pre-built eBPF probe seems to be halfway missing for amazonlinux about test-infra HOT 5 CLOSED

So if you look at the various objects for the drivers we have 2

eBPF

which uses the .o syntax and is just a good ol' fashioned ELF object that we have all grown to love.

Kernel Modules

which use the .ko syntax (short for kernel object) which is slightly different.

In your example you have

ebpf:
  enabled: true

Probably the quickest fix is to flip that to false.

If for some reason we need the eBPF probe instead of the kernel module (they roughly do the exact same thing but exist for various use cases) we can talk more about getting the .o file into the builds. Just let us know.

Typically the eBPF driver (or .o file) is reserved for users who run on GKE because of their underlying kernel restrictions. Which would explain why we don't pre-build it for EKS folks :)

from test-infra.

PS: please let us know what happens if you have time. I closed the issue to spare the other maintainers, but you can reopen at any time. ✌️

from test-infra.

Thanks @kris-nova for replying to @timothy-spencer :)

Let me just add that the place for this kind of issue is https://github.com/falcosecurity/test-infra where we have the system that prebuilds drivers (best-effort).

I'll move the issue there for future reference. Thanks!

from test-infra.

Thanks for the information. Turning off eBPF does indeed work. I have a vague memory of turning this on because some documentation said I needed to, perhaps while I was trying to test it out in AWS Fargate.

Anyways, it's working now. Thanks again!

from test-infra.

Amazonlinux support was just added in test-infra. See #139

from test-infra.