Proposing Falco for graduation

[leodido]

This is a formal proposal to consider Falco for CNCF graduation.

In this PR you can find the proposal document that highlights how Falco has met the graduation criteria as defined by CNCF.

Please let me know if anything is missing or can be clarified further.

[krisnova]

strong plus 1 from me, i'll reserve my opinions on exactly why i think this should happen for another day. regardless of the reasoning - i do passionately believe this should happen.

[rikatz]

+1 from me.

I've returned to using Falco the last few weeks, the project is solid, the documentation is helpful, the developers/maintainers are accessible, passionate and the community team is great making Falco well suited for graduation and for the de-facto tool in Cloud Native landscape for container security IMO!

[ssurovich]

I agree with @rikatz - +1 from me. Falco has proven itself as an incredibly stable tool that we have made a standard on our clusters. The team is one of the most helpful OSS project teams I have dealt with, you can see the growth and support from the team on how they have addressed issues over the years, updated documentation, and they add additional support with tools like Sidekick and the Sidekick UI. This project deserves graduation, I think it deserved consideration a long time ago :)

[shane-lawrence]

+1. We've been putting Falco to work @Shopify and have been very happy with the project's evolution. In particular, the maintainers have been uncommonly kind and responsive as they've steered the product to its current status. Especially following falcosecurity/falco#1530, I fully support moving to graduation.

[cpanato]

+1
This project reflects a lot in how to build a strong community and build a product that grows taking into consideration feedback from several groups of people.

[Rajakavitha1]

• To enable wider adoption of the product the Falco website content is translated in Chinese, Korean, Japanese, and Malayalam languages.

[Rajakavitha1]

A huge +1 from me!!!

[TheFoxAtWork]

SIG-Security would like to raise a concern regarding vendor independence (from due diligence doc) and its impact of the existing security audit of the project.

[TheFoxAtWork]

SIG-Security would like to raise a concern regarding the vendor independence of the Falco project. The Incubation Due Diligence document shows many items that are indicated to be resolved prior to graduation. Reviewing the existing codebase highlights several areas without independence but also reflect efforts of that transition. This in turn causes confusion to the community as it is not clear what the scope of Falco is. Organizations may not simply deploy Falco as is, rather they must also deploy sysdig to reap the value of the project.

If the separation were to be completed, the existing security audit of 2019 may no longer be relevant to the project as significant changes may have occurred. The scheduled security audit for later this year would be beneficial, provided the separation were completed.

CC @lizrice & @justincormack

[leodido]

Hello Emily!

I'd like to answer your comment by summarizing the discussion (and the plan we came up with) during our call last week.

To recap:

1. The current Falco prebuilt drivers - those installed when using the DEB, RPM, and tarball Falco packages - are already built from the contributed libs repository thanks to driverkit and our Open Falco Infra (Prow) (see build-drivers, its ProwJobs definitions, and an example run)

2. There are 2 ongoing PRs to complete the refactoring of the CMakeLists.txt files both in Falco and in libs repository

3. Today, I've finally published 5 GitHub Security Advisories on falcosecurity/libs containing detailed information about all the finding of the security audit done in July 2019, and the relative fixes

   • You can find them here

4. The findings (and the fixes) of the security audit regarding Falco only have been already published as Github Security Advisories

5. The falcosecurity/libs code doesn't present substantial changes in the API or in the behavior to the code base that underwent a security audit in July 2019
   The only differences are due to:

   • Fixes to vulnerabilities found during the security audit
   • Fixes on the eBPF driver (mostly to make the eBPF verifier happy on newer Linux kernels)
   • Fixes regarding the bpf_probe_read_str() usage
   • Fixes to the handling of syscalls getting relative or absolute file paths
   • Fixes to properly use newer libcurl features
   • Memory leaks fixes
   • Support for tracing the renameat2 syscall
   • Support for tracing the fchmodat, fchmod, chmod syscalls
   • Support to fetch Kubernetes liveness/readiness probe from related containers (when not available in the container info labels)
   • Async DNS resolution using c-ares
   • The userspace API (an experimental API - see pdig driver, or -u Falco flag)
   • Decoupling and refactoring code (cosmetic changes) to let the libs contribution happen
   • Refactoring of the CMakeLists.txt files to let the libs contribution happen

   We can prepare a deck/presentation to present the libs repository to the SIG-Security, if requested

Roadmap: as you may notice, there's a lot already done to complete the transition, and there's active ongoing work (point 2) to complete it that will be complete very soon.

