{"action":"created","issue":{"url":"https://api.github.com/repos/draios/falco/issues/401","repository_url":"https://api.github.com/repos/draios/falco","labels_url":"https://api.github.com/repos/draios/falco/issues/401/labels{/name}","comments_url":"https://api.github.com/repos/draios/falco/issues/401/comments","events_url":"https://api.github.com/repos/draios/falco/issues/401/events","html_url":"https://github.com/draios/falco/issues/401","id":348012975,"node_id":"MDU6SXNzdWUzNDgwMTI5NzU=","number":401,"title":"Error starting falco pods. ","user":{"login":"kratos81","id":36683061,"node_id":"MDQ6VXNlcjM2NjgzMDYx","avatar_url":"https://avatars2.githubusercontent.com/u/36683061?v=4","gravatar_id":"","url":"https://api.github.com/users/kratos81","html_url":"https://github.com/kratos81","followers_url":"https://api.github.com/users/kratos81/followers","following_url":"https://api.github.com/users/kratos81/following{/other_user}","gists_url":"https://api.github.com/users/kratos81/gists{/gist_id}","starred_url":"https://api.github.com/users/kratos81/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kratos81/subscriptions","organizations_url":"https://api.github.com/users/kratos81/orgs","repos_url":"https://api.github.com/users/kratos81/repos","events_url":"https://api.github.com/users/kratos81/events{/privacy}","received_events_url":"https://api.github.com/users/kratos81/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-08-06T17:22:12Z","updated_at":"2018-08-06T21:08:22Z","closed_at":null,"author_association":"NONE","body":"I have been trying to install falco as a POC but it keeps erring out. I am using the helm chart deploy it and using the default rules.  We have a GKE cluster with a combination of CoreOs and Ubuntu node pools , however I set the taints and tolerations such that pods from the daemonset  can ONLY be deployed on the ubuntu nodes \r\n\r\nThis is the error Im getting \r\n\r\n```falco | Aug 6, 2018, 12:59:56 PM | Mon Aug 6 16:59:56 2018: Runtime error: yaml-cpp: error at line 101, column 21: illegal map value. Exiting.\r\n-- | -- | --\r\nfalco | Aug 6, 2018, 12:59:56 PM | Cannot read config file (/etc/falco/falco.yaml): yaml-cpp: error at line 101, column 21: illegal map value\r\nfalco | Aug 6, 2018, 12:59:56 PM | Download failed, consider compiling your own falco-probe and loading it or getting in touch with the sysdig community\r\nfalco | Aug 6, 2018, 12:59:56 PM | * Trying to download precompiled module from https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/falco-probe-0.1.2503dev-x86_64-4.13.0-1015-gcp-8ac09a2370cbecd58e97561eb5bfdd03.ko\r\nfalco | Aug 6, 2018, 12:59:56 PM | Found kernel config at /host/boot/config-4.13.0-1015-gcp\r\nfalco | Aug 6, 2018, 12:59:56 PM | * Trying to find precompiled falco-probe for 4.13.0-1015-gcp\r\nfalco | Aug 6, 2018, 12:59:56 PM | * Trying to load a system falco-probe, if present\r\nfalco | Aug 6, 2018, 12:59:56 PM | * Trying to load a dkms falco-probe, if present\r\nfalco | Aug 6, 2018, 12:59:56 PM | DKMS: install completed.\r\n```\r\n\r\nThat was the error  I was getting.   I had seen some posts where it was mentioned to use the dev image that would resolve the issue.  I tried that and it did not work  \r\n\r\nThese are snippets  of my values.yaml file \r\n```\r\nfalco:\r\n  # The location of the rules file(s). This can contain one or more paths to\r\n  # separate rules files.\r\n  rulesFile:\r\n    - /etc/falco/falco_rules.yaml\r\n    - /etc/falco/falco_rules.local.yaml\r\n    - /etc/falco/rules.d\r\n```\r\n\r\n```\r\nimage:\r\n  repository: sysdig/falco\r\n  tag: dev\r\n  pullPolicy: Always\r\n\r\nresources:\r\n  # We usually recommend not to specify default resources and to leave this as a conscious\r\n  # choice for the user. This also increases chances charts run on environments with little\r\n  # resources, such as Minikube. If you do want to specify resources, uncomment the following\r\n  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.