update: sync command line options with Falco 0.38.0

.github/workflows/ci.yaml

@@ -44,6 +44,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install needed artifacts using falcoctl
+        run: |
+          mkdir -p /usr/share/falco/plugins
+          falcoctl artifact install k8saudit-rules
+          falcoctl artifact install cloudtrail-rules
+
       # note: this converts the output of go test into a junit-compatible,
       # which can later be processed by test-summary/action to upload
       # a Markdown report on the GitHub Actions workflow.

pkg/falco/tester_options.go

@@ -105,11 +105,10 @@ func WithAllEvents() TestOption {
 	}
 }
 
-// WithCaptureFile runs Falco reading events from a capture file through the `-e` option.
+// WithCaptureFile runs Falco reading events from a capture file through the `-o engine.kind=replay` option.
 func WithCaptureFile(f run.FileAccessor) TestOption {
 	return func(o *testOptions) {
-		o.args = removeFromArgs(o.args, "-e", 1)
-		o.args = append(o.args, "-e", f.Name())
+		o.args = append(o.args, "-o", "engine.kind=replay", "-o", fmt.Sprintf("engine.replay.capture_file=%s", f.Name()))
 		o.files = append(o.files, f)
 	}
 }

tests/falco/commands_test.go

@@ -38,8 +38,6 @@ import (
 //   --markdown, -N, --gvisor-generate-config, --page-size
 // Metadata collection and container runtimes:
 //   --cri, --disable-cri-async, -k, --k8s-api, -K, --k8s-api-cert, --k8s-node, -m, --mesos-api
-// Falco event collection modes:
-//   -g, --gvisor-config, --gvisor-root, -u, --userspace, --modern-bpf
 // Changers of Falco's behavior:
 //   --disable-source, --enable-source, -A, -d, --daemon, -P, --pidfile,
 //   -p, --print, -b, --print-base64, -S, --snaplen,

tests/falco/miscs_test.go

@@ -31,9 +31,8 @@ import (
 
 // todo(jasondellaluce): implement tests for the non-covered Falco config fields:
 //   watch_config_files, libs_logger, buffered_outputs, syscall_event_timeouts,
-//   syscall_buf_size_preset, modern_bpf, output_timeout, outputs
 //   syslog_output, file_output, stdout_output, webserver, program_output,
-//   http_output, metadata_download
+//   http_output, metadata_download, output_timeout, outputs
 //
 // todo(jasondellaluce): test Falco behavior on environment variables and their
 // priorities in combination with their args/configs/cmds counterparts:

tests/falcodriverloader/drivers_test.go

@@ -19,10 +19,11 @@ limitations under the License.
 package testfalcodriverloader
 
 import (
-	"github.com/falcosecurity/testing/pkg/falcoctl"
 	"testing"
 	"time"
 
+	"github.com/falcosecurity/testing/pkg/falcoctl"
+
 	"github.com/falcosecurity/testing/pkg/falco"
 	"github.com/falcosecurity/testing/tests"
 	"github.com/stretchr/testify/assert"
@@ -106,7 +107,7 @@ func TestFalcoModernBpf(t *testing.T) {
 	falcoRes := falco.Test(
 		tests.NewFalcoExecutableRunner(t),
 		falco.WithStopAfter(3*time.Second),
-		falco.WithArgs("--modern-bpf"),
+		falco.WithArgs("-o", "engine.kind=modern_ebpf"),
 	)
 	assert.NoError(t, falcoRes.Err(), "%s", falcoRes.Stderr())
 	assert.Equal(t, 0, falcoRes.ExitCode())