UNCLASSIFIED - NO CUI

Skip to content

Update falcosecurity/falco Docker tag to v0.37.0

Ghost User requested to merge renovate/falcosecurity-falco-0.x into development

This MR contains the following updates:

Package Type Update Change
falcosecurity/falco minor 0.36.2 -> 0.37.0
falcosecurity/falco ironbank-docker minor 0.36.2 -> 0.37.0
falcosecurity/falco stage minor 0.36.2 -> 0.37.0

Release Notes

falcosecurity/falco (falcosecurity/falco)

v0.37.0

Compare Source

Released on 2024-01-30

Breaking Changes
  • The deprecated rate-limiter mechanism is removed as it is no longer used.
    • the deprecated outputs.rate Falco config is removed.
    • the deprecated outputs.max_burst Falco config is removed.
  • The deprecated --userspace CLI option is removed as it is no longer used.
  • The falco-driver-loader script will be removed and embedded into falcoctl. The new falcoctl driven implementation will drop:
    • --source-only CLI option.
    • BPF_USE_LOCAL_KERNEL_SOURCES environment variable.
    • DRIVER_CURL_OPTIONS environment variable.
    • FALCO_BPF_PROBE environment variable is not used by the new falcoctl driver loader, since it is already deprecated and will be removed in the next major version. Some env vars were renamed:
    • DRIVERS_REPO env variable has been replaced by FALCOCTL_DRIVER_NAME or --name command line argument for falcoctl driver command
    • DRIVERS_NAME env variable has been replaced by FALCOCTL_DRIVER_REPOS, or --repo command line argument for falcoctl driver command
    • DRIVER_KERNEL_RELEASE env variable has been replaced by --kernelrelease command line argument for falcoctl driver install command
    • DRIVER_KERNEL_VERSION env variable has been replaced by --kernelversion command line argument for falcoctl driver install command
    • DRIVER_INSECURE_DOWNLOAD env variable has been replaced by --http-insecure command line argument for falcoctl driver install command
  • Remove -K/-k options from Falco in favor of the new k8smeta plugin.
  • Drop plugins shipped with Falco since plugins are now be managed by falcoctl.
  • Falco 0.37.0 allows environment variables to be expanded even if they are part of a string. This introduces small breaking changes:
    • Previously, environment variables used in YAML that were empty or defined as “” would be expanded to the default value. This was not consistent with the way YAML was handled in other cases, where we only returned the default values if the node was not defined. Now expanded env vars retain the same behavior of all other variables.
    • Falco 0.37.0 will return default value for nodes that cannot be parsed to chosen type.
    • program_output command will be env-expanded at init time, instead of letting popen and thus the sh shell expand it. This is technically a breaking change even if no behavioral change is expected. Also, you can avoid env var expansion by using ${{FOO}} instead of ${FOO}. It will resolve to ${FOO} and won't be resolved to the env var value.
Major Changes
  • new!: dropped falco-driver-loader script in favor of new falcoctl driver command [#​2905] - @​FedeDP
  • update!: bump libs to latest and deprecation of k8s metadata options and configs [#​2914] - @​jasondellaluce
  • cleanup(falco)!: remove outputs.rate and outputs.max_burst from Falco config [#​2841] - @​Andreagit97
  • cleanup(falco)!: remove --userspace support [#​2839] - @​Andreagit97
  • new(engine): add selective overrides for Falco rules [#​2981] - @​LucaGuerra
  • feat(userspace/falco): falco administrators can now configure the http output to compress the data sent as well as enable keep alive for the connection. Two new fields (compress_uploads and keep_alive) in the http_output block of the falco.yaml file can be used for that purpose. Both are disabled by default. [#​2974] - @​sgaist
  • new(userspace): support env variable expansion in all yaml, even inside strings. [#​2918] - @​FedeDP
  • new(scripts): add a way to enforce driver kind and falcoctl enablement when installing Falco from packages and dialog is not present. [#​2773] - @​vjjmiras
  • new(falco): print system info when Falco starts [#​2927] - @​Andreagit97
  • new: driver selection in falco.yaml [#​2413] - @​therealbobo
  • new(build): enable compilation on win32 and macOS. [#​2889] - @​therealbobo
  • feat(userspace/falco): falco administrators can now configure the address on which the webserver listen using the new listen_address field in the webserver block of the falco.yaml file. [#​2890] - @​sgaist
Minor Changes
Bug Fixes
Non user-facing changes

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about these updates again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports

UNCLASSIFIED - NO CUI