this:

/reopen

/remove-lifecycle stale

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[FedeDP]

/milestone 0.37.0

[FedeDP]

We actually need this for the shiny new falco-driver-loader integrated inside falcoctl: falcosecurity/falcoctl#327

[FedeDP]

I'd suggest a rebase, and then:

• DEPRECATION NOTICE for FALCO_BPF_PROBE
• DEPRECATION NOTICE for cmd line options (note that -u was already dropped in the meantime, so i think that only the modern-bpf related one survives today)

Imho config option should always take precedence over deprecated cmdline/env var, since otherwise falcoctl would not be able to correctly instrument the right driver for Falco.

/cc @leogr

[LucaGuerra]

Thank you for this! 😮 LGTM, let's merge it so we can test it better. This is something we needed 😅

[poiana]

LGTM label has been added.

Git tree hash: f99a5c87c0a21f7dc134467c3c73787ba75ee22f

[leogr]

For sure we need to deeply test it, but LGTM at the moment!

Thank you'll!

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, leogr, LucaGuerra, therealbobo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97,LucaGuerra,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment