[stable/falco] Upgrade to Falco 0.14.0 (#12439)

* Upgrade to Falco 0.14.0 Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * Enable eBPF by default on Falco builds Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * Allow to specify images from different registries than `docker.io` Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * Upgrade Chart version to a minor one because eBPF default value Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * Use RollingUpgrade strategy by default Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * Provide a sane defaults for resources Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * Update CHANGELOG entries Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com> * Add minor / major categorization to changelog Signed-off-by: Néstor Salceda <nestor.salceda@sysdig.com>
2026-08-23 22:37:45 +00:00 · 2019-04-02 04:42:34 -07:00
parent 160d833f72
commit 1eaeebaae1
8 changed files with 224 additions and 90 deletions
@@ -3,29 +3,52 @@
 This file documents all notable changes to Sysdig Falco Helm Chart. The release
 numbering uses [semantic versioning](http://semver.org).

+## v0.6.0
+
+### Major Changes
+
+* Upgrade to Falco 0.14.0
+* Upgrade rules to Falco 0.14.0
+* Enable eBPF by default on Falco
+* Allow to download Falco images from different registries than `docker.io`
+* Use rollingUpdate strategy by default
+* Provide sane defauls for falco resource management
+
 ## v0.5.6

+### Minor Changes
+
 * Allow extra container args

 ## v0.5.5

+### Minor Changes
+
 * Update correct slack example

 ## v0.5.4

+### Minor Changes
+
 * Using Falco version 0.13.0 instead of latest.

 ## v0.5.3

+### Minor Changes
+
 * Update falco_rules.yaml file to use the same rules that Falco 0.13.0

 ## v0.5.2

+### Minor Changes
+
 * Falco was accepted as a CNCF project. Fix references and download image from
  falcosecurity organization.

 ## v0.5.1

+### Minor Changes
+
 * Allow falco to resolve cluster hostnames when running with ebpf.hostNetwork: true

 ## v0.5.0
@@ -1,7 +1,7 @@
 apiVersion: v1
 name: falco
-version: 0.5.6
-appVersion: 0.13.0
+version: 0.6.0
+appVersion: 0.14.0
 description: Sysdig Falco
 keywords:
  - monitoring
@@ -45,20 +45,25 @@ The following table lists the configurable parameters of the Falco chart and the

 | Parameter                                       | Description                                                          | Default                                                                                |
 | ---                                             | ---                                                                  | ---                                                                                    |
+| `image.registry`                                | The image registry to pull from                                      | `docker.io`                                                                            |
 | `image.repository`                              | The image repository to pull from                                    | `falcosecurity/falco`                                                                  |
-| `image.tag`                                     | The image tag to pull                                                | `0.13.0`                                                                               |
-| `image.pullPolicy`                              | The image pull policy                                                | `IfNotPresent`                                                                               |
-| `resources`                                     | Specify container resources                                          | `{}`                                                                                   |
+| `image.tag`                                     | The image tag to pull                                                | `0.14.0`                                                                               |
+| `image.pullPolicy`                              | The image pull policy                                                | `IfNotPresent`                                                                         |
+| `resources.requests.cpu`                        | CPU requested for being run in a node                                | `100m`                                                                                 |
+| `resources.requests.memory`                     | Memory requested for being run in a node                             | `512Mi`                                                                                |
+| `resources.limits.cpu`                          | CPU limit                                                            | `200m`                                                                                 |
+| `resources.limits.memory`                       | Memory limit                                                         | `1024Mi`                                                                               |
 | `extraArgs`                                     | Specify additional container args                                    | `[]`                                                                                   |
 | `rbac.create`                                   | If true, create & use RBAC resources                                 | `true`                                                                                 |
 | `serviceAccount.create`                         | Create serviceAccount                                                | `true`                                                                                 |
 | `serviceAccount.name`                           | Use this value as serviceAccountName                                 | ` `                                                                                    |
 | `fakeEventGenerator.enabled`                    | Run falco-event-generator for sample events                          | `false`                                                                                |
 | `fakeEventGenerator.replicas`                   | How many replicas of falco-event-generator to run                    | `1`                                                                                    |
+| `daemonset.updateStrategy.type`                 | The updateStrategy for updating the daemonset                        | `RollingUpdate`                                                                        |
 | `proxy.httpProxy`                               | Set the Proxy server if is behind a firewall                         | ``                                                                                     |
 | `proxy.httpsProxy`                              | Set the Proxy server if is behind a firewall                         | ``                                                                                     |
 | `proxy.noProxy`                                 | Set the Proxy server if is behind a firewall                         | ``                                                                                     |
-| `ebpf.enabled`                                  | Enable eBPF support for Falco instead of `falco-probe` kernel module | `false`                                                                                |
+| `ebpf.enabled`                                  | Enable eBPF support for Falco instead of `falco-probe` kernel module | `true`                                                                                 |
 | `ebpf.settings.hostNetwork`                     | Needed to enable eBPF JIT at runtime for performance reasons         | `true`                                                                                 |
 | `ebpf.settings.mountEtcVolume`                  | Needed to detect which kernel version are running in Google COS      | `true`                                                                                 |
 | `falco.rulesFile`                               | The location of the rules files                                      | `[/etc/falco/falco_rules.yaml, /etc/falco/falco_rules.local.yaml, /etc/falco/rules.d]` |
@@ -1,3 +1,21 @@
+#
+# Copyright (C) 2016-2018 Draios Inc dba Sysdig.
+#
+# This file is part of falco.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
 ####################
 # Your custom rules!
 ####################
@@ -16,6 +16,16 @@
 # limitations under the License.
 #