\r\n  limits:\r\n    cpu: 200m\r\n    memory: 300Mi\r\n  requests:\r\n    cpu: 100m\r\n    memory: 256Mi\r\n\r\nrbac:\r\n  # Create and use rbac resources\r\n  create: true\r\n```\r\n\r\nWe are running kubernetes 1.10.5  , helm version is - ```Client: &version.Version{SemVer:\"v2.9.1\",\r\nServer: &version.Version{SemVer:\"v2.9.1\", ```"},"comment":{"url":"https://api.github.com/repos/draios/falco/issues/comments/410853583","html_url":"https://github.com/draios/falco/issues/401#issuecomment-410853583","issue_url":"https://api.github.com/repos/draios/falco/issues/401","id":410853583,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMDg1MzU4Mw==","user":{"login":"kratos81","id":36683061,"node_id":"MDQ6VXNlcjM2NjgzMDYx","avatar_url":"https://avatars2.githubusercontent.com/u/36683061?v=4","gravatar_id":"","url":"https://api.github.com/users/kratos81","html_url":"https://github.com/kratos81","followers_url":"https://api.github.com/users/kratos81/followers","following_url":"https://api.github.com/users/kratos81/following{/other_user}","gists_url":"https://api.github.com/users/kratos81/gists{/gist_id}","starred_url":"https://api.github.com/users/kratos81/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kratos81/subscriptions","organizations_url":"https://api.github.com/users/kratos81/orgs","repos_url":"https://api.github.com/users/kratos81/repos","events_url":"https://api.github.com/users/kratos81/events{/privacy}","received_events_url":"https://api.github.com/users/kratos81/received_events","type":"User","site_admin":false},"created_at":"2018-08-06T21:08:22Z","updated_at":"2018-08-06T21:08:22Z","author_association":"NONE","body":"Hi @nestorsalceda  thanks for your speedy response  find below the information  \r\n\r\n```\r\nimage:\r\n  repository: sysdig/falco\r\n  tag: dev\r\n  pullPolicy: Always\r\n\r\nresources:\r\n  # We usually recommend not to specify default resources and to leave this as a conscious\r\n  # choice for the user. This also increases chances charts run on environments with little\r\n  # resources, such as Minikube. If you do want to specify resources, uncomment the following\r\n  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.\r\n  limits:\r\n    cpu: 200m\r\n    memory: 300Mi\r\n  requests:\r\n    cpu: 100m\r\n    memory: 256Mi\r\n\r\nrbac:\r\n  # Create and use rbac resources\r\n  create: true\r\n\r\nserviceAccount:\r\n  # Create and use serviceAccount resources\r\n  create: true\r\n  # Use this value as serviceAccountName\r\n  name: falco\r\n\r\nfakeEventGenerator:\r\n  enabled: false\r\n  replicas: 1\r\n\r\ndaemonset: {}\r\n  # Allow the DaemonSet to perform a rolling update on helm update\r\n  # ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/\r\n  # If you do want to specify resources, uncomment the following lines, adjust\r\n  # them as necessary, and remove the curly braces after 'resources:'.\r\n  # updateStrategy: RollingUpdate\r\n\r\nfalco:\r\n  # The location of the rules file(s). This can contain one or more paths to\r\n  # separate rules files.\r\n  rulesFile:\r\n    - /etc/falco/falco_rules.yaml\r\n    - /etc/falco/falco_rules.local.yaml\r\n    - /etc/falco/rules.d\r\n\r\n  # Whether to output events in json or text\r\n  jsonOutput: true\r\n\r\n  # When using json output, whether or not to include the \"output\" property\r\n  # itself (e.g. \"File below a known binary directory opened for writing\r\n  # (user=root ....\") in the json output.\r\n  jsonIncludeOutputProperty: true\r\n\r\n  # Send information logs to stderr and/or syslog Note these are *not* security\r\n  # notification logs! These are just Falco lifecycle (and possibly error) logs.\r\n  logStderr: true\r\n  logSyslog: true\r\n\r\n  # Minimum log level to include in logs. Note: these levels are\r\n  # separate from the priority field of rules. This refers only to the\r\n  # log level of falco's internal logging. Can be one of \"emergency\",\r\n  # \"alert\", \"critical\", \"error\", \"warning\", \"notice\", \"info\", \"debug\".\r\n  logLevel: info\r\n\r\n  # Minimum rule priority level to load and run. All rules having a\r\n  # priority more severe than this level will be loaded/run.  