WIP

Author: lsroe

charts/internal/falco/templates/0helpers.tpl

@@ -89,7 +89,7 @@ Return the proper Falco image name
     {{- . }}/
 {{- end -}}
 {{- .Values.image.repository }}:
-{{- .Values.image.tag | default (printf "%s" .Chart.AppVersion) -}}
+{{- .Values.image.tag | default .Chart.AppVersion -}}
 {{- end -}}
 
 {{/*

charts/internal/falco/templates/falco-configmap.yaml

@@ -12,3 +12,7 @@ data:
     {{- include "falco.gardenerManagedRules" . }}
     {{- end }}
     {{- toYaml .Values.falco | nindent 4 }}
+    {{- include "falco.containerPlugin" . -}}
+    {{- include "k8smeta.configuration" . -}}
+
+

charts/internal/falco/templates/falco-pod-template.tpl

@@ -424,8 +424,8 @@ spec:
       {{- $securityContext := set $securityContext "privileged" true -}}
     {{- end -}}
   {{- end -}}
-  {{- if eq .Values.driver.kind "modern-bpf" -}}
-    {{- if .Values.driver.modern_bpf.leastPrivileged -}}
+  {{- if (or (eq .Values.driver.kind "modern_ebpf") (eq .Values.driver.kind "modern-bpf")) -}}
+    {{- if .Values.driver.modernEbpf.leastPrivileged -}}
       {{- $securityContext := set $securityContext "capabilities" (dict "add" (list "BPF" "SYS_RESOURCE" "PERFMON" "SYS_PTRACE")) -}}
     {{- else -}}
       {{- $securityContext := set $securityContext "privileged" true -}}

charts/internal/falco/values.yaml

@@ -202,11 +202,11 @@ driver:
     # Read more on that here: https://falco.org/docs/event-sources/kernel/#least-privileged-mode-1
     leastPrivileged: false
   # -- Configuration section for modern bpf driver.
-  modern_bpf:
+  modernEbpf:
     # -- Constrain Falco with capabilities instead of running a privileged container.
     # Ensure the modern bpf driver is enabled (i.e., setting the `driver.kind` option to `modern-bpf`).
     # Capabilities used: {CAP_SYS_RESOURCE, CAP_BPF, CAP_PERFMON, CAP_SYS_PTRACE}.
-    # Read more on that here: https://falco.org/docs/event-sources/kernel/#least-privileged-mode-2
+    # Read more on that here: https://falco.org/docs/setup/container/#docker-least-privileged-ebpf-probe
     leastPrivileged: false
     # -- bufSizePreset determines the size of the shared space between Falco and its drivers.
     # This shared space serves as a temporary storage for syscall events.

pkg/values/falcovalues.go

@@ -15,6 +15,7 @@ import (
 	"strconv"
 	"strings"
 
+	semver3 "github.com/Masterminds/semver/v3"
 	"github.com/gardener/gardener/extensions/pkg/controller"
 	"github.com/gardener/gardener/pkg/extensions"
 	"github.com/go-logr/logr"
@@ -234,8 +235,11 @@ func (c *ConfigBuilder) BuildFalcoValues(ctx context.Context, log logr.Logger, c
 			"networking.gardener.cloud/to-falcosidekick": "allowed",
 		},
 		"priorityClassName": *c.config.Falco.PriorityClassName,
-		"driver": map[string]string{
-			"kind": "modern-bpf",
+		"driver": map[string]any{
+			"kind": "modern_ebpf",
+			"loader": map[string]bool{
+				"enabled": false,
+			},
 		},
 		"image": map[string]string{
 			"image": falcoImage,
@@ -250,6 +254,12 @@ func (c *ConfigBuilder) BuildFalcoValues(ctx context.Context, log logr.Logger, c
 			"docker": map[string]bool{
 				"enabled": false,
 			},
+			"containerd": map[string]bool{
+				"enabled": true,
+			},
+			"containerEngine": map[string]bool{
+				"enabled": false,
+			},
 		},
 		"extra": map[string]interface{}{
 			"env": []map[string]string{
@@ -300,6 +310,9 @@ func (c *ConfigBuilder) BuildFalcoValues(ctx context.Context, log logr.Logger, c
 	if err := c.generateHeartbeatRule(falcoChartValues, falcoServiceConfig, falcoVersion); err != nil {
 		return nil, err
 	}
+	if err := c.enableContainerPlugin(falcoChartValues, falcoVersion); err != nil {
+		return nil, err
+	}
 	return falcoChartValues, nil
 }
 
@@ -371,6 +384,19 @@ func (c *ConfigBuilder) generateHeartbeatRule(falcoChartValues map[string]interf
 	return nil
 }
 
+func (c *ConfigBuilder) enableContainerPlugin(falcoChartValues map[string]interface{}, falcoVersion *string) error {
+	constraint, _ := semver3.NewConstraint(">= 0.41.2")
+	v, err := semver3.NewVersion(*falcoVersion)
+	if err != nil {
+		return fmt.Errorf("invalid falco version %s: %w", *falcoVersion, err)
+	}
+	if constraint.Check(v) {
+		falcoChartValues["collectors"].(map[string]any)["containerEngine"].(map[string]bool)["enabled"] = true
+		falcoChartValues["collectors"].(map[string]any)["containerd"].(map[string]bool)["enabled"] = false
+	}
+	return nil
+}
+
 func (c *ConfigBuilder) generateStandardRules(falcoChartValues map[string]interface{}, falcoServiceConfig *apisservice.FalcoServiceConfig, falcoVersion *string) error {
 	if falcoServiceConfig.Rules.StandardRules != nil {
 		for _, rule := range *falcoServiceConfig.Rules.StandardRules {