This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge

Learner activity No attempts yet

Install Falco for Runtime Security Monitoring Using Helm

by Omkar Shelke · on

Kubernetes Security

Add the Falco Helm repository, install Falco with modern eBPF driver and Falcosidekick UI enabled, then upgrade the Falcosidekick UI service to NodePort.

#cka #falco #helm #runtime-security #ebpf

Scenario

Your cluster needs runtime security monitoring. Falco is a CNCF runtime security tool that watches system calls and Kubernetes events, alerting on suspicious behaviour — such as a shell being opened inside a container, unexpected file writes to sensitive paths, or privilege escalation attempts.

You will install Falco using Helm with the modern eBPF driver (no kernel module required), enable the Falcosidekick UI for a web-based event dashboard, and upgrade the Falcosidekick UI service from ClusterIP to NodePort so it is externally accessible.

Task

Add the falcosecurity Helm repository and update it.
Install Falco in the falco namespace using the falcosecurity/falco chart with the following settings:
- driver.kind=modern_ebpf
- falco.json_output=true
- falco.json_include_output_property=true
- falco.log_stderr=true
- falco.log_syslog=false
- falcosidekick.enabled=true
- falcosidekick.webui.enabled=true
Wait for all Falco pods to be in Ready state, then use helm upgrade to change the falco-falcosidekick-ui service from ClusterIP to NodePort with a fixed node port of 32099 by setting:
- falcosidekick.webui.service.type=NodePort
- falcosidekick.webui.service.nodePort=32099
Do not use kubectl edit.

Hint 1 — Add and Update the Helm Repository

Helm repositories must be added before you can install charts from them. After adding, always run helm repo update to fetch the latest chart versions.

helm repo add <name> <url>
helm repo update

Documentation

Helm — Adding Repositories

Hint 2 — Install with Custom Values

Pass each configuration field using --set key=value flags on the helm install command. Use --create-namespace so Helm creates the falco namespace if it does not exist.

helm install <release-name> <chart> \
  --namespace <namespace> \
  --create-namespace \
  --set key1=value1 \
  --set key2=value2

Documentation

Falco Helm Chart

Hint 3 — Upgrade the Falcosidekick UI Service to NodePort

Use helm upgrade with --reuse-values to keep all existing settings and only override the service type and node port for the Falcosidekick UI.

helm upgrade <release-name> falcosecurity/falco \
  --namespace <namespace> \
  --reuse-values \
  --set falcosidekick.webui.service.type=NodePort \
  --set falcosidekick.webui.service.nodePort=32099

Documentation

Helm — Upgrading a Release

⚒ Test Cases

Understanding the Challenge

Falco is a CNCF runtime security tool that hooks into the Linux kernel via eBPF and watches every system call made by every process on the node. When a call matches a security rule — a shell spawned inside a container, a write to /etc/passwd, a container running as root — Falco fires an alert.

This challenge uses the modern eBPF driver: no kernel module compilation required, works on any kernel 5.8+, and loads safely without rebooting the node.

Falcosidekick is a companion service that receives Falco alerts and forwards them to output targets (Slack, webhooks, S3, etc.). The Falcosidekick UI is a web dashboard that displays those alerts in real time.

The solution flow is:

Add Helm repo → Update cache → helm install → Wait for Pods → helm upgrade (NodePort 32099)

Step 1 : Add the falcosecurity Helm Repository

The falcosecurity Helm repository hosts all Falco-related charts. Add it and give it the name falcosecurity so Helm knows where to fetch the chart from.

helm repo add falcosecurity https://falcosecurity.github.io/charts

"falcosecurity" has been added to your repositories

Verify it is listed:

helm repo list

NAME             URL
falcosecurity    https://falcosecurity.github.io/charts

Step 2 : Update the Repository Cache

Helm caches chart metadata locally. Run helm repo update to pull the latest index from the repository so the install step picks up the most recent chart version.

helm repo update

Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "falcosecurity" chart repository
Update Complete. ⎈Happy Helming!⎈

Step 3 : Install Falco

Install the falcosecurity/falco chart into the falco namespace. Each --set flag overrides a default chart value. --create-namespace creates the falco namespace automatically if it does not exist.

helm install falco falcosecurity/falco \
  --namespace falco \
  --create-namespace \
  --set driver.kind=modern_ebpf \
  --set collectors.containerEngine=containerd \
  --set falco.json_output=true \
  --set falco.json_include_output_property=true \
  --set falco.log_stderr=true \
  --set falco.log_syslog=false \
  --set falcosidekick.enabled=true \
  --set falcosidekick.webui.enabled=true

