# Installation and Setup

## **Installing and Setting Up Falco**

**Overview:** In this lesson, we will walk through the process of installing and setting up Falco in a Kubernetes environment. Falco can be deployed using various methods, but in this lesson, we’ll focus on deploying Falco using Helm, a popular package manager for Kubernetes. By the end of this lesson, you will have a working installation of Falco monitoring your Kubernetes cluster.

### **Step 1: Prerequisites**

Before you begin installing Falco, ensure that your environment meets the following prerequisites:

* **Kubernetes Cluster:** You need a running Kubernetes cluster. This can be a local development cluster (e.g., Minikube or kind) or a cloud-based cluster (e.g., GKE, EKS, AKS).
* **Kubectl Installed:** Kubectl, the Kubernetes command-line tool, should be installed and configured to interact with your cluster.
* **Helm Installed:** Helm should be installed and configured. If you haven’t installed Helm, you can follow the official Helm installation guide.

### **Step 2: Add the Falco Helm Repository**

Falco is available as a Helm chart, making installation straightforward. The first step is to add the official Falco Helm repository to your Helm configuration:

```bash
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update
```

This command adds the Falco Helm repository and updates your local Helm chart repository index.

### **Step 3: Install Falco Using Helm**

With the Falco Helm repository added, you can now install Falco into your Kubernetes cluster. The installation process is simple and involves running the following command:

```bash
helm install falco falcosecurity/falco --namespace falco --create-namespace
```

This command installs Falco in a namespace called `falco`. The `--create-namespace` flag ensures that the namespace is created if it doesn’t already exist.

**Optional Customization:** You can customize the installation by providing additional configuration options. For example, you might want to enable specific output channels or adjust resource limits. To do this, create a custom values file and pass it to the Helm install command:

```bash
helm install falco falcosecurity/falco --namespace falco --values my-falco-values.yaml
```

### **Step 4: Verify the Installation**

After installing Falco, it’s important to verify that it is running correctly and monitoring your cluster. You can do this by checking the status of the Falco pods:

```bash
kubectl get pods -n falco
```

You should see the Falco pod(s) running. The output will look something like this:

```sql
NAME                    READY   STATUS    RESTARTS   AGE
falco-xxxxxxx-yyyyy     1/1     Running   0          5m
```

Ensure that the pod is labeled correctly before checking the logs:

<pre class="language-bash"><code class="lang-bash"><strong>kubectl get pods --all-namespaces
</strong><strong>kubectl label pod faclo-&#x3C;uniquestring> -n falco app=falco
</strong></code></pre>

Next, check the Falco logs to ensure that it is working as expected:

```bash
kubectl logs -n falco -l app=falco
```

The logs should show that Falco is actively monitoring system calls and looking for rule violations. You might see output similar to this:

```csharp
Starting Falco engine
Loading rules from file /etc/falco/falco_rules.yaml:
Loading rules from file /etc/falco/falco_rules.local.yaml:
Starting internal webserver, listening on port 8765
```

### **Step 5: Testing Falco**

To ensure that Falco is properly set up and detecting events, you can perform a simple test by running a command that violates one of Falco’s default rules. For example, you can attempt to create a shell inside a container:

1. Start a pod with a shell:

   ```bash
   kubectl run -it --rm test-shell --image=busybox -- sh
   ```
2. In the shell, try to list the contents of the root directory:

   ```bash
   ls /
   ```
3. Exit the shell.

Falco should detect this action and log a rule violation. You can check the Falco logs again to see the alert:

```bash
kubectl logs -n falco -l app=falco
```

You should see an alert similar to the following:

```sql
17:32:12.123456789: Warning A shell was spawned in a container with an attached terminal (user=root command=sh parent=<NA> container_id=abc123...)
```

This confirms that Falco is correctly monitoring your Kubernetes environment and generating alerts for rule violations.

### **Step 6: Basic Troubleshooting**

If Falco is not working as expected, here are a few troubleshooting steps:

* **Pod Not Running:** If the Falco pod is not running, check the pod events for any errors:

  ```bash
  kubectl describe pod <falco-pod-name> -n falco
  ```
* **No Alerts:** If Falco is running but not generating any alerts, verify that it is monitoring the correct system calls and that the rules are properly loaded. You can also try adjusting the verbosity level in the Falco configuration.
* **High Resource Usage:** If Falco is consuming more resources than expected, you might need to adjust the resource limits in the Helm values file or investigate which rules or system calls are causing the high usage.