3 ms·

Hey all - Seth from Google here. Please let us know if you have any questions regarding GKE or questions about the upgrade process. I'm also happy to escalate a

Hey all - Seth from Google here. Please let us know if you have any questions regarding GKE or questions about the upgrade process. I'm also happy to escalate any feedback to our internal product and engineering teams. Here's link to our security posting with more information and upgrade procedures: https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc https://cloud.google.com/kubernetes-engine/docs/security-bul...

sethvargo 8y ago
One thing I want to emphasize: you are only affected if you're using Ubuntu base images for your node pools. If you're using COS, you are unaffected.
- numbsafari 8y ago
  It would be great if folks could run COS and leverage tools like Falco. I realize there is a trade-off between having a totally locked down OS and being able to flexibly use such tools. However, Google and Sysdig announced a partnership around Falco and GCSCC integration. It would make sense that such a tool would be able to be run on COS. Perhaps I'm guilty wanting to have my cake and eat it, too. But this seems like an area where GKE and COS are somewhat limited.
  - random_copy 8y ago
    Falco can read events via an ebpf program (instead of the falco-probe kernel module). https://github.com/draios/sysdig/wiki/eBPF https://github.com/draios/sysdig/wiki/eBPF So, falco will work on GKE and COS
  - markstemm 8y ago
    Hi, Falco developer here. We do have support for running falco with an ebpf program taking the place of the kernel module. You can learn more about ebpf support at https://github.com/draios/sysdig/wiki/eBPF https://github.com/draios/sysdig/wiki/eBPF, and you should be able to run falco with ebpf by setting an environment variable SYSDIG_EBPF_PROBE="".
    - numbsafari 8y ago
      This is awesome news! I see it’s still beta, which is probably why the Falco docs still say GKE users must run Ubuntu images. Adding this to my tracking list. Thanks.
jhealy 8y ago
I'm interested in why COS is unaffected - is it due to the read-only root filesystem?
- tssuser 8y ago
  Yes.

sethvargo 8y ago

One thing I want to emphasize: you are only affected if you're using Ubuntu base images for your node pools. If you're using COS, you are unaffected.

numbsafari 8y ago
It would be great if folks could run COS and leverage tools like Falco. I realize there is a trade-off between having a totally locked down OS and being able to flexibly use such tools. However, Google and Sysdig announced a partnership around Falco and GCSCC integration. It would make sense that such a tool would be able to be run on COS. Perhaps I'm guilty wanting to have my cake and eat it, too. But this seems like an area where GKE and COS are somewhat limited.
- random_copy 8y ago
  Falco can read events via an ebpf program (instead of the falco-probe kernel module). https://github.com/draios/sysdig/wiki/eBPF https://github.com/draios/sysdig/wiki/eBPF So, falco will work on GKE and COS
- markstemm 8y ago
  Hi, Falco developer here. We do have support for running falco with an ebpf program taking the place of the kernel module. You can learn more about ebpf support at https://github.com/draios/sysdig/wiki/eBPF https://github.com/draios/sysdig/wiki/eBPF, and you should be able to run falco with ebpf by setting an environment variable SYSDIG_EBPF_PROBE="".
  - numbsafari 8y ago
    This is awesome news! I see it’s still beta, which is probably why the Falco docs still say GKE users must run Ubuntu images. Adding this to my tracking list. Thanks.

jhealy 8y ago

I'm interested in why COS is unaffected - is it due to the read-only root filesystem?

tssuser 8y ago
Yes.