From 4f2479ae58f18c25c83c58d7a83d5203cdd37142 Mon Sep 17 00:00:00 2001
From: Fabricio Voznika <fvoznika@google.com>
Date: Wed, 30 Nov 2022 15:14:37 -0800
Subject: [PATCH] Add K8s to Falco+gVisor tutorial

PiperOrigin-RevId: 492030619
---
 g3doc/user_guide/tutorials/falco.md | 47 ++++++++++++++++++-----------
 1 file changed, 29 insertions(+), 18 deletions(-)

diff --git a/g3doc/user_guide/tutorials/falco.md b/g3doc/user_guide/tutorials/falco.md
index 80d933347..0e24d78b8 100644
--- a/g3doc/user_guide/tutorials/falco.md
+++ b/g3doc/user_guide/tutorials/falco.md
@@ -4,11 +4,16 @@
 
 ## Installation
 
+This section explains the steps required to install Falco+gVisor integration
+depending your environment.
+
+### Docker
+
 First, install [gVisor](/docs/user_guide/install/) and
 [Falco](https://falco.org/docs/getting-started/installation/) on the machine.
 Run `runsc --version` and check that `runsc version release-20220704.0` or newer
 is reported. Run `falco --version` and check that `Falco version` reports
-`0.32.1` or higher.
+`0.33.1` or higher.
 
 Once both are installed, you can configure gVisor to connect to Falco whenever a
 new sandbox is started. The first command below generates a configuration file
@@ -19,27 +24,10 @@ Docker runtime pointing it to the configuration file we just generated:
 
 ```shell
 falco --gvisor-generate-config | sudo tee /etc/falco/pod-init.json
-# Edit /etc/falco/pod-init.json, see note below.
 sudo runsc install --runtime=runsc-falco -- --pod-init-config=/etc/falco/pod-init.json
 sudo systemctl restart docker
 ```
 
-> **Note:** Between steps 1 and 2 above, edit the `pod-init.json` file to add
-> `ignore_setup_error` to the sink options (this will be fixed in the next Falco
-> release). The file will look like this:
-
-```json
-      "sinks" : [
-         {
-            "config" : {
-               "endpoint" : "/tmp/gvisor.sock"
-            },
-            "name" : "remote",
-            "ignore_setup_error": true   <== ADD THIS LINE
-         }
-      ]
-```
-
 gVisor is now configured. Next, let's start Falco and tell it to enable gVisor
 monitoring. You should use the same command line that you normally use to start
 Falco with these additional flags:
@@ -68,6 +56,29 @@ command above, the configuration files are defined in
 `/etc/falco/faco_rules.yaml` and `/etc/falco/faco_rules.local.yaml` (where you
 can add your own rules).
 
+### Kubernetes
+
+If you are using Kubernetes, the steps above must be done on every node that has
+gVisor enabled. Luckily, this can be done for you automatically using
+[Falco's Helm chart](https://github.com/falcosecurity/charts/blob/master/falco/README.md).
+You can find more details, like available options, in the
+[*About gVisor*](https://github.com/falcosecurity/charts/blob/master/falco/README.md#about-gvisor)
+section.
+
+Here is a quick example using
+[GKE Sandbox](https://cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods),
+which already pre-configures gVisor for you. You can use any version that is
+equal or higher than 1.24.4-gke.1800:
+
+```shell
+gcloud container clusters create my-cluster --release-channel=rapid --cluster-version=1.25
+gcloud container node-pools create gvisor --sandbox=type=gvisor --cluster=my-cluster
+gcloud container clusters get-credentials my-cluster
+helm install falco-gvisor falcosecurity/falco \
+  -f https://raw.githubusercontent.com/falcosecurity/charts/master/falco/values-gvisor-gke.yaml \
+  --namespace falco-gvisor --create-namespace
+```
+
 ## Triggering Falco Events
 
 Let's run something interesting inside a container to see a few rules trigger in