Install fails kubectl create due to LIBBPFGO_OSRELEASE_FILE env variable not set correctly

[brackend]

Prerequisites

I couldn't find anything related to Helm deployments. Most likely not a bug but rather how-to set the environment variable and my lack of knowledge.

Bug description

Unable to find info on how to execute the instructions in the error message. I'd assumed that the code in the yaml dealt with it.

Steps to reproduce

Please provide detailed steps for reproducing the bug.

kubectl create -f https://raw.githubusercontent.com/aquasecurity/tracee/v0.7.0/deploy/kubernetes/tracee-postee/tracee.yaml

The error I get is:

ERROR: ERROR: You have to set LIBBPFGO_OSRELEASE_FILE env variable. ERROR: It allows tracee to detect host environment features. ERROR: ERROR: Run docker with : ERROR: -v /etc/os-release:/etc/os-release-host:ro ERROR: ERROR: Then you may set LIBBPFGO_OSRELEASE_FILE: ERROR: -e LIBBPFGO_OSRELEASE_FILE=/etc/os-release-host ERROR:

Context

Please provide any relevant information about your setup. This is important in case the issue is not reproducible except for under certain conditions.

• Linux version:
• Linux kernel version: 5.4.162-86.275.amzn2.x86_64
• Tracee version (or commit id of your tree): image: aquasec/tracee:v0.7.0
• LLVM version:
• Golang version:

Additional Information

Through brute force and ignorance I had updated yaml with : - args: - >- --webhook http://tracee-webhook:2801 --webhook-template ./templates/falcosidekick.tmpl --webhook-content-type application/json -- LIBBPFGO_OSRELEASE_FILE=/etc/os-release-host

[danielpacak]

Are you trying Tracee on Amazon EKS? Could you provide more details which version is it? I assume all cluster nodes are run on machines with 5.4.162-86.275.amzn2.x86_64 kernel.

[brackend]

Yes Amazon EKS. yes all should be on this kernel.
Kubernetes version

1.21 Platform version eks.4 ( this is what I see in configuration )

[danielpacak]

I run a quick test on a similar EKS environment and it seems to work just fine:

I'm getting some webhook errors but it's because I haven't installed Postee in my cluster.

@rafaeldtinoco do you see any reason why Tracee works on 5.4.188-104.359.amzn2.x86_64 but may fail on 5.4.162-86.275.amzn2.x86_64?

[danielpacak]

@brackend could you please format and share snippet of tracee.yaml that you updated? I cannot see what's the difference in setting the LIBBPFGO_OSRELEASE_FILE env in https://github.com/aquasecurity/tracee/blob/v0.7.0/deploy/kubernetes/tracee-postee/tracee.yaml#L26

[rafaeldtinoco]

@rafaeldtinoco do you see any reason why Tracee works on 5.4.188-104.359.amzn2.x86_64 but may fail on 5.4.162-86.275.amzn2.x86_64?

Nothing I can think of. @brackend were you able to make it work ? Maybe our TODO here is to improve documentation for k8s deployment only ?

[yanivagman]

closing as not reproducible and no update given by the user