Release notes

v1.1.11

Release date: 2026-09-18

Fixes FalcoAuditRules being rejected on Astra Linux nodes with the closed software environment enabled, and stops a failure of the validator itself from being reported as an invalid rule set.

Highlights

Changes in this release:

• FalcoAuditRules can be created and updated on Astra Linux nodes where the closed software environment verifies digital signatures. A single request used to be enough to make one webhook endpoint reject every rule set until its Pod was recreated.
• A rules-loader that cannot run its validator now reports an error instead of a verdict, so the configured failurePolicy applies and the write is not blocked.

New features

This release adds:

• Added the D8RuntimeAuditEngineRulesNotValidated alert. It fires when the rules-loader validating webhook cannot run its validator and, under failurePolicy: Ignore, accepts FalcoAuditRules without checking them. That state is otherwise invisible: the writes succeed and nothing else reports it.

Fixes

This release fixes:

• Creating or updating any FalcoAuditRules could fail with admission webhook "d8-runtime-audit-engine.deckhouse.io" denied the request: spec validation error: falco -V failed: signal: segmentation fault, and kept failing for as long as the rules-loader Pod lived. This happened on Astra Linux nodes with the closed software environment enabled: the kernel verifies the signature of the falco executable on its first run by an unprivileged process, which takes seconds for a 326 MB file, while rules-loader allowed the run 5 seconds and then killed it. The kernel caches an interrupted check as failed, so every later run of the same file ended with SIGSEGV. rules-loader now verifies the executable at start-up, before the webhook begins accepting requests, and no longer cuts a signature check short on a brief timeout.
• A rules-loader that could not run falco at all returned allowed: false: the submitted FalcoAuditRules was rejected, and failurePolicy: Ignore had no effect, because from the API server’s point of view the webhook had answered successfully. Such a failure is now returned as an error, so the configured failurePolicy applies. A rule set falco refuses is still rejected, whether it refuses it while compiling the rules or over the plugin versions they require.
• Rule sets were rejected when what was broken was the validator’s own environment rather than the rules: falco exits with the same status whether it found an error in the rules or could not read its configuration file or load a plugin. rules-loader told the two apart by that exit status, and in the second case rejected every FalcoAuditRules. When falco now fails without reporting on the submitted rules, rules-loader re-runs it over a rule set known to be good: if that one still validates, the validator works and the submitted rules are at fault.

v1.1.10

Release date: 2026-09-09

Syscall events now report the Kubernetes namespace and the Pod name. Fixes the module namespace being deleted on every release upgrade, makes DaemonSet rollouts survive a slow Falco start, adds an alert and a metric for rule synchronisation, restores the documented alert for critical events, and rebuilds the images with CVE remediation.

Highlights

Changes in this release:

• The d8-runtime-audit-engine namespace is no longer deleted and recreated on every release upgrade, which used to restart kube-apiserver and put the module into a loop of repeated upgrades.
• Events from syscall rules now report the Kubernetes namespace and the Pod name, so a workload no longer has to be identified by container ID alone.
• Falco has more time to reconnect to k8s-metacollector on startup, and DaemonSet rollouts update nodes in parallel batches, so a module upgrade no longer restarts Falco mid-start or takes hours on a large cluster.
• rules-loader Pod readiness no longer implies FalcoAuditRules have finished syncing - a new alert and a new metric track that instead.
• Module images are rebuilt with updated dependencies that remediate known vulnerabilities (CVE), and ship OpenVEX statements for the findings that do not apply to them.

New features

This release adds:

• The output of every syscall rule now ends with ns=<NAMESPACE> pod=<POD_NAME>, resolved from the container ID through the container runtime socket. The same two values are added to the output_fields property of the JSON output as k8s.ns.name and k8s.pod.name, which also fills the k8s_ns_name and k8s_pod_name labels of the falcosecurity_falcosidekick_falco_events_total metric. Rules of the k8sAudit type are unchanged: they already reported ns and pod taken from the Kubernetes audit event.
• Added the D8RuntimeAuditEngineRulesNotSynced alert, which fires when a rules-loader Pod has not finished syncing FalcoAuditRules.
• Added the falco_rules_loader_webhook_up metric, which reports whether the validating webhook’s HTTPS listener is bound. This is the condition the rules-loader readiness probe now reflects.

