2.6.0

Changelog

[2.6.0] - 2025-02-10

Features

• Falco Upgrade - Upgrade falco to 0.39.2
  • Enhanced modern-bpf probe detection by probing kernels for bpf features
  • Fix kernel breaking issue for modern-bpf for kernels >= 6.6.11
  • New configuration options in Falco.yaml config
  • New falco rule enhancements available for custom rules including field transformer operators basename, regex and more. See latest Falco rules documentation for more details
  • Global logConfig.logLevel in helm values inherited for Falco containers

Bug Fixes

• Fix leader election failures in controllers due to small renew deadline causing the leader lease to be lost
• Fix labels provided in overrides not applying to policy operator or workload images remover job

Breaking Changes

• Removed configuration options for Falco. Custom falco.yaml or falco-customrules.yaml configuration maybe affected
  • Replaced rules_file with rules_files
  • Removed syscall_buf_size_preset
  • Removed syscall_drop_failed_exit
  • Replaced modern_bpf.cpus_for_each_syscall_buffer with engine.modern_ebpf.cpus_for_each_buffer
  • Replaced syscall_event_drops with the metrics config and some automatic notifications on syscall drops

Full Changelog: 2.5.5...2.6.0

Upgrade instructions

Sample upgrade command:

helm upgrade \
--values overrides.yaml \
--namespace trendmicro-system \
trendmicro \
https://github.com/trendmicro/cloudone-container-security-helm/archive/2.6.0.tar.gz