+# See xxx for details on falco engine and rules versioning. Currently,
+# this specific rules file is compatible with engine version 0
+# (e.g. falco releases <= 0.13.1), so we'll keep the
+# required_engine_version lines commented out, so maintain
+# compatibility with older falco releases. With the first incompatible
+# change to this rules file, we'll uncomment this line and set it to
+# the falco engine version in use at the time.
+#
+#- required_engine_version: 2
+
 # Currently disabled as read/write are ignored syscalls. The nearly
 # similar open_write/open_read check for files being opened for
 # reading/writing.
@@ -178,17 +188,23 @@
 - list: deb_binaries
  items: [dpkg, dpkg-preconfigu, dpkg-reconfigur, dpkg-divert, apt, apt-get, aptitude,
    frontend, preinst, add-apt-reposit, apt-auto-remova, apt-key,
-    apt-listchanges, unattended-upgr, apt-add-reposit
+    apt-listchanges, unattended-upgr, apt-add-reposit, apt-config, apt-cache
    ]

 # The truncated dpkg-preconfigu is intentional, process names are
 # truncated at the sysdig level.
 - list: package_mgmt_binaries
-  items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client]
+  items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client, apk]

 - macro: package_mgmt_procs
  condition: proc.name in (package_mgmt_binaries)

+- macro: package_mgmt_ancestor_procs
+  condition: proc.pname in (package_mgmt_binaries) or
+             proc.aname[2] in (package_mgmt_binaries) or
+             proc.aname[3] in (package_mgmt_binaries) or
+             proc.aname[4] in (package_mgmt_binaries)
+
 - macro: coreos_write_ssh_dir
  condition: (proc.name=update-ssh-keys and fd.name startswith /home/core/.ssh)

@@ -262,14 +278,18 @@
 # Network
 - macro: inbound
  condition: >
-    (((evt.type in (accept,listen) and evt.dir=<)) or
+    (((evt.type in (accept,listen) and evt.dir=<) or
+      (evt.type in (recvfrom,recvmsg) and evt.dir=< and
+       fd.l4proto != tcp and fd.connected=false and fd.name_changed=true)) and
     (fd.typechar = 4 or fd.typechar = 6) and
     (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
     (evt.rawres >= 0 or evt.res = EINPROGRESS))

 - macro: outbound
  condition: >
-    (((evt.type = connect and evt.dir=<)) or
+    (((evt.type = connect and evt.dir=<) or
+      (evt.type in (sendto,sendmsg) and evt.dir=< and
+       fd.l4proto != tcp and fd.connected=false and fd.name_changed=true)) and
     (fd.typechar = 4 or fd.typechar = 6) and
     (fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8") and
     (evt.rawres >= 0 or evt.res = EINPROGRESS))
@@ -580,7 +600,7 @@
  condition: (proc.pname=run-openldap.sh and fd.name startswith /etc/openldap)