Improvements

This release improves:

• DaemonSet rollouts now update up to 25% of nodes at a time instead of one, avoiding multi-hour upgrades on large clusters.
• The D8RuntimeAuditEngineNotScheduledInCluster alert now waits 20 minutes instead of 15 before firing, so a slow but successful rollout no longer trips it.
• The resourcesRequests.vpa.scopeLabel parameter is validated as a Kubernetes label key, so an invalid value is rejected by ModuleConfig instead of producing a broken VPA configuration.
• Module documentation, the OpenAPI schemas, and the CRD reference are available even when the module is not installed in the cluster.

Fixes

This release fixes:

• The Namespace and SecurityPolicyException manifests were annotated as Helm hooks without a helm.sh/hook-delete-policy, which means the default before-hook-creation: every release upgrade deleted the namespace and created it again, taking the webhook TLS Secret, the control-plane-configurator ConfigMap and the workloads with it. Losing the ConfigMap made control-plane-manager recreate kube-apiserver, losing the Secret changed module values, and the missing workloads were reported as absent Helm resources - each of which started another module run, so the module upgraded itself in a loop. Both manifests are now ordinary chart resources, as they were before v1.1.5.
• Added a startup grace period of up to 900 seconds for Falco, so a slow reconnect to k8s-metacollector no longer gets it killed by the liveness probe (previously possible after about 105 seconds).
• The alert example in the FAQ selected falcosecurity_falcosidekick_falco_events_total{priority="Critical"}. The priority label carries a number and the text severity moved to priority_raw in lowercase, so the expression silently matched nothing and the alert never fired. It now uses priority_raw="critical".

Security updates

Security updates in this release:

• Rebuilt the module images with updated dependencies to remediate known vulnerabilities (CVE). This covers CVE-2026-56854, CVE-2026-56855 and CVE-2026-78662 in golang.org/x/crypto, CVE-2026-84303, CVE-2026-84304 and CVE-2026-84445 in google.golang.org/grpc, CVE-2026-56864 and CVE-2026-56865 in golang.org/x/mod, and CVE-2026-79921 in github.com/rabbitmq/amqp091-go.
• Added OpenVEX statements for GO-2026-5932 to the event-generator, falcosidekick, rules-loader and module bundle images. The finding is marked as not affected: golang.org/x/crypto/openpgp is not on the execute path of these images.

Upgrade notes

Before upgrading, note the following:

• On a cluster running v1.1.5 or v1.1.6, the upgrade to this version is the last one that deletes the namespace. Expect one final kube-apiserver restart and a few minutes of module churn while it settles, after which upgrades leave the namespace alone.
• Pod readiness for runtime-audit-engine no longer depends on rules-loader finishing its FalcoAuditRules sync - only on the validating webhook being up. If you have automation or dashboards that treat Pod Ready as a proxy for rules being fully applied, switch them to the D8RuntimeAuditEngineRulesNotSynced alert (based on the falco_rules_loader_ready metric) instead.
• Events from syscall rules carry two additional fields at the end of the message text: ns and pod. If you match the Falco message with an expression anchored to its end, update that expression. Consumers that read the output_fields property of the JSON output are unaffected, apart from gaining k8s.ns.name and k8s.pod.name.

Known issues

Known limitations of this release:

• The ns and pod fields of a syscall event can be empty: for activity that did not happen inside a container, and for the earliest events of a short-lived container, whose metadata Falco collects asynchronously from the runtime socket. The matching metric labels are then absent as well, because Prometheus drops an empty label — so do not build a PromQL selector on k8s_ns_name or k8s_pod_name, which would also skip every k8sAudit event. If you need enrichment that does not depend on this timing, process events through the security-events-manager module, which enriches them in the event-building pipeline instead.

Docs

Documentation changes:

• Added a section on Kubernetes metadata in event output to the advanced usage page. It describes the ns and pod fields, the metric labels they fill, and the conditions under which they are empty.
• Added the priority to priority_raw mapping to the metrics section of the advanced usage page.
• The FAQ section on notifications now points to the security-events-manager module as the primary way to alert on runtime audit events.
• The metrics section no longer says a Grafana dashboard is yet to come. The module ships the Runtime audit engine dashboard, and the section now describes what it shows.
• The metrics section and the FAQ now warn that an event arriving without a priority is exported with an empty priority_raw, which no priority_raw selector matches. An alert that has to cover such events needs a priority condition as well.

Dependencies

Dependency updates:

• falcosidekick: 2.34.1 → 2.35.0 (changelog)

  • Adds TLS and CA certificate settings for the OTLP outputs and fixes a race condition when several outputs are configured. The module configures a single output, so cluster behaviour does not change.

