Having issues deploying to GKE - Falco fails about sumologic-kubernetes-collection

[emcay]

Im having this issue, but on EKS.

k8s: v1.14.9-eks-c0eccc

App version: 0.10.0

Trying to download precompiled module from https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/falco-probe-0.17.1-x86_64-4.14.154-128.181.amzn2.x86_64-2a1b4e38248e08669f1ed37604b3ad74.ko
curl: (22) The requested URL returned error: 404 Not Found

[vsinghal13]

Have you tried this solution? Seems to have worked. falcosecurity/falco#624

[Colbize]

Had the same issue, containers were stuck in restarting phase.
K8s: "v1.14.9-eks-c0eccc"

Solution was to follow the installation in -> https://falco.org/docs/installation/
on our amz2 linux worker nodes:

rpm --import https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public
curl -s -o /etc/yum.repos.d/draios.repo https://s3.amazonaws.com/download.draios.com/stable/rpm/draios.repo
yum -y install kernel-devel-$(uname -r)
yum -y install falco

[daroga0002]

Have you tried this solution? Seems to have worked. falcosecurity/falco#624

this solution is problematic in case when you use EKS node groups where you are restricted to AWS AMIs to which you cannot pass any additional parameters.

[vsinghal13]

@daroga0002 have you tried using v 0.18.0 of falco on EKS 1.14 as other versions do not seem to have the precompiled kernel modules. ?

[daroga0002]

yes, even tried to bump version to 0.19 and 0.20 from https://github.com/falcosecurity/falco/releases

[frankreno]

@chelapa @emcay @Colbize @daroga0002 - Please see #687 with a workaround. This has been tested in EKS and should work in other environments.