Feel free to reach out if you have any questions. :)

[lizrice]

Seems like there are still a lot of Sysdig references - I appreciate that some of these are completely legitimate but almost 500 in the code seems like a lot, please could you comment on that?

[caniszczyk]

Just a reminder for the Falco team, CNCF has website guidelines on how you can refer to the progenitor organization: https://github.com/cncf/foundation/blob/master/website-guidelines.md

[leodido]

Hi @lizrice,
Thank you for pointing this out - there are a few reasons why some sysdig references are still around:

1. Most of them (260) are related to the libraries that have recently been contributed to the CNCF.

   In order for this donation to happen, a dedicated action plan was discussed and approved within the Falco community between Nov 2020 and Jan 2021. As per this plan, we decided not to disrupt the original codebase and git history all at once, but instead to distribute minor refactoring efforts over time (see point Develop a process for Working Group formation #3 of the action plan items), and these efforts are still ongoing.

   I would like to point out that the key items related to the ownership of the libraries' code have been prioritized and completed. These include org governance (under which the contributed libraries fall), libs licensing and using those libs to create Falco pre-built drivers.

   We are confident that removing the vast majority of the references to sysdig in the libraries can be accomplished with a relatively small effort, we are committed to doing it, and there is a PR related to it: libs#35.

2. Some other references (98) are actually part of archived repositories, precisely:

   • falco-security-workshop (30)
   • kubernetes-response-engine (21)
   • katacoda-scenarios (21)
   • falco-operator (9)
   • cloud-native-security-hub (7)
   • falco-google-kubernetes-marketplace (4)
   • falco-aws-firelens-integration (2)
   • cloud-native-security-hub-backend (1)
   • cloud-native-security-hub-frontend (1)
   • profiles (1)
   • falcosecurity.github.io (1)

   A dedicated cleanup activity has already been scheduled by the community but postponed since not urgent.

3. Of the remaining 123 references:

   • 46 are contained inside our website and mostly refer to the above-mentioned libs before they were contributed
   • 31 are part of community meeting notes
   • 22 are into the main repo and most of them are due to disappear as soon as some PRs get merged (e.g. falco#1552)
   • 7 are into our evolution repo which is dedicated to hosting drafts and sandbox projects from our community
   • The remaining 17 items are a mix of old links and legacy mentions

Hope this helps to address your concerns - happy to go deeper into details if needed!

---

Update

During the last days, the Falco community took a step forward in completing the deletion of the references. As you can see the overall number is ~50% (253 references at the moment vs 481 before) of the past week.

Some of the PRs regarding this ongoing effort:

• fix the license at the top of the source code files falcosecurity/libs#35
• Update brand and URL references falcosecurity/evolution#67
• Wording and refactoring of docs falcosecurity/libs#36
• Remove deprecated OCI image repositories in default ruleset falcosecurity/falco#1634
• Fix broken links falcosecurity/pdig#21

The greatest drop in the number of references is on the libs repository that went down from 260 to 50 total references.

[robbycochran]

+1
StackRox utilizes falcosecurity/libs and we would like to contribute upstream patches. We look forward to participating in the Falco community and support the CNCF graduation of Falco.

[mrbobbytables]

I'm not a contributor to Falco, but was a heavy end user in my previous role. They've done a great job with building a community around the project 👍

It's been a little over a month since the last update, but it looks like there has been a good amount of progress towards reducing references:

For the various references to sysdig in the codebase, I did a quick look:

• There are 244 remaining references, 146 if you omit the archived repos.
• Of those, 24 are references in the falcosecurity/libs repo.
• 16 in Falco's primary repo, with a few being changelog items etc.
• Theres still about the same amount in the website repo, but a good chunk of those are blog posts or localizations of content.

