[Tracking] Falco 0.37.0

[Andreagit97]

Falco 0.37.0 Release

Will keep this issue updated with the current status and progress.

Date

Target release date: 2024-01-30

Release Steps

The process is described in this document.

External dependencies

Preview Give feedback

1. falcoctl -> 0.7.1
2. libs -> 0.14.2
3. drivers -> 7.0.0+driver
4. rules -> 3.0.0
5. plugins bump

Manual Testing Action Items

Preview Give feedback

1. Running Falco on Kubernetes with the official Helm Charts
2. Running Falco from RPM and DEB artifacts
3. Running Falco in a container with the official images
4. Running/fuzzing Falco with multiple event sources active in parallel
5. Running/fuzzing Falco with variable syscall buffer dimension
6. Running Falco in all officially-supported architectures (x86_64, ARM64)
7. Running Falco with the supported drivers (kmod, modern eBPF, eBPF, gVisor, trace files)
8. Test Falco with event generator
9. Test that plugins are correctly loaded
10. Test memory and CPU usage (with Valgrind and other tools)
11. Test latest version of driver loader
12. Test that k8smeta plugin works as expected
13. Test that all Falco CLI options work as expected
14. Check that Falco log messages are correct and consistent
15. Test that Falco ruleset loading and validation works as expected
16. Test Falco with Gvisor

Action Items

• Pre-Release
  • Milestone
  • Code freeze in falcosecurity/falco
  • Open release branch in Falco and protect it
  • See External dependencies task lists
  • Prebuilt drivers publish
  • Code thaw in falcosecurity/falco
  • Changelog on the release branch
  • cherry-pick the changelog on master
• Release
  • Github Release in the Falco repo
• Website
  • Create new snapshot
    • Protect snapshot branch
  • Merge the release blog post
  • Merge all necessary documentation PRs
• Helm
  • Release a new helm chart version
  • Update helm chart documentation
  • Add instructions to the Helm chart readme about how to switch images if necessary
• Announcements
  • mailing list
  • blog post
  • slack channel
• Post-Release
  • Archive community call meeting notes
  • Close the resolved issues after the tag and move the unresolved ones under a new milestone
  • Update supported fields and syscall documentation
  • add Falco version to the rules CI: ci(.github): add 0.37 to FALCO_VERSIONS rules#221

Miscs

/milestone 0.37.0

/assign @Andreagit97

/kind documentation

PRs that should be cherry-picked into the release branch

• update(cmake): bumped falcoctl to v0.7.1. #3030
• fix(userspace/engine): avoid storing escaped strings in engine #3028

Synced with: #3031

---

• fix: nlohmann_json lib include path #3032
• fix(userspace/metric): minor fixes in new libsinsp state metrics handling #3033
• update!(config): soft deprecation of drop stats counters in syscall_event_drops #3015
• update(cmake/modules): bump Falco rules to 3.0 #3034

Synced with: #3035

---

• update(build): update libs to 0.14.2 #3036 directly pushed on the release branch
• new(docs): add changelog for 0.37.0 #3040 directly pushed on the release branch

---

[Andreagit97]

Falco 0.37.0-rc1 is out https://github.com/falcosecurity/falco/releases/tag/0.37.0-rc1!
Please help us test it if you have time!

[Andreagit97]

Falco 0.37.0-rc2 is out https://github.com/falcosecurity/falco/releases/tag/0.37.0-rc2!
Please help us test it if you have time!

[Andreagit97]

Falco 0.37.0-rc3 is out https://github.com/falcosecurity/falco/releases/tag/0.37.0-rc3!
Please help us test it if you have time!

[Andreagit97]

Falco 0.37.0 is finally out https://github.com/falcosecurity/falco/releases/tag/0.37.0! 🚀