[tracking] Falco v0.33 release

[jasondellaluce]

Scheduled to happen: ~2022-09-30 (delayed)

POSTPONED
ETA: ~one week after falcosecurity/libs v0.9.0 release Released on 2022-10-19

During the community call of 2022-09-28 I proposed myself as a release manager, and together with the other maintainers we plan to release v0.33 as soon as possible. Different factors caused this release to be running late, but this was mostly due to the new experimental release process, refactoring and fixing some parts of falcosecurity/libs, and lack of bandwidth from the maintainers.

Will keep this issue updated with the current status and progress.

Current Status

• Code freeze in falcosecurity/libs
• Code taw in falcosecurity/libs
• Release libs v0.9.0: https://github.com/falcosecurity/libs/releases/tag/0.9.0
• Release drivers v3.0.1: https://github.com/falcosecurity/libs/releases/tag/3.0.1%2Bdriver
• Code freeze in falcosecurity/falco
• Open release branch in Falco
  • https://github.com/falcosecurity/falco/tree/release/0.33.0
  • Branch-protect the branch: update(config.yaml): protect Falco 0.33.0 branch test-infra#871
• Code thaw in falcosecurity/falco
• Release Falco v0.33.0

Release Steps

Process is described in this document, but we are experimenting the new process drafted in falcosecurity/libs#580.

Release Blocking PRs

• cleanup(scripts): cleanup systemd unit in DEB + RPM packages #2138
• Add rule to detect bypass by symlink files #2202 (postponed to next release)
• chore: bump libs/driver to the latest release branch commit #2232
• fix(rules): add falco no-driver images to k8s_containers macro #2234
• fix(userspace/falco): make signal termination more robust with multi-threading #2235
• update(userspace): minor pre-release improvements #2236
• fix(userspace): safely check string bounded access #2237
• fix(userspace/falco): make termination and signal handlers more stable #2239
• fix(falco_service): falco service needs to write under /sys/module/falco #2238
• fix(userspace): properly print ignored syscalls messages when not in -A mode #2243
• chore: bump libs version #2244
• update(userspace): solve warnings and performance tips from cppcheck #2247
• fix(userspace): cleanup output of ruleset validation result #2248
• chore(userspace/falco): make logging optional when terminating, restarting, and reopening outputs #2249
• chore(userspace/falco): improve cli helper and log options with debug level #2252
• update(userspace/falco): move on from deprecated libs API for printing event list #2253
• fix(userspace/falco): avoid using CPU when main thread waits for parallel event sources #2255
• chore: bump plugin version #2256
• chore: use latest libs tag 0.9.0 #2257
• update(userspace/falco): turn error into warning log when plugins are loaded but unused #2258 (postponed to next release)
• fix(libsinsp, libscap): fix compiler warning about uninitialized var libs#653
• fix(kmod): fix kmod build on some kernels libs#652
• fix(userspace/libsinsp): set event number consistently libs#655
• new(libsinsp,libscap): add a new generable event API libs#656
• fix(driver): avoid kmod buffer corruption in case of len>max_arg_size libs#660
• update(libscap-engine-kmod): avoid a write operation when not necessary libs#661
• fix(userspace): add compat syscalls header  libs#662
• fix(userspace/sinsp): return event names of generic syscall events libs#663
• fix(userspace): split is_unused from is_skip_parse_reset event checks libs#665
• fix(userspace/libsinsp): do proper checks on syscall.type filtercheck libs#669

Manual Testing Action Items

• Running Falco on Kubernetes with the official Helm Charts
• Running Falco from RPM and DEB artifacts
• Running Falco in a container with the official images
• Running/fuzzing Falco with multiple event sources active in parallel
• Running/fuzzing Falco with variable syscall buffer dimension
• Running Falco in all officially-supported architectures (x86_64, ARM64)
• Running Falco with the supported drivers (kmod, eBPF, gVisor, trace files)
• Test Falco with event generator
• Test that plugins are correctly loaded
• Test memory and CPU usage (with Valgrind and other tools)
• Test latest version of driver loader
• Test that k8s metadata enrichment client works as expected
• Test that all Falco CLI options work as expected
• Check that Falco log messages are correct and consistent
• Test that Falco ruleset loading and validation works as expected