 - macro: ucpagent_writing_conf
-  condition: (proc.name=apiserver and container.image startswith docker/ucp-agent and fd.name=/etc/authorization_config.cfg)
+  condition: (proc.name=apiserver and container.image.repository=docker/ucp-agent and fd.name=/etc/authorization_config.cfg)

 - macro: iscsi_writing_conf
  condition: (proc.name=iscsiadm and fd.name startswith /etc/iscsi)
@@ -628,7 +648,7 @@
  condition: (veritas_progs and (fd.name startswith /etc/vx or fd.name startswith /etc/opt/VRTS or fd.name startswith /etc/vom))

 - macro: nginx_writing_conf
-  condition: (proc.name=nginx and fd.name startswith /etc/nginx)
+  condition: (proc.name in (nginx,nginx-ingress-c) and fd.name startswith /etc/nginx)

 - macro: nginx_writing_certs
  condition: >
@@ -802,7 +822,7 @@
  condition: (proc.name=rabbitmq-server and fd.directory=/etc/rabbitmq)

 - macro: rook_writing_conf
-  condition: (proc.name=toolbox.sh and container.image startswith rook/toolbox
+  condition: (proc.name=toolbox.sh and container.image.repository=rook/toolbox
              and fd.directory=/etc/ceph)

 - macro: httpd_writing_conf_logs
@@ -839,7 +859,17 @@
  condition: (proc.aname[2] in (dpkg-reconfigur, dpkg-preconfigu))

 - macro: ufw_writing_conf
-  condition: proc.name=ufw and fd.directory=/etc/ufw
+  condition: (proc.name=ufw and fd.directory=/etc/ufw)
+
+- macro: calico_writing_conf
+  condition: >
+    (proc.name = calico-node and fd.name startswith /etc/calico)
+
+- macro: prometheus_conf_writing_conf
+  condition: (proc.name=prometheus-conf and fd.directory=/etc/prometheus/config_out)
+
+- macro: openshift_writing_conf
+  condition: (proc.name=oc and fd.name=/etc/origin/node/node.kubeconfig)

 # Add conditions to this macro (probably in a separate file,
 # overwriting this macro) to allow for specific combinations of
@@ -943,6 +973,9 @@
    and not iscsi_writing_conf
    and not istio_writing_conf
    and not ufw_writing_conf
+    and not calico_writing_conf
+    and not prometheus_conf_writing_conf
+    and not openshift_writing_conf

 - rule: Write below etc
  desc: an attempt to write to any file below /etc
@@ -1153,7 +1186,7 @@
    as a part of creating a container) by calling setns.
  condition: >
    evt.type = setns
-    and not proc.name in (docker_binaries, k8s_binaries, lxd_binaries, sysdigcloud_binaries, sysdig, nsenter)
+    and not proc.name in (docker_binaries, k8s_binaries, lxd_binaries, sysdigcloud_binaries, sysdig, nsenter, calico)
    and not proc.name in (user_known_change_thread_namespace_binaries)
    and not proc.name startswith "runc:"
    and not proc.pname in (sysdigcloud_binaries)
@@ -1314,50 +1347,43 @@

 - macro: allowed_openshift_registry_root
  condition: >
-    (container.image startswith openshift3/ or
-     container.image startswith registry.access.redhat.com/openshift3/)
+    (container.image.repository startswith openshift3/ or
+     container.image.repository startswith registry.access.redhat.com/openshift3/)

