There is no way to install Falco in private network without internet using Helm

[EsDmitrii]

There is no way to install Falco in private network without internet using Helm

[EsDmitrii]

Hi @LucaGuerra !
Thank you for your help!
Will try these ways:)
I appreciate it!

[LucaGuerra]

Hi @EsDmitrii , it should be possible to achieve what you are mentioning in several ways:

1. Regarding the driver loader it appears that you are using kernel 3.x . The current image is a bit newer than that so it does not contain the necessary toolchain to compile the driver for those kernels. However, we distribute an older one as well that you can use with the chart https://github.com/falcosecurity/charts/tree/master/falco#selecting-an-different-driver-loader-image . Alternatively, you can distribute your kmod versions in your internal webserver and use the DRIVER_REPO env variable in the loader container to specify a different host than the default one so it won't connect to the Internet

2. Regarding the rules (and plugins!) you have a number of options. To name a few:

• Configmap: examples here -- https://falco.org/blog/rules-helm-chart-3-0-0/ basically that is ok if you want to quickly change the rules in your k8s cluster, but will probably not be the right solution if you want to mirror the official ones or you have a versioned rules repo that you are maintaining for your environment.
• Mirroring artifacts from the official Falco repositories: if you only need to mirror the official rules files you can simply copy them over or mirror them from https://github.com/orgs/falcosecurity/packages?repo_name=rules , for example if you copy ghcr.io/falcosecurity/rules/falco-rules:2 (floating tag, or 2.0.0 full tag, or both!) onto registry.internal.example.com/falcosecurity/rules/falco-rules:2 you will be able to install the helm chart with helm install falco falcosecurity/falco --set "falcoctl.config.artifact.install.refs={registry.internal.example.com/falcosecurity/rules/falco-rules:2} --set "falcoctl.config.artifact.follow.refs={registry.internal.example.com/falcosecurity/rules/falco-rules:2}" so that all downloads will point to your registry (usage of index files is required if you want signature check as well!)
• Full GitOps with OCI artifact distribution: you can publish and load own your rules onto any OCI registry, public or private, such as the one you use for distributing container images. This is an in-depth blog post that explains that in detail including the usage of the index files: https://falco.org/blog/gitops-your-falco-rules/

Let us know if this helps!