Installation and Setup

Installing and Setting Up Falco

Overview: In this lesson, we will walk through the process of installing and setting up Falco in a Kubernetes environment. Falco can be deployed using various methods, but in this lesson, we’ll focus on deploying Falco using Helm, a popular package manager for Kubernetes. By the end of this lesson, you will have a working installation of Falco monitoring your Kubernetes cluster.

Step 1: Prerequisites

Before you begin installing Falco, ensure that your environment meets the following prerequisites:

• Kubernetes Cluster: You need a running Kubernetes cluster. This can be a local development cluster (e.g., Minikube or kind) or a cloud-based cluster (e.g., GKE, EKS, AKS).

• Kubectl Installed: Kubectl, the Kubernetes command-line tool, should be installed and configured to interact with your cluster.

• Helm Installed: Helm should be installed and configured. If you haven’t installed Helm, you can follow the official Helm installation guide.

Step 2: Add the Falco Helm Repository

Falco is available as a Helm chart, making installation straightforward. The first step is to add the official Falco Helm repository to your Helm configuration:

helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update

This command adds the Falco Helm repository and updates your local Helm chart repository index.

Step 3: Install Falco Using Helm

With the Falco Helm repository added, you can now install Falco into your Kubernetes cluster. The installation process is simple and involves running the following command:

helm install falco falcosecurity/falco --namespace falco --create-namespace

This command installs Falco in a namespace called falco. The --create-namespace flag ensures that the namespace is created if it doesn’t already exist.

Optional Customization: You can customize the installation by providing additional configuration options. For example, you might want to enable specific output channels or adjust resource limits. To do this, create a custom values file and pass it to the Helm install command:

helm install falco falcosecurity/falco --namespace falco --values my-falco-values.yaml

Step 4: Verify the Installation

After installing Falco, it’s important to verify that it is running correctly and monitoring your cluster. You can do this by checking the status of the Falco pods:

kubectl get pods -n falco

You should see the Falco pod(s) running. The output will look something like this:

NAME                    READY   STATUS    RESTARTS   AGE
falco-xxxxxxx-yyyyy     1/1     Running   0          5m

Ensure that the pod is labeled correctly before checking the logs:

kubectl get pods --all-namespaces
kubectl label pod faclo-<uniquestring> -n falco app=falco

Next, check the Falco logs to ensure that it is working as expected:

kubectl logs -n falco -l app=falco

The logs should show that Falco is actively monitoring system calls and looking for rule violations. You might see output similar to this:

Starting Falco engine
Loading rules from file /etc/falco/falco_rules.yaml:
Loading rules from file /etc/falco/falco_rules.local.yaml:
Starting internal webserver, listening on port 8765

Step 5: Testing Falco

To ensure that Falco is properly set up and detecting events, you can perform a simple test by running a command that violates one of Falco’s default rules. For example, you can attempt to create a shell inside a container:

1. Start a pod with a shell:

   kubectl run -it --rm test-shell --image=busybox -- sh

2. In the shell, try to list the contents of the root directory:

   ls /

3. Exit the shell.

Falco should detect this action and log a rule violation. You can check the Falco logs again to see the alert:

kubectl logs -n falco -l app=falco

You should see an alert similar to the following:

17:32:12.123456789: Warning A shell was spawned in a container with an attached terminal (user=root command=sh parent=<NA> container_id=abc123...)

This confirms that Falco is correctly monitoring your Kubernetes environment and generating alerts for rule violations.

Step 6: Basic Troubleshooting

If Falco is not working as expected, here are a few troubleshooting steps:

• Pod Not Running: If the Falco pod is not running, check the pod events for any errors:

  kubectl describe pod <falco-pod-name> -n falco

• No Alerts: If Falco is running but not generating any alerts, verify that it is monitoring the correct system calls and that the rules are properly loaded. You can also try adjusting the verbosity level in the Falco configuration.

• High Resource Usage: If Falco is consuming more resources than expected, you might need to adjust the resource limits in the Helm values file or investigate which rules or system calls are causing the high usage.