Can be one\r\n  # of \"emergency\", \"alert\", \"critical\", \"error\", \"warning\", \"notice\",\r\n  # \"info\", \"debug\".\r\n  priority: debug\r\n\r\n  # Whether or not output to any of the output channels below is\r\n  # buffered.\r\n  bufferedOutputs: false\r\n\r\n  # A throttling mechanism implemented as a token bucket limits the\r\n  # rate of falco notifications. This throttling is controlled by the following configuration\r\n  # options:\r\n  #  - rate: the number of tokens (i.e. right to send a notification)\r\n  #    gained per second. Defaults to 1.\r\n  #  - max_burst: the maximum number of tokens outstanding. Defaults to 1000.\r\n  #\r\n  # With these defaults, falco could send up to 1000 notifications after\r\n  # an initial quiet period, and then up to 1 notification per second\r\n  # afterward. It would gain the full burst back after 1000 seconds of\r\n  # no activity.\r\n  outputs:\r\n    rate: 1\r\n    maxBurst: 1000\r\n\r\n  # Where security notifications should go.\r\n  # Multiple outputs can be enabled.\r\n  syslogOutput:\r\n    enabled: true\r\n\r\n  # If keep_alive is set to true, the file will be opened once and\r\n  # continuously written to, with each output message on its own\r\n  # line. If keep_alive is set to false, the file will be re-opened\r\n  # for each output message.\r\n  #\r\n  # Also, the file will be closed and reopened if falco is signaled with\r\n  # SIGUSR1.\r\n  fileOutput:\r\n    enabled: false\r\n    keepAlive: false\r\n    filename: ./events.txt\r\n\r\n  stdoutOutput:\r\n    enabled: true\r\n\r\n  # Possible additional things you might want to do with program output:\r\n  #   - send to a slack webhook:\r\n  #         program: \"jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXX\"\r\n  #   - logging (alternate method than syslog):\r\n  #         program: logger -t falco-test\r\n  #   - send over a network connection:\r\n  #         program: nc host.example.com 80\r\n\r\n  # If keep_alive is set to true, the program will be started once and\r\n  # continuously written to, with each output message on its own\r\n  # line. If keep_alive is set to false, the program will be re-spawned\r\n  # for each output message.\r\n  #\r\n  # Also, the program will be closed and reopened if falco is signaled with\r\n  # SIGUSR1.\r\n  programOutput:\r\n    enabled: true\r\n    keepAlive: false\r\n    program: \"jq '{text: .output}' | curl -d @- -X POST https://hooks.slack.com/services/XXcustomLinkXXX/xxxxxxx/“\r\n\r\ncustomRules:\r\n  # Although Falco comes with a nice default rule set for detecting weird\r\n  # behavior in containers, our users are going to customize the run-time\r\n  # security rule sets or policies for the specific container images and\r\n  # applications they run. This feature can be handled in this section.\r\n  #\r\n  # Example:\r\n  #\r\n  # rules-traefik.yaml: |-\r\n  #   [ rule body ]\r\n\r\nintegrations:\r\n  #json_output: true\r\n  #program_output:\r\n    #enabled: true\r\n    #keep_alive: false\r\n    #program: \"jq '{text: .output}' | curl -d @- -X POST \"https://hooks.slack.com/services/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\"\r\n  gcscc:\r\n    enabled: false\r\n    webhookUrl: http://sysdig-gcscc-connector.default.svc.cluster.local:8080/events\r\n    webhookAuthenticationToken: b27511f86e911f20b9e0f9c8104b4ec4\r\n  # If Nats Output integration is enabled, falco will be configured to use this\r\n  # integration as file_output and sets the following values:\r\n  # * json_output: true\r\n  # * json_include_output_property: true\r\n  # * file_output:\r\n  #     enabled: true\r\n  #     keep_alive: true\r\n  #     filename: /var/run/falco/nats\r\n  natsOutput:\r\n    enabled: false\r\n    natsUrl: \"nats://nats.nats-io.svc.cluster.local:4222\"\r\n\r\n# Allow falco to run on Kubernetes 1.6 masters.\r\ntolerations:\r\n  - effect: NoSchedule\r\n    key: node-role.kubernetes.io/master\r\n```\r\n\r\nLet me know if you need any further information. I only redacted the web hook url "}}
{"actor":{"display_login":"kratos81"}}