Falco kernel module
Falco deploys a kernel module to monitor system calls on the host system. Since kernel modules must be compatible with the host kernel, you need to have a module that works with the worker node's host operating system.
Falco attempts to load or create a module in a few different ways:
- If there is a pre-built module available for the hosts kernel, Falco will download and use the module automatically.
- If no pre-built module exists for the worker node's kernel, Falco will attempt to build a module using any installed kernel-headers from the host.
At the time of writing, Falco offers an early-access alternative method for Falco probes, where they are created using a utility called driverkit. This new utility automates the creation of a new probe based on the kernel information of the host machine. The process of creating a probe using driverkit will be covered in detail since we will use it to create a Falco probe for our KinD cluster...
