Open
Description
Latest version of rules not compatible with latest released version of Falco.
Running falco 0.40.0 from the helm chart with falcoctl following falco-rules:latest
According to the repo description it should be compatible with Falco 0.40.0
Falco currently faling to load latest rules.
Tue May 27 13:33:00 2025: Falco version: 0.40.0 (x86_64)
Tue May 27 13:33:00 2025: Falco initialized with configuration files:
Tue May 27 13:33:00 2025: /etc/falco/config.d/engine-kind-falcoctl.yaml | schema validation: ok
Tue May 27 13:33:00 2025: /etc/falco/falco.yaml | schema validation: ok
Tue May 27 13:33:00 2025: System info: Linux version 5.15.0-1073-azure (buildd@lcy02-amd64-075) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #82-Ubuntu SMP Mon Sep 2 11:36:34 UTC 2024
Tue May 27 13:33:00 2025: Loading rules from:
Tue May 27 13:33:00 2025: /etc/falco/falco_rules.yaml | schema validation: ok
Error: /etc/falco/falco_rules.yaml: Invalid
1 Errors:
In rules content: (/etc/falco/falco_rules.yaml:0:0)
required_engine_version: (/etc/falco/falco_rules.yaml:27:2)
------
- required_engine_version: 0.50.0
^
------
LOAD_ERR_VALIDATE (Error validating rule/macro/list/exception objects): Rules require engine version 0.50.0, but engine version is 0.46.0
Expect the currently up to date falco version to work with the current rule definition. Is there any other tag than latest falcoctl can follow to guarantee compatibility?
Environment
- Falco version:
- System info:
- Cloud provider or hardware configuration:
- OS:
- Kernel:
- Installation method:
Additional context