• falcoctl: 0.13.0 → 0.14.0 (changelog)

  • Rejects symlink and hardlink entries when extracting a tar.gz archive. The module ships the falcoctl binary inside the rules-loader image but never invokes it, so cluster behaviour does not change.

v1.1.6

Release date: 2026-08-19

Rewrote rules-loader in Go, enabled mTLS on the FalcoAuditRules validating webhook, added the builtInRulesTypes setting, enriched Falco output with pod metadata, and removed containerd and LVM false positives.

Highlights

Changes in this release:

• The rules-loader component is rewritten in Go and no longer ships the shell-operator and Python runtime.
• The FalcoAuditRules validating webhook requires and verifies client certificates, so only the Kubernetes API server can send it admission requests.
• The new builtInRulesTypes setting disables built-in rules by event source type; k8sAudit rules are also disabled automatically when the security-events-manager module is enabled.
• Falco syscall events carry pod namespace, pod name, and service account via the k8s_pod_info plugin.
• False positives on containerd temporary, ingest, and sandbox paths and on LVM lock files are gone.

New features

This release adds:

• Added the builtInRulesTypes parameter to disable built-in rules by event source type (k8sAudit, syscall).
• Built-in k8sAudit rules are disabled automatically when the security-events-manager module is enabled, to avoid duplicated Kubernetes audit events.
• Split the SSH rule into Inbound SSH Connection Attempt (TCP accept, pre-auth) and Inbound SSH Connection (post-auth execve, captures the username).
• Added proc.aname[1], proc.aname[3], and proc.vpid to the Falco output of containerd host rules for additional process context.
• Added pod namespace, pod name, and service account to Falco syscall rule outputs and to SecurityEvents, resolved by container ID through the k8s_pod_info plugin.

Improvements

This release improves:

• Rewrote rules-loader from shell-operator with Python hooks to Go: the image no longer contains the shell-operator runtime or Python dependencies.
• The falco container runs with the Unconfined AppArmor profile: the containerd default profile denies ptrace, which Falco needs to enrich events with data from /proc/<pid>.

Fixes

This release fixes:

• Excluded containerd .tmp-status* temporary files and io.containerd.content.v1.content/ingest paths from the Write below containerd images dir and Read below containerd images dir rules.
• Excluded the containerd sandbox directory (sandboxes/) from the Write below containerd images dir and Read below containerd images dir rules — these are legitimate containerd sandbox metadata operations.
• Excluded LVM lock files (/run/lock/lvm/) created by lvm, lvs, vgs, and pvs from the Container drift detected (open+create) rule — LVM creates its flock files with mode 0777, which is not container drift.
• Anchored security event regexes to Falco’s JSON "output":" field to prevent false positives from rules-loader validation logs.
• Added user.uid to the Falco SSH rule output and metadata.extra for additional process context.

Security updates

Security updates in this release:

• The FalcoAuditRules validating webhook now requires and verifies client certificates against the cluster admission webhook client CA, so only the Kubernetes API server can send AdmissionReview requests.
• Rebuilt module images with updated Go dependencies to remediate known vulnerabilities (CVE) in falcoctl, falcosidekick, k8s-metacollector, event-generator, and rules-loader.

Breaking changes

Changes that affect backward compatibility:

• The module requires Kubernetes 1.31 or later and is not installed on older clusters: it sets the AppArmor profile through the securityContext field, which is only available starting from that version. Upgrade the cluster to Kubernetes 1.31 or later before upgrading the module.

Upgrade notes

Before upgrading, note the following:

• If the security-events-manager module is enabled and you want to keep the built-in k8sAudit rules, set builtInRulesTypes.k8sAudit to true explicitly: otherwise these rules are no longer rendered.

Dependencies

Dependency updates:

• kubernetes: >= 1.31

  • Required for the appArmorProfile field in securityContext.

v1.1.4

Release date: 2026-07-21

Updated Falco to 0.44.1, Falcosidekick to 2.34.1, related components, and moved the named webhook port 4227 from the falcosidekick container to rules-loader.

Highlights

Changes in this release:

• Falco is updated to 0.44.1.
• Falcosidekick is updated to 2.34.1.
• k8s-metacollector is updated to 0.1.3.
• The k8saudit plugin is updated to 0.18.0.
• The named webhook port 4227 now belongs to the rules-loader container.

Improvements

This release improves:

• Moved the named webhook port 4227 from the falcosidekick container to the rules-loader container.

Security updates

Security updates in this release:

• Component updates in this release address known vulnerabilities (see Dependencies).

