section 12 falco is failing

oskarq

Looks like Falco can't be installed now.
Any help or update what works in 2024?

kubectl get all -n falco
NAME              READY   STATUS                  RESTARTS       AGE
pod/falco-4qfnf   0/2     Init:CrashLoopBackOff   17 (24s ago)   62m
pod/falco-cv8sn   0/2     Init:CrashLoopBackOff   17 (42s ago)   62m
pod/falco-prb8j   0/2     Init:CrashLoopBackOff   17 (49s ago)   62m

NAME                   DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
daemonset.apps/falco   3         3         0       3            0           <none>          62m

kubectl logs -n falco  pod/falco-4qfnf -c falco-driver-loader
* Setting up /usr/src links from host
2024-02-22 10:24:29 INFO  Running falcoctl driver install
                      ├ driver version: 7.0.0+driver
                      ├ driver type: kmod
                      ├ driver name: falco
                      ├ compile: true
                      ├ download: true
                      ├ arch: x86_64
                      ├ kernel release: 
                      └ kernel version: #1 SMP PREEMPT_DYNAMIC Sat Dec 30 15:31:26 UTC 2023
2024-02-22 10:24:29 INFO  Found distro target: cos
2024-02-22 10:24:29 INFO  Check if kernel module is still loaded. 
2024-02-22 10:24:29 INFO  OK! There is no module loaded. 
2024-02-22 10:24:29 INFO  Check all versions of kernel module in dkms. 
2024-02-22 10:24:29 INFO  OK! There are no module versions in dkms. 
2024-02-22 10:24:29 INFO  Trying to download a driver.
                      └ url: https://download.falco.org/driver/7.0.0%2Bdriver/x86_64/falco_cos__1.ko
2024-02-22 10:24:29 WARN  Non-200 response from url. code: 404
2024-02-22 10:24:29 WARN  unable to find a prebuilt driver 
2024-02-22 10:24:29 INFO  Trying to dkms install module. gcc: /usr/bin/gcc
Sign command: /lib/modules/6.1.58+/build/scripts/sign-file
Binary /lib/modules/6.1.58+/build/scripts/sign-file not found, modules won't be signed
DIRECTIVE: MAKE="'/tmp/falco-dkms-make'"
Creating symlink /var/lib/dkms/falco/7.0.0+driver/source -> /usr/src/falco-7.0.0+driver
Error! Your kernel headers for kernel 6.1.58+ cannot be found at /lib/modules/6.1.58+/build or /lib/modules/6.1.58+/source.
Please install the linux-headers-6.1.58+ package or use the --kernelsourcedir option to tell DKMS where it's located.

fcioanca

Hi @oskarq

We are in the process of updating the course and hope to have these updates live within a month or so. Thank you for your patience while we work to improve the experience.

Regards,

Flavia

oskarq

Will you extend availability for the course so I will have a chance to run it again? it is less useful now. Many sections are blocked due to the errors.

fcioanca

You would have to send a request to the LF Customer Support team at trainingsupport.linuxfoundation.org.