Action Items

• Pre-Release
  • Milestone: https://github.com/falcosecurity/falco/milestone/24
  • Sync with new falcosecurity/libs release v0.9.0:
    • [TRACKING] Libs Release libs#626
    • chore: use latest libs tag 0.9.0 #2257
  • Sync with new falcosecurity/libs driver release v3.0.1:
    • chore: use latest driver tag 3.0.1+driver #2251
  • Release plugin-sdk-go: https://github.com/falcosecurity/plugin-sdk-go/releases/tag/v0.6.0
  • Release plugins:
    • update: bump plugin-sdk-go to v0.6.0 and plugin version plugins#168
    • https://github.com/falcosecurity/plugins/releases
  • Prebuilt drivers publish
    • update(dbg): added new 3.0.1+driver configs. test-infra#869
  • Changelog
    • update(changelog.md): add entry for Falco 0.33.0 #2261
    • release branch sync: update(CHANGELOG.md): sync changelog changes #2264
• Release
  • Tag: https://github.com/falcosecurity/falco/tree/0.33.0
  • Github Release: https://github.com/falcosecurity/falco/releases/tag/0.33.0
• Website
  • Create 0.32 snapshot
    • Protect snapshot branch: update(config.yaml): protect v0.32 website snapshot branch test-infra#876
  • chore(content): updated running page with newest informations. falco-website#699
  • Update docs for json_output option to reflect alerts+rules result v2 falco-website#659
  • update(sources/drivers): refresh Falco Drivers page with updated info falco-website#701
  • update(content/en/docs): refresh list of syscall events for Falco 0.33.0 falco-website#702
  • update(content/en/docs): sync cli option list with Falco 0.33 falco-website#703
  • update(content/en/docs): sync supported field list with Falco 0.33 falco-website#704
  • update(content/en/docs): sync falco configuration docs with Falco 0.33.0 falco-website#705
  • update(content/en/docs): sync plugin api reference with Falco v0.33 falco-website#706
  • update(content/docs): sync with docs changes of Falco 0.33.0 about alerts and event sources falco-website#708
  • update(learning.md): sync with docs changes of Falco 0.33.0 about minikube falco-website#710
  • update(config.toml): update website to v0.33 falco-website#714
  • new(content/en/blog): add post for Falco 0.33 falco-website#716
• Announcements
  • mailing list
  • slack channel: https://kubernetes.slack.com/archives/CMWH3EH32/p1666194408614249
• Post-Release
  • Update helm charts
    • support falco 0.33.0 charts#409
  • Archive community call meeting notes:
    • update(meeting-note): add v0.32.2 snapshot community#161

Miscs

/milestone 0.33.0

/assign @jasondellaluce

/kind documentation

[jasondellaluce]

Code freeze on Falco starts today!

[jasondellaluce]

Release branch has been opened! https://github.com/falcosecurity/falco/tree/release/0.33.0

[leogr]

Not actually an item for the release, but I want to keep a note of it here, so we won't forget.
After the release, we need to release the event-generator too, because of this 👇
falcosecurity/event-generator#77

[leogr]

For the same reason
👇
falcosecurity/falco-exporter#74

[jasondellaluce]

Code taw for Falco happens now! We can resume regular PR merging on mainline!

[jasondellaluce]

Falco has been released! 🥳

[leogr]

event-generator, falco-exporter and all charts have been updated!

I think it's time to close this issue, cc @jasondellaluce

[jasondellaluce]

/close 😍

[Andreagit97]

A big thank you to @alacuku for the help with helm charts!