Falco: Falco can't load BPF probe in GKE

[ariguillegp]

Describe the bug
I am getting errors when Falco 0.19.0 tries to get the BPF probe from the S3 bucket in AWS. If I use v0.18.0 it works fine using the SYSDIF_BPF_PROBE environment variable in the Daemonset manifest. Now, while I was trying to deploy the DaemonSet with Falco v0.19.0, if I use the environment variable SYSDIG_BPF probe I get the following error:

* Setting up /usr/src links from host
* Unloading falco-probe, if present
* Running dkms install for falco

Creating symlink /var/lib/dkms/falco/0.19.0/source ->
                 /usr/src/falco-0.19.0

DKMS: add completed.
Error! echo
Your kernel headers for kernel 4.14.150+ cannot be found at
/lib/modules/4.14.150+/build or /lib/modules/4.14.150+/source.
* Running dkms build failed, couldn't find /var/lib/dkms/falco/0.19.0/build/make.log
* Trying to load a system falco-probe, if present
* Trying to find precompiled falco-probe for 4.14.150+
Found kernel config at /proc/config.gz
* Trying to download precompiled module from https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/falco-probe-0.19.0-x86_64-4.14.150%2B-353b32428aa262ba1b77391c004ebacd.ko
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to s3.amazonaws.com:443
Download failed, consider compiling your own falco-probe and loading it or getting in touch with the Falco community
Thu Jan 23 20:19:52 2020: Falco initialized with configuration file /etc/falco/falco.yaml
Thu Jan 23 20:19:52 2020: Configured rules filenames:
Thu Jan 23 20:19:52 2020:    /etc/falco/falco_rules.yaml
Thu Jan 23 20:19:52 2020:    /etc/falco/k8s_audit_rules.yaml
Thu Jan 23 20:19:52 2020:    /etc/falco/application_rules.yaml
Thu Jan 23 20:19:52 2020:    /etc/falco/falco_rules.local.yaml
Thu Jan 23 20:19:52 2020: Loading rules from file /etc/falco/falco_rules.yaml:
Thu Jan 23 20:19:52 2020: Loading rules from file /etc/falco/k8s_audit_rules.yaml:
Thu Jan 23 20:19:52 2020: Loading rules from file /etc/falco/application_rules.yaml:
Thu Jan 23 20:19:52 2020: Loading rules from file /etc/falco/falco_rules.local.yaml:
Thu Jan 23 20:19:53 2020: Unable to load the driver. Exiting.
Thu Jan 23 20:19:53 2020: Runtime error: can't open BPF probe '/root/.sysdig/falco-probe-bpf.o': Errno 2. Exiting.

I can confirm it is not a connection issue becasuse it works with Falco 0.18.0
How to reproduce it

Just deploy the Falco daemonset to GKE as described in https://github.com/falcosecurity/falco/blob/dev/integrations/k8s-using-daemonset/k8s-with-rbac/falco-daemonset-configmap.yaml
Of course the section that enables the BPF behaviour needs to be uncommented.

Expected behaviour
Falco should be deployed as a daemonset in the K8s cluster using the eBPF approach.

Environment
Falco 0.19.0 running as a daemonset in GKE.

• Falco version: 0.19.0
• Cloud provider or hardware configuration: GCP
• OS: COS
• Kernel: 4.14.150+
• Installation method:
  Kubernetes

[Thyrst]

Hello, I have probably the same issue. It looks like COS is not detected. With Falco 0.18.0 everything works fine.

[mestrade]

Same behavior with 0.20.
By changing the environment variable to BPF_PROBE="" instead of FALCO_BPF_PROBE, it works. but then falco refuse to start.

[mestrade]

Worked on my side with the following setup:

GKE COS node

env:
          - name: BPF_PROBE
            value: ""
          - name: SYSDIG_BPF_PROBE
            value: "/root/.falco/falco-probe-bpf.o"

[Thyrst]

Worked on my side with the following setup:

GKE COS node

env:
          - name: BPF_PROBE
            value: ""
          - name: SYSDIG_BPF_PROBE
            value: "/root/.falco/falco-probe-bpf.o"

Cool! Works for me too.

[fntlnz]

This was fixed in https://github.com/falcosecurity/falco/pull/1050

[fntlnz]

Will be released in 0.20.1

[fntlnz]

For all those updating falco after 0.20.1, remember that those two variables reported here are gone now in favor of a single FALCO_BPF_PROBE variable

[degilq]

we have same problem with bpf and gke
Falco can't load BPF probe in GKE
Im using falcosecurity/falco:latest and the env

• name: BPF_PROBE
  value: ""
  - name: FALCO_BPF_PROBE
  value: "/root/.falco/falco-probe-bpf.o"

[irivera007]

Im facing this same issue right now, Im using the GKE marketplace version and all of a sudden all pods are failing. I enabled the eBPF and my cluster runs GCOS
First with:
"Unable to load the driver. Exiting."
Second:
"Runtime error: can't open BPF probe '/root/.sysdig/falco-probe-bpf.o': No such file or directory. Exiting."

Seems like it tries to download:
https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/falco-probe-bpf-0.14.0-x86_64-4.14.138%2B-3ed0774cb82bc5c7f3b6f5190c3b82ef.o
and returns a 404
and then a "Failure to find a BPF probe"
Not sure if related

Any idea?

Thank you