I am trying to install Falco on my home lab (K3s v1.23.6+k3s1 on Pop!_OS v20.04). For work I need to create a response engine, for that I have chosen FalcoSidekick and OpenFAAS - before taking this to EKS I want to test it locally.
I am using the standard Helm chart:
kubectl create ns falco
helm upgrade --install falco \
--set falco.jsonOutput=true --set auditLog.enabled=true \
--set image.repository=falcosecurity/falco-no-driver \
--set falcosidekick.enabled=true \
--set falcosidekick.config.openfaas.functionname="falco-pod-delete" \
--namespace falco \
falcosecurity/falco
The issue occurs as the falco-driver-load InitContainer is unable to download the driver fom my OS (from here, so it tries to build the driver and fails.
* Looking for a falco module locally (kernel 5.17.5-76051705-generic)
* Trying to download a prebuilt falco module from https://download.falco.org/driver/2.0.0%2Bdriver/x86_64/falco_pop_5.17.5-76051705-generic_202204271406.ko
curl: (22) The requested URL returned error: 404
Unable to find a prebuilt falco module
* Trying to dkms install falco module with GCC /usr/bin/gcc
warning: the compiler differs from the one used to build the kernel
The kernel was built by: gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0
You are using: gcc (Debian 5.5.0-12) 5.5.0 20171010
CC [M] /var/lib/dkms/falco/2.0.0+driver/build/main.o
gcc: error: unrecognized command line option '-mharden-sls=all'
gcc: error: unrecognized command line option '-Wimplicit-fallthrough=5'
make[2]: *** [scripts/Makefile.build:288: /var/lib/dkms/falco/2.0.0+driver/build/main.o] Error 1
I was wondering if I would be able to use the Ubuntu driver, and if so how can I override this?