Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to find the rebuild driver for kernel 5.10.217-205.860.amzn2.x86_64 on AWS EKS version 1.26 #3244

Closed
kg-ops opened this issue Jun 11, 2024 · 5 comments

Comments

@kg-ops
Copy link

kg-ops commented Jun 11, 2024

Describe the bug

Unable to find the rebuild driver for kernel 5.10.217-205.860.amzn2.x86_64 on AWS EKS version 1.26.
Download link : https://download.falco.org/driver/5.0.1%2Bdriver/x86_64/falco_amazonlinux2_5.10.217-205.860.amzn2.x86_64_1.ko

* Looking for a falco module locally (kernel 5.10.217-205.860.amzn2.x86_64)
* Filename 'falco_amazonlinux2_5.10.217-205.860.amzn2.x86_64_1.ko' is composed of:
 - driver name: falco
 - target identifier: amazonlinux2
 - kernel release: 5.10.217-205.860.amzn2.x86_64
 - kernel version: 1
* Trying to download a prebuilt falco module from https://download.falco.org/driver/5.0.1%2Bdriver/x86_64/falco_amazonlinux2_5.10.217-205.860.amzn2.x86_64_1.ko
curl: (22) The requested URL returned error: 404 
Unable to find a prebuilt falco module

How to reproduce it

  • Use the community published AMI for K8s 1.26 cluster.
  • Initialize falco.

Expected behaviour

falco should come up healthy, instead

bin/sh: 1: gcc10-ld.bfd: not found
make[3]: *** [scripts/Makefile.build:437: /var/lib/dkms/falco/5.0.1+driver/build/falco.o] Error 127
make[2]: *** [Makefile.kernel:1829: /var/lib/dkms/falco/5.0.1+driver/build] Error 2
make[2]: Leaving directory '/host/usr/src/kernels/5.10.217-205.860.amzn2.x86_64'
make[1]: *** [Makefile:9: modules] Error 2
make[1]: Leaving directory '/host/usr/src/kernels/5.10.217-205.860.amzn2.x86_64'
make: *** [Makefile:16: all] Error 2
* Trying to load a system falco module, if present
Consider compiling your own falco driver and loading it or getting in touch with the Falco community

Screenshots
Missing .217 driver.
image

Environment

  • Falco version: 0.35.1 (x86_64)
  • System info:
{
  "machine": "x86_64",
  "nodename": "falco-pt7ch",
  "release": "5.10.216-204.855.amzn2.x86_64",  --> previous working version 
  "sysname": "Linux",
  "version": "#1 SMP Sat May 4 16:53:27 UTC 2024"
}
  • Cloud provider or hardware configuration:
    EKS, K8s 1.26, x86 Machines

  • OS:

PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
  • Kernel:
Previous working version  - 
Linux falco-pt7ch 5.10.216-204.855.amzn2.x86_64 #1 SMP Sat May 4 16:53:27 UTC 2024 x86_64 GNU/Linux
  • Installation method: Kubernetes

Additional context

@FedeDP
Copy link
Contributor

FedeDP commented Jun 12, 2024

Hi! Thanks for opening this issue!
So, first of all, we are no more publishing drivers for 5.0.1+driver driver version since it is now unsupported (since we tagged Falco 0.38.0 with its 7.2.0+driver version).
I see that the driver is instead present for 6.0.1+driver and 7.0.0+driver, but not 7.2.0+driver; indeed it seems it is failing to build for latest driver version; i will dig deeper.

Anyway, since this is a recent enough kernel release, you can also just use the modern-bpf probe that does not require any external artifact!

@poiana
Copy link
Contributor

poiana commented Sep 10, 2024

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

@poiana
Copy link
Contributor

poiana commented Oct 10, 2024

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

@poiana
Copy link
Contributor

poiana commented Nov 9, 2024

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

@poiana poiana closed this as completed Nov 9, 2024
@poiana
Copy link
Contributor

poiana commented Nov 9, 2024

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants