Learning Environment
minikube
The easiest way to use Falco on Kubernetes in a local environment is on Minikube.
When running minikube
with one of the following drivers virtualbox, qemu, kvm2
, it creates a VM that runs the various Kubernetes services and a container framework to run Pods, etc. Generally, it's not possible to build the Falco kernel module directly on the minikube
VM, as the VM doesn't include the kernel headers for the running kernel.
To address this, starting with Falco 0.33.0 prebuilt kernel modules
and bpf probes
for the last 3 minikube
major versions, including minor versions, are available at https://download.falco.org/?prefix=driver/. This allows the download fallback step to succeed with a loadable driver. New versions of minikube
are automatically discovered by the kernel-crawler and periodically built by test-infra. The supported versions can be found at https://falcosecurity.github.io/kernel-crawler/?target=Minikube&arch=x86_64. Falco currently retains previously-built kernel modules for download and continues to provide limited historical support as well.
You can follow the official Get Started! guide to install.
View minikube Get Started! Guide
Note: Ensure that you have installed kubectl.
Falco with syscall source
In order to install Falco with the kernel module
or the bpf probe
:
Create the cluster with Minikube using a VM driver, in this case, Virtualbox:
Check that all pods are running:
Add the Falco Helm repository and update the local Helm repository cache:
Install Falco using Helm:
With kernel module:
With bpf probe:
With modern-bpf probe(recommended):
The output is similar to:
Check the logs to ensure that Falco is running:
The output is similar to:
Falco with multiple sources
Here we run Falco in minikube
cluster with multiple sources: syscall
and k8s_audit
. The next steps show how to start a minikube
cluster with the audit logs enabled and deploy Falco with the kernel module
and the k8saudit plugin
:
First, we need to create a new folder under the configuration folder of
minikube
:We are assuming that the
minikube
configuration folder lives in your home folder otherwise, adjust the command according to your environment.Let's create the needed configuration files to enable the
audit logs
. We are going to create a new file under~/.minikube/files/etc/ssl/certs
namedaudit-policy.yaml
and copy the required config into it. Copy the following snippet into your terminal shell:Create the file
webhook-config.yaml
and save the required configuration needed by thek8s api-server
to send the audit logs to Falco:Once the configuration files are in place we are ready to start the
minikube
cluster:
We need at least 4 CPUs for the VM to deploy Falco with multiple sources!
Before installing Falco, let us configure it to use the
syscall
andk8saudit
sources:
If you need to change the port numbers then make sure to change them also in the `webhook` configuration file in step 2.
Add the Falco Helm repository and update the local Helm repository cache:
Assuming the configuration showed in the previous step lives in the current directory
values-falco-syscall-k8saudit.yaml
, then run the following command to deploy Falco in theminikube
cluster:Check that the Falco pod is up and running:
Execute the following command and keep the terminal open:
The command will follow the log stream of the Falco pod by printing the logs as soon as Falco emits them. And make sure that the following lines are present:
It means that Falco is running with the configured sources.
Trigger some rules to check that Falco works as expected. Open a new terminal and make sure that your
kubeconfig
points to the minikube cluster. Then run:- Trigger a
k8saudit
rule:In the terminal that we opened in step 8 we should see a log line like this: - Trigger a Falco rule:Check that a log similar to this one has been printed:
- Trigger a
kind
kind
lets you run Kubernetes on
your local computer. This tool requires that you have
Docker installed and configured.
Currently not working directly on Mac with Linuxkit, but these directions work on Linux guest OS running kind
.
The kind Quick Start page shows you what you need to do to get up and running with kind.
To run Falco on a kind
cluster is as follows:
Create a configuration file. For example:
kind-config.yaml
Add the following to the file:
Create the cluster by specifying the configuration file:
Install Falco on a node in the kind cluster. To install Falco as a daemonset on a Kubernetes cluster use Helm. For more information about the configuration of Falco charts, see https://github.com/falcosecurity/charts/tree/master/charts/falco.
MicroK8s
MicroK8s is the smallest, fastest multi-node Kubernetes. Single-package fully conformant lightweight Kubernetes that works on Linux, Windows and Mac. Perfect for: Developer workstations, IoT, Edge, CI/CD.
You can follow the official Getting Started guide to install.
View MicroK8s Getting Started Guide
To run Falco on MicroK8s:
- Install Falco on a node in the MicroK8s cluster. To install Falco as a daemonset on a Kubernetes cluster use Helm. For more information about the configuration of Falco charts, see https://github.com/falcosecurity/charts/tree/master/charts/falco.
Was this page helpful?
Let us know! You feedback will help us to improve the content and to stay in touch with our users.
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.