NAME: falco
LAST DEPLOYED: Mon Jul 14 10:00:00 2026
NAMESPACE: falco
STATUS: deployed
REVISION: 1

Note

What each flag does:

driver.kind=modern_ebpf — uses the modern CO-RE eBPF probe. No kernel headers or module compilation needed. Requires kernel 5.8+.
collectors.containerEngine=containerd — tells Falco which container runtime to use for enriching alerts with metadata (Pod name, namespace, image). Note: the old collectors.containerd and collectors.docker fields have been removed from the chart — always use containerEngine instead.
falco.json_output=true — emit alerts as JSON instead of plain text. Required for Falcosidekick to parse and forward alerts.
falco.json_include_output_property=true — include the human-readable output string inside the JSON alert alongside the structured fields.
falco.log_stderr=true — write Falco's own operational logs to stderr, visible via kubectl logs.
falco.log_syslog=false — disable syslog output; keep all logs in-cluster.
falcosidekick.enabled=true — deploy the Falcosidekick service that receives Falco alerts and can forward them to Slack, webhooks, S3, and more.
falcosidekick.webui.enabled=true — deploy the Falcosidekick UI web dashboard alongside Falcosidekick.

Step 4 : Wait for Falco Pods to be Ready

After install, Kubernetes pulls the images and starts the Pods. Check the status:

kubectl get pods -n falco

NAME                                        READY   STATUS    RESTARTS   AGE
falco-5xk9j                                 1/1     Running   0          60s
falco-falcosidekick-7d6f9b8c4-xk2pj        1/1     Running   0          60s
falco-falcosidekick-ui-6c5d4f9b8-m3wnx     1/1     Running   0          60s

Use kubectl wait to block until all Falco Pods are ready before proceeding to the upgrade:

kubectl wait pods -n falco \
  -l app.kubernetes.io/name=falco \
  --for=condition=Ready --timeout=120s

pod/falco-5xk9j condition met

Step 5 : Upgrade the Falcosidekick UI Service to NodePort

By default, the Falcosidekick UI Service is ClusterIP — reachable only inside the cluster. Use helm upgrade to change it to NodePort with a fixed port of 32099 so it is accessible from outside the cluster.

--reuse-values carries over every value from the original install, so you only need to specify what is changing.

helm upgrade falco falcosecurity/falco \
  --namespace falco \
  --reuse-values \
  --set falcosidekick.webui.service.type=NodePort \
  --set falcosidekick.webui.service.nodePort=32099

Release "falco" has been upgraded. Happy Helming!
LAST DEPLOYED: Mon Jul 14 10:05:00 2026
NAMESPACE: falco
STATUS: deployed
REVISION: 2

Note

--reuse-values merges the two new --set flags on top of all previously installed values. You do not need to repeat driver.kind, falco.json_output, or any other flag from the install step — they are all preserved automatically.

Do not use kubectl edit or kubectl patch to change the service type. Those commands modify the live Kubernetes object directly but do not update the Helm release values, so helm get values would not reflect the change and the verify task would fail.

Step 6 : Verify Everything is Correct

Confirm the Helm release now has two revisions, proving helm upgrade was actually run:

helm history falco -n falco

REVISION  STATUS      CHART          DESCRIPTION
1         superseded  falco-4.x.x    Install complete
2         deployed    falco-4.x.x    Upgrade complete

Confirm the service type and node port are recorded in the Helm values:

helm get values falco -n falco -o json \
  | jq '{type: .falcosidekick.webui.service.type, nodePort: .falcosidekick.webui.service.nodePort}'

{
  "type": "NodePort",
  "nodePort": 32099
}

Confirm the live Service reflects the change:

kubectl get svc falco-falcosidekick-ui -n falco

NAME                       TYPE       CLUSTER-IP    EXTERNAL-IP   PORT(S)           AGE
falco-falcosidekick-ui     NodePort   10.96.x.x     <none>        2802:32099/TCP    6m

The Falcosidekick UI is now reachable at http://<node-ip>:32099 from outside the cluster.

Note

The complete flow: add falcosecurity repo → update cache → helm install with modern_ebpf driver, containerd engine, JSON output, and Falcosidekick UI → wait for Pods → helm upgrade --reuse-values to expose the UI as NodePort 32099. Falco is now