[TRACKING] Breaking changes in Falco 0.37.0

[Andreagit97]

This issue keeps track of all deprecated Falco features that will be removed in Falco 0.37

• rate-limiter mechanism
  • deprecation PR: cleanup: deprecate rate limiter mechanism #2762
  • breaking change PR: [BREAKING CHANGE] cleanup(falco)!: remove outputs.rate and outputs.max_burst from Falco config #2841
• --userspace CLI option
  • deprecation PR: fix: restore Falco MINIMAL_BUILD and deprecate userspace option #2761
  • breaking change PR: [BREAKING CHANGE] cleanup(falco)!: remove --userspace support #2839
• falco-driver-loader script will be removed and embedded into falcoctl
  • deprecation issue: Deprecate falco-driver-loader #2675
  • breaking change PR: new: falcoctl driver loader #2905
  • About falco-driver-loader; the new falcoctl driven implementation will drop:
    • --source-only
    • BPF_USE_LOCAL_KERNEL_SOURCES
    • DRIVER_CURL_OPTIONS
    • FALCO_BPF_PROBE environment variable won't be considered by new falcoctl driver loader, since it is already deprecated (above points, Falco 0.37.0) and going to be removed in Falco 0.38.0
  • Also, some env vars were renamed:
    • DRIVERS_REPO env variable has been replaced by FALCOCTL_DRIVER_NAME, or --name command line argument for falcoctl driver tool
    • DRIVERS_NAME env variable has been replaced by FALCOCTL_DRIVER_REPOS, or --repo command line argument for falcoctl driver tool
    • DRIVER_KERNEL_RELEASE env variable has been replaced by --kernelrelease command line argument for falcoctl driver install command
    • DRIVER_KERNEL_VERSION env variable has been replaced by --kernelversion command line argument for falcoctl driver install command
    • DRIVER_INSECURE_DOWNLOAD env variable has been replaced by --http-insecure command line argument for falcoctl driver install command
• remove -K/-k options from Falco in favor of the new k8s plugin:
  • deprecation issue: K8S client issues #2973
  • breaking change PR: update!: bump libs to latest and deprecation of k8s metadata options and configs #2914
• Falco config yaml env var expansion: chore(unit_test,userspace): allow env var to get expanded in yaml even when part of a string #2918; following the new feature, we have small breaking changes:
  • in feat: support parsing of system environment variables in yaml #2562 env var that resolved to empty string (both non-set env vars and env vars set to "") returned default value. This was in constrast with everything else in our yaml impl (ie: we only returned default value if node is not defined). Now expanded env vars retain the same behavior of all other variables.
  • now we will return default value for nodes that cannot be parsed to chosen type
  • program_output command will be env-expanded at init time, instead of letting popen and thus the sh shell expand it. This is technically a breaking change even if no behavioral change is expected. Also, you can avoid env var expansion by using ${{FOO}} instead of ${FOO}. It will resolve to ${FOO} and won't be resolved to the env var value.
• Plugins shipped inside Falco bundled were dropped; since we now rely on falcoctl to install and eventually follow plugins, there is no need to ship them bundled anymore.

DEPRECATION (probably will be removed with Falco 1.0.0):

• append in Falco rule is deprecated in favor of override (see update(rule_loader): deprecate the append flag in falco rules #2992)
• syntax like

  - rule: Write below etc
    enabled: false

  is deprecated in favor of override (see update(rule_loader): deprecate the append flag in falco rules #2992).

    - rule: Write below etc
      enabled: false
      override:
         enabled: replace

  Please note that the enabled key is only deprecated when used as an override! So a rule like this is perfectly legit:

  - rule: legit_rule
    desc: legit rule description
    condition: evt.type=open
    output: user=%user.name command=%proc.cmdline file=%fd.name
    priority: INFO
    enabled: false

[Andreagit97]

We cannot use tasklists at the moment since indented tasks (i.e. nested tasklist) are not supported

[leogr]

/assign @Andreagit97

[FedeDP]

About falco-driver-loader; the new falcoctl driven implementation will drop:

• --source-only
• BPF_USE_LOCAL_KERNEL_SOURCES
• DRIVER_CURL_OPTIONS

[FedeDP]

Added notes about #2918!

[FedeDP]

#2997 might add a new deprecation: it will drop:

• k8saudit plugin
• k8saudit-rules
• cloudtrail plugin
• cloudtrail-rules
• json plugin

out of Falco bundle, since they are meant to be installed through falcoctl.
Will update OP once there is an agreement by the maintainers.

[leogr]

#2997 might add a new deprecation: it will drop:

• k8saudit plugin
• k8saudit-rules
• cloudtrail plugin
• cloudtrail-rules
• json plugin

out of Falco bundle, since they are meant to be installed through falcoctl. Will update OP once there is an agreement by the maintainers.

The PR is merged, so yes! We need to inform our users regarding this change.

[FedeDP]

Already added to OP

[FedeDP]

falcosecurity/falco-website#1240 addresses documentation updates for:

• new falco-driver-loader
• dropped --userspace CLI option
• new driver selection config option in config file: new: driver selection in falco.yaml #2413

[Andreagit97]

Falco 0.37.0 is out we can close it!