Falco: Runtime error: Socket handler (k8s_pod_handler_state): read more than 30MB of data

Created on 21 Aug 2019  Ā·  22Comments  Ā·  Source: falcosecurity/falco

What happened:
We observed an error log under a large scale load test.

Wed Aug 21 02:21:40 2019: Runtime error: Socket handler (k8s_pod_handler_state): read more than 30MB of data from https://10.40.48.1/api/v1/pods?fieldSelector=status.phase!=Failed,status.phase!=Unknown,status.phase!=Succeeded&pretty=false (31463287 bytes, 2162 reads). Giving up. Exiting.

What you expected to happen:
Falco should work in a large scale Kubernetes cluster.

How to reproduce it (as minimally and precisely as possible):
Use a large Kubernetes cluster with > 1k node and > 10k PODs.

Anything else we need to know?:

Environment:

  • Falco version (use falco --version):
    falco version 0.1.2736dev
  • System info