Try Falco on Kubernetes
This environment requires of a Kubernetes environment of at least 1 node.
1. Deploying Falco
These are the main steps to install Falco on Kubernetes using Helm. Follow them and you should be able to use Falco in a matter of minutes.
1.1 Install kernel headers
Run the following command to install the kernel headers on every Kubernetes node:
$ sudo apt-get -y install linux-headers-$(uname -r)
This step might not even be necessary if the specific driver for the Linux kernel in your Kubernetes cluster is prebuilt and offered by Falco.
Otherwise, the the presence of the kernel headers will allow the installer to build the Falco driver for you.
1.2 Add Falco chart repository
Run the following command to add the
falcosecurity charts repository:
$ helm repo add falcosecurity https://falcosecurity.github.io/charts $ helm repo update
1.3 Install the chart
Run the following command to create a namespace for Falco and install the Falco chart:
$ kubectl create namespace falco $ helm install falco -n falco --set tty=true falcosecurity/falco
1.4 Verify the Falco deployment
Verify that Falco is deployed correctly using the
$ kubectl get pods -n falco
Falco pod(s) might need a few seconds to start. Wait until they are ready:
$ kubectl wait pods --for=condition=Ready --all -n falco
2. Trying Falco in action
2.1 Generate a suspicious event
Run the following command to simulate a suspicious event:
$ kubectl exec -it alpine -- sh -c "uptime"
2.2 Look at Falco logs
Run the following command to look at Falco logs.
$ kubectl logs -l app.kubernetes.io/name=falco -n falco
Check the logs to see the following notice:
15:44:24.787469557: Notice A shell was spawned in a container with an attached terminal (user=<NA> user_loginuid=-1 k8s.ns=default k8s.pod=alpine container=07f3751ec492 shell=sh parent=runc cmdline=sh -c uptime pid=32402 terminal=34816 container_id=07f3751ec492 image=docker.io/library/alpine)
Congratulations, you finished this scenario!
You should be able to install Falco in your Kubernetes cluster and watch for suspicious behavior.
Click on Try Falco and try out the next scenario.
Was this page helpful?
Let us know! You feedback will help us to improve the content and to stay in touch with our users.
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.