Lab 12 Auto response engine issues

freddysf

@gouravshah FYI I had a lot of trouble getting the lab to work as much of it is out of date.
The issue you had in the video where ARGO wasn't syncing seems to be because the repo that the apps were syncing with is the original "https://github.com/Issif/argo-falco" which needed to be changed to the forked repo in all the /deployment/.yaml files

the argo workflow install also needs to be changed from

kubectl apply -n argo -f https://raw.githubusercontent.com/argoproj/argo-workflows/stable/manifests/install.yaml
kubectl patch -n argo cm workflow-controller-configmap -p '{"data": {"containerRuntimeExecutor": "pns"}}'

to use a specific release:

kubectl apply -n argo -f https://github.com/argoproj/argo-workflows/releases/download/v3.4.7/install.yaml

and the pns configmap change is only for kind or minikube not for GKE.

The argo workflow UI needs the deployment updated to use server auth, otherwise it requires a login:

      - args:
        - server
        - "--auth-mode=server"

I had to manually apply the EventSource and Sensor from the original blog post as well.
The Falco install also needs updating to :

helm install falco falcosecurity/falco --namespace falco -f custom-rules.yaml --set driver.kind=ebpf --set falcosidekick.enabled=true --set falcosidekick.config.webhook.address=http://webhook-falco-eventsource-svc.argo-events.svc.cluster.local:12000/falco

gouravshah

@freddysf thanks for bringing this up. This course is already due for an update (all labs) which I would be working on in the next two months. I would have the fixes that you have suggested tested and pushed to the labs in the meanwhile.

dre93

@gouravshah said:
@freddysf thanks for bringing this up. This course is already due for an update (all labs) which I would be working on in the next two months. I would have the fixes that you have suggested tested and pushed to the labs in the meanwhile.

Thinking about purchasing the course. Has the course been updated?