 # Source: https://docs.openshift.com/enterprise/3.2/install_config/install/disconnected_install.html
 - macro: openshift_image
  condition: >
    (allowed_openshift_registry_root and
-      (container.image contains logging-deployment or
-       container.image contains logging-elasticsearch or
-       container.image contains logging-kibana or
-       container.image contains logging-fluentd or
-       container.image contains logging-auth-proxy or
-       container.image contains metrics-deployer or
-       container.image contains metrics-hawkular-metrics or
-       container.image contains metrics-cassandra or
-       container.image contains metrics-heapster or
-       container.image contains ose-haproxy-router or
-       container.image contains ose-deployer or
-       container.image contains ose-sti-builder or
-       container.image contains ose-docker-builder or
-       container.image contains ose-pod or
-       container.image contains ose-docker-registry or
-       container.image contains image-inspector))
+      (container.image.repository contains logging-deployment or
+       container.image.repository contains logging-elasticsearch or
+       container.image.repository contains logging-kibana or
+       container.image.repository contains logging-fluentd or
+       container.image.repository contains logging-auth-proxy or
+       container.image.repository contains metrics-deployer or
+       container.image.repository contains metrics-hawkular-metrics or
+       container.image.repository contains metrics-cassandra or
+       container.image.repository contains metrics-heapster or
+       container.image.repository contains ose-haproxy-router or
+       container.image.repository contains ose-deployer or
+       container.image.repository contains ose-sti-builder or
+       container.image.repository contains ose-docker-builder or
+       container.image.repository contains ose-pod or
+       container.image.repository contains ose-docker-registry or
+       container.image.repository contains image-inspector))
+
+- list: trusted_images
+  items: [
+    sysdig/agent, sysdig/falco, sysdig/sysdig, gcr.io/google_containers/hyperkube,
+    quay.io/coreos/flannel, gcr.io/google_containers/kube-proxy, calico/node,
+    rook/toolbox, cloudnativelabs/kube-router, consul, mesosphere/mesos-slave,
+    datadog/docker-dd-agent, datadog/agent, docker/ucp-agent, gliderlabs/logspout
+    ]

 - macro: trusted_containers
-  condition: (container.image startswith sysdig/agent or
-              (container.image startswith sysdig/falco and
-               not container.image startswith sysdig/falco-event-generator) or
-              container.image startswith quay.io/sysdig or
-              container.image startswith sysdig/sysdig or
-              container.image startswith gcr.io/google_containers/hyperkube or
-              container.image startswith quay.io/coreos/flannel or
-              container.image startswith gcr.io/google_containers/kube-proxy or
-              container.image startswith calico/node or
-              container.image startswith rook/toolbox or
-              openshift_image or
-              container.image startswith cloudnativelabs/kube-router or
-              container.image startswith "consul:" or
-              container.image startswith mesosphere/mesos-slave or
-              container.image startswith istio/proxy_ or
-              container.image startswith datadog/docker-dd-agent or
-              container.image startswith datadog/agent or
-              container.image startswith docker/ucp-agent or
-              container.image startswith gliderlabs/logspout)
+  condition: (openshift_image or
+              container.image.repository in (trusted_images) or
+              container.image.repository startswith istio/proxy_ or
+              container.image.repository startswith quay.io/sysdig)

 # Add conditions to this macro (probably in a separate file,
 # overwriting this macro) to specify additional containers that are
@@ -1366,7 +1392,7 @@
 # In this file, it just takes one of the images in trusted_containers
 # and repeats it.
 - macro: user_trusted_containers
-  condition: (container.image startswith sysdig/agent)
+  condition: (container.image.repository=sysdig/agent)

 # Add conditions to this macro (probably in a separate file,
 # overwriting this macro) to specify additional containers that are
@@ -1375,7 +1401,7 @@
 # In this file, it just takes one of the images in trusted_containers
 # and repeats it.
 - macro: user_sensitive_mount_containers
-  condition: (container.image startswith sysdig/agent)
+  condition: (container.image.repository=sysdig/agent)

 - rule: Launch Privileged Container
  desc: Detect the initial process started in a privileged container. Exceptions are made for known trusted images.
@@ -1384,7 +1410,7 @@
    and container.privileged=true
    and not trusted_containers
    and not user_trusted_containers
-  output: Privileged container started (user=%user.name command=%proc.cmdline %container.info image=%container.image)
+  output: Privileged container started (user=%user.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag)
  priority: INFO
  tags: [container, cis]

