Skip to content

Latest version of falco-rules not compatible with latest released version of Falco (0.40.0) #293

Open
@robinlandstrom

Description

@robinlandstrom

Latest version of rules not compatible with latest released version of Falco.
Running falco 0.40.0 from the helm chart with falcoctl following falco-rules:latest
According to the repo description it should be compatible with Falco 0.40.0

Falco currently faling to load latest rules.

Tue May 27 13:33:00 2025: Falco version: 0.40.0 (x86_64)
Tue May 27 13:33:00 2025: Falco initialized with configuration files:
Tue May 27 13:33:00 2025:    /etc/falco/config.d/engine-kind-falcoctl.yaml | schema validation: ok
Tue May 27 13:33:00 2025:    /etc/falco/falco.yaml | schema validation: ok
Tue May 27 13:33:00 2025: System info: Linux version 5.15.0-1073-azure (buildd@lcy02-amd64-075) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #82-Ubuntu SMP Mon Sep 2 11:36:34 UTC 2024
Tue May 27 13:33:00 2025: Loading rules from:
Tue May 27 13:33:00 2025:    /etc/falco/falco_rules.yaml | schema validation: ok
Error: /etc/falco/falco_rules.yaml: Invalid
1 Errors:
In rules content: (/etc/falco/falco_rules.yaml:0:0)
    required_engine_version: (/etc/falco/falco_rules.yaml:27:2)
------
- required_engine_version: 0.50.0
  ^
------
LOAD_ERR_VALIDATE (Error validating rule/macro/list/exception objects): Rules require engine version 0.50.0, but engine version is 0.46.0

Expect the currently up to date falco version to work with the current rule definition. Is there any other tag than latest falcoctl can follow to guarantee compatibility?

Environment

  • Falco version:
  • System info:
  • Cloud provider or hardware configuration:
  • OS:
  • Kernel:
  • Installation method:

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions