Frequently restarts in AKS 1.30.5

[ql3xHd630]

Falco with version "0.34.1" deployed in AKS 1.30.5. will Frequently restarts. the error message is:

[Andreagit97]

Hi! Yes this is a known issue with Falco 0.34.1 and k8s enrichment. Please use a recent version of Falco https://github.com/falcosecurity/falco/releases/tag/0.39.2, the issue should be solved

[ql3xHd630]

thankyou.

[ql3xHd630]

Hi @Andreagit97 .

When I try to upgrade falco to 0.39.2. The problem of restart have been resolved.

But I got trouble when I use the "http_output". Below are my config of "http_output" part in helm values.yaml.

http_output: enabled: true url: http://fluent-bit:8888 user_agent: "falcosecurity/falco" # -- Tell Falco to not verify the remote server. insecure: false # -- Path to the CA certificate that can verify the remote server. ca_cert: "" # -- Path to a specific file that will be used as the CA certificate store. ca_bundle: "" # -- Path to a folder that will be used as the CA certificate store. CA certificate need to be # stored as indivitual PEM files in this directory. ca_path: "/etc/falco/certs/" # -- Tell Falco to use mTLS mtls: false # -- Path to the client cert. client_cert: "/etc/falco/certs/client/client.crt" # -- Path to the client key. client_key: "/etc/falco/certs/client/client.key" # -- Whether to echo server answers to stdout echo: false # -- compress_uploads whether to compress data sent to http endpoint. compress_uploads: false # -- keep_alive whether to keep alive the connection. keep_alive: false

I got this problem:

Could you please give me some suggestion？Thankyou.

[Andreagit97]

probably @leogr is more familiar with this, any idea of what is going on here?

[Issif]

Can you try by using the whole DNS entry: http://fluent-bit.<namespace>.svc.cluster.local:8888.

Moreover, I don't see the point to use the http endpoint of fluent-bit and not its capacity to read the logs directly. Just enable the json format + output_fields for the logs

[ql3xHd630]

@Issif. Thank you. When I enable json output. It work well.

[ql3xHd630]

Hello, Guys. I got another problem.

I want to disable some rule by helm chart values file.
When I write disable statement follow falco docuemnt

I got this Error.

Could you please help me? Thanks!!

[ql3xHd630]

How can I disable many rule by set value os customRule

[leogr]

How can I disable many rule by set value os customRule

You have to set the Falco config using proper helm values via values.yaml or using --set (in the latter case, be aware of --set syntax and limitation) , for example:
--set falco.rules[0].disable.rule="Redirect STDOUT/STDIN to Network Connection in Container"