@@ -1395,7 +1421,8 @@
 - macro: sensitive_mount
  condition: (container.mount.dest[/proc*] != "N/A" or
              container.mount.dest[/var/run/docker.sock] != "N/A" or
-              container.mount.dest[/var/lib/kubelet*] != "N/A" or
+              container.mount.dest[/var/lib/kubelet] != "N/A" or
+              container.mount.dest[/var/lib/kubelet/pki] != "N/A" or
              container.mount.dest[/] != "N/A" or
              container.mount.dest[/etc] != "N/A" or
              container.mount.dest[/root*] != "N/A")
@@ -1423,7 +1450,7 @@
    and sensitive_mount
    and not trusted_containers
    and not user_sensitive_mount_containers
-  output: Container with sensitive mount started (user=%user.name command=%proc.cmdline %container.info image=%container.image mounts=%container.mounts)
+  output: Container with sensitive mount started (user=%user.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag mounts=%container.mounts)
  priority: INFO
  tags: [container, cis]

@@ -1434,8 +1461,8 @@
 # alllowed, by using a filter that is guaranteed to evaluate to true
 # (the same proc.vpid=1 that's in the Launch Disallowed Container
 # rule). In the overridden macro, the condition would look something
-# like (container.image startswith vendor/container-1 or
-# container.image startswith vendor/container-2 or ...)
+# like (container.image.repository = vendor/container-1 or
+# container.image.repository = vendor/container-2 or ...)

 - macro: allowed_containers
  condition: (proc.vpid=1)
@@ -1444,7 +1471,7 @@
  desc: >
    Detect the initial process started by a container that is not in a list of allowed containers.
  condition: evt.type=execve and proc.vpid=1 and container and not allowed_containers
-  output: Container started and not in allowed list (user=%user.name command=%proc.cmdline %container.info image=%container.image)
+  output: Container started and not in allowed list (user=%user.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag)
  priority: WARNING
  tags: [container]

@@ -1686,8 +1713,8 @@
 # any way to know all the containers that should have access, so any
 # container is alllowed, by repeating the "container" macro. In the
 # overridden macro, the condition would look something like
-# (container.image startswith vendor/container-1 or container.image
-# startswith vendor/container-2 or ...)
+# (container.image.repository = vendor/container-1 or
+# container.image.repository = vendor/container-2 or ...)
 - macro: ec2_metadata_containers
  condition: container

@@ -1697,7 +1724,7 @@
 - rule: Contact EC2 Instance Metadata Service From Container
  desc: Detect attempts to contact the EC2 Instance Metadata Service from a container
  condition: outbound and fd.sip="169.254.169.254" and container and not ec2_metadata_containers
-  output: Outbound connection to EC2 instance metadata service (command=%proc.cmdline connection=%fd.name %container.info image=%container.image)
+  output: Outbound connection to EC2 instance metadata service (command=%proc.cmdline connection=%fd.name %container.info image=%container.image.repository:%container.image.tag)
  priority: NOTICE
  tags: [network, aws, container]

@@ -1713,16 +1740,14 @@
 # within a container.
 - macro: k8s_containers
  condition: >
-    (container.image startswith gcr.io/google_containers/hyperkube-amd64 or
-     container.image startswith gcr.io/google_containers/kube2sky or
-     container.image startswith sysdig/agent or
-     container.image startswith sysdig/falco or
-     container.image startswith sysdig/sysdig)
+    (container.image.repository in (gcr.io/google_containers/hyperkube-amd64,
+     gcr.io/google_containers/kube2sky, sysdig/agent, sysdig/falco,
+     sysdig/sysdig))

 - rule: Contact K8S API Server From Container
  desc: Detect attempts to contact the K8S API Server from a container
  condition: outbound and k8s_api_server and container and not k8s_containers
-  output: Unexpected connection to K8s API Server from container (command=%proc.cmdline %container.info image=%container.image connection=%fd.name)
+  output: Unexpected connection to K8s API Server from container (command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag connection=%fd.name)
  priority: NOTICE
  tags: [network, k8s, container]

@@ -1742,6 +1767,46 @@
  priority: NOTICE
  tags: [network, k8s, container]