Dependencies

Dependency updates:

• falco: 0.43.1 → 0.44.1

• falcosidekick: 2.33.0 → 2.34.1

• k8s-metacollector: 0.1.2 → 0.1.3

• k8saudit: 0.17.0 → 0.18.0

v1.1.3

Release date: 2026-05-21

Added documentation for built-in rules, new Vertical Pod Autoscaler (VPA) and LimitRange settings, Falco non-ASCII output cleanup, and updated Falcoctl, event-generator, and plugins.

Highlights

Changes in this release:

• Documentation now describes the built-in rules shipped with the module.
• Operators can configure separate VPA calculation by node label and a LimitRange for module pods.
• Falco output strips non-ASCII characters.
• Falcoctl, event-generator, and the k8saudit / json plugins are updated.

New features

This release adds:

• Added a module setting to enable separate VPA calculation for runtime-audit-engine pods based on a node label (enabled by default for Deckhouse 1.76 or later).
• Added a module setting to configure a LimitRange for pods in the runtime-audit-engine namespace.
• Added cleanup of non-ASCII characters in Falco output.

Security updates

Security updates in this release:

• Component updates in this release address known vulnerabilities (see Dependencies).

Upgrade notes

Before upgrading, note the following:

• This release removes the LimitRange previously introduced because of a Falco memory leak and enables VPA by default.
• Review and, if needed, configure the new LimitRange and VPA module settings after upgrade.

Docs

Documentation changes:

• Added a documentation page that describes the built-in rules installed with the module.

Dependencies

Dependency updates:

• falcoctl: 0.13.0

• event-generator: 0.13.0

• k8saudit: 0.16.1 → 0.17.0

• json: 0.7.4

v1.1.2

Release date: 2026-04-30

Adapted the module for the CSE edition of Deckhouse Kubernetes Platform (DKP).

Highlights

Changes in this release:

• The module is adapted for operation in the CSE edition of DKP.

Improvements

This release improves:

• Adjusted module packaging and runtime settings required for CSE clusters.

v1.1.1

Release date: 2026-04-27

Updated Falco to 0.43.1, Falcosidekick to 2.33.0, and related collectors and plugins, including CVE-oriented component fixes.

Highlights

Changes in this release:

• Falco is updated to 0.43.1.
• Falcosidekick is updated to 2.33.0.
• k8s-metacollector is updated to 0.1.2.
• The k8saudit and k8smeta plugins are updated.
• CVE-oriented fixes are included for module components.

Security updates

Security updates in this release:

• Applied CVE-oriented fixes in component images.
• Component updates in this release address known vulnerabilities (see Dependencies).

Dependencies

Dependency updates:

• falco: 0.43.0 → 0.43.1

• falcosidekick: 2.33.0

• k8s-metacollector: 0.1.2

• k8saudit: 0.16.1

• k8smeta: 0.4.1

v1.1.0

Release date: 2026-02-27

Updated Falco to 0.43.0 and Falcoctl to 0.12.2, including CVE-oriented fixes in module services.

Highlights

Changes in this release:

• Falco is updated to 0.43.0.
• Falcoctl is updated to 0.12.2.
• CVE-oriented fixes are included for module services.

Security updates

Security updates in this release:

• Component updates in this release address known vulnerabilities (see Dependencies).
• Applied CVE-oriented fixes for module service images.

Dependencies

Dependency updates:

• falco: 0.43.0

  • Runtime detection engine update.

• falcoctl: 0.12.2

  • Falco tooling update.

v1.0.11

Release date: 2026-02-20

Added SecurityPolicyException objects for security policy exceptions, fixed critical vulnerabilities, and raised the Deckhouse Kubernetes Platform (DKP) requirement to 1.74 or later.

Highlights

Changes in this release:

• Operators can create SecurityPolicyException objects to exclude selected workloads from security policies.
• Critical vulnerabilities in module components are fixed.
• The module now requires DKP 1.74 or later.
• Documentation and examples for Falco audit rules are updated.

New features

This release adds:

• Added support for SecurityPolicyException custom resources to define exceptions from security policies.

Security updates

Security updates in this release:

• Fixed critical vulnerabilities (CVE) in module component images.

Upgrade notes

Before upgrading, note the following:

• Before upgrading, ensure the cluster runs Deckhouse Kubernetes Platform 1.74 or later.

Docs

Documentation changes:

• Updated the description and examples for Falco audit rules.

Dependencies

Dependency updates:

• deckhouse: >= 1.74