If there are concerns about still having a high number of references from the archived projects in the main project org, one potential idea might be to mimic the archive org pattern e.g. kubernetes-retired and move the repos there which can act as a very clear signal to users about the state of those projects.

[fntlnz]

Hi! Falco maintainer here, just noticed this #671

Should we review our application to follow a new process? Would anyone be able to provide any guidance/help in getting the application updated?

cc/ @lizrice @amye

[amye]

#671 has details on exactly this!
The process will change from the current process of submitting a PR and asking for a TOC sponsor to move forward, to a more streamlined process at the time that this PR passes a TOC vote. Projects applying for graduation that do not yet have a TOC sponsor will be moved to this process at the time of an approved vote.

[fntlnz]

I saw that note, I was more focused on the:

Would anyone be able to provide any guidance/help in getting the application updated?

Just want to make sure we do it right and we don't get lost in processes. We didn't have a chance to connect with people for this and are stuck in a more process > people situation rather than a situation where people are > processes.

I feel like just having a conversation and getting guidance and feedback would help Falco and other projects succeding rather than just following a checklist in this stage.

[leogr]

Hi,

Falco maintainer here. Is there any update on the new streamlined process (i.e., #667, #671)? As far as I know, it has not yet been confirmed, and we are still stuck in limbo. It would be beneficial for us to have a guide to understand how to proceed (e.g., is there something we should address or just awaiting proper cycles to address the graduation process).

[amye]

@leogr: The process has not changed, the changes to the graduating process are still in proposal. My comments from before still apply.

#671 has details on exactly this!
The process will change from the current process of submitting a PR and asking for a TOC sponsor to move forward, to a more streamlined process at the time that this PR passes a TOC vote. Projects applying for graduation that do not yet have a TOC sponsor will be moved to this process at the time of an approved vote.

[lizrice]

A few thoughts from me

• I'm confused by the different OWNERS files and also maintainers file.

• Two of the most active maintainers moved organization within the last few weeks. That could be great from the point of view of vendor independence, but I'd like to see this given some time to "bed in" and ensure that the project is truly stable.

• Thanks to @mrbobbytables's update it sounds like there is still some way to go with the removal of Sysdig references?

[leogr]

• I'm confused by the different OWNERS files and also maintainers file.

The maintainers.yaml contains the list of the current maintainers and is generated from the OWNERS files of all projects within falcosecurity GitHub organization. Periodically, it is automatically updated by our infra.

• Thanks to @mrbobbytables's update it sounds like there is still some way to go with the removal of Sysdig references?

There's an ongoing effort to reduce the reference count. Currently, it already went down from ~500 to 170 (including archived contents and some legitimate references). Is there perhaps any particular area to be cleaned up that we should prioritize?

[mrbobbytables]

Thanks to @mrbobbytables's update it sounds like there is still some way to go with the removal of Sysdig references?

Most of those seem like valid references to sysdig - e.g. 100~ instances are from markdown and most of those are changelog items, meeting notes etc.

The one standout area is the sysdig/libs repo, where there are still some carryover code references from when it was migrated, with the caveat that there is a PR in flight to take care of most of them.

[amye]

Administratively: I'm closing this pull request based on the July 20th meeting, where Falco was discussed and the TOC recommended that Falco reapply in 6 months.
We look forward to a January application!

[dims]

Related traffic:

• [tracking] Preparation for Falco Graduation falcosecurity/falco#2106
• [tracking] Preparation for Falco Graduation falcosecurity/evolution#156
• [tracking] cleanup inactive maintainers falcosecurity/evolution#157

@leodido @ewilderj are there other public places where you all are figuring out steps or things to do (before filing for graduation again)?

[leogr]

Hey @dims

We are trying to keep everything within the https://github.com/falcosecurity/evolution repository.

This 👇 is the PR to update the governance document.
falcosecurity/evolution#169

I will keep you posted in case there're other relevant references.