+- list: network_tool_binaries
+  items: [nc, ncat, nmap]
+
+- macro: network_tool_procs
+  condition: proc.name in (network_tool_binaries)
+
+# Container is supposed to be immutable. Package management should be done in building the image.
+- rule: Launch Package Management Process in Container
+  desc: Package management process ran inside container
+  condition: >
+    spawned_process and container and user.name != "_apt" and package_mgmt_procs and not package_mgmt_ancestor_procs
+  output: >
+    Package management process launched in container (user=%user.name
+    command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
+  priority: ERROR
+  tags: [process]
+
+- rule: Netcat Remote Code Execution in Container
+  desc: Netcat Program runs inside container that allows remote code execution
+  condition: >
+    spawned_process and container and
+    ((proc.name = "nc" and (proc.args contains "-e" or proc.args contains "-c")) or
+     (proc.name = "ncat" and (proc.args contains "--sh-exec" or proc.args contains "--exec"))
+    )
+  output: >
+    Netcat runs inside container that allows remote code execution (user=%user.name
+    command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
+  priority: WARNING
+  tags: [network, process]
+
+- rule: Lauch Suspicious Network Tool in Container
+  desc: Detect network tools launched inside container
+  condition: >
+    spawned_process and container and network_tool_procs
+  output: >
+    Network tool launched in container (user=%user.name
+    command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
+  priority: NOTICE
+  tags: [network, process]
+
 # Application rules have moved to application_rules.yaml. Please look
 # there if you want to enable them by adding to
 # falco_rules.local.yaml.
@@ -41,3 +41,26 @@ Create the name of the service account to use
    {{ default "default" .Values.serviceAccount.name }}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Return the proper Falco image name
+*/}}
+{{- define "falco.image" -}}
+{{- $registryName := .Values.image.registry -}}
+{{- $repositoryName := .Values.image.repository -}}
+{{- $tag := .Values.image.tag | toString -}}
+{{/*
+Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
+but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
+Also, we can't use a single if because lazy evaluation is not an option
+*/}}
+{{- if .Values.global }}
+    {{- if .Values.global.imageRegistry }}
+        {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
+    {{- else -}}
+        {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
+    {{- end -}}
+{{- else -}}
+    {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
+{{- end -}}
+{{- end -}}
@@ -24,7 +24,7 @@ spec:
 {{ toYaml .Values.tolerations | indent 8 }}
      containers:
        - name: {{ .Chart.Name }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          image: {{ template "falco.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          resources:
 {{ toYaml .Values.resources | indent 12 }}
@@ -182,6 +182,5 @@ spec:
        - name: shared-pipe
          emptyDir: {}
        {{- end }}
-
  updateStrategy:
-    type: {{ default "OnDelete" .Values.daemonset.updateStrategy | quote }}
+{{ toYaml .Values.daemonset.updateStrategy | indent 4 }}
@@ -1,21 +1,21 @@
 # Default values for falco.

 image:
+  registry: docker.io
  repository: falcosecurity/falco
-  tag: 0.13.0
+  tag: 0.14.0
  pullPolicy: IfNotPresent

-resources: {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 30m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 20m
-  #   memory: 128Mi
+resources:
+  # Although resources needed are subjective on the actual workload we provide
+  # a sane defaults ones. If you have more questions or concerns, please refer
+  # to Sysdig Support for more info about it
+  requests:
+    cpu: 100m
+    memory: 512Mi
+  limits:
+    cpu: 200m
+    memory: 1024Mi

 extraArgs: []

@@ -33,12 +33,13 @@ fakeEventGenerator:
  enabled: false
  replicas: 1

-daemonset: {}
-  # Allow the DaemonSet to perform a rolling update on helm update
+daemonset:
+  # Perform rolling updates by default in the DaemonSet agent
  # ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/
-  # If you do want to specify resources, uncomment the following lines, adjust
-  # them as necessary, and remove the curly braces after 'resources:'.
-  # updateStrategy: RollingUpdate
+  updateStrategy:
+    # You can also customize maxUnavailable, maxSurge or minReadySeconds if you
+    # need it
+    type: RollingUpdate

 # If is behind a proxy you can set the proxy server
 proxy:
@@ -48,7 +49,7 @@ proxy:

 ebpf:
  # Enable eBPF support for Falco
-  enabled: false
+  enabled: true

  settings:
    # Needed to enable eBPF JIT at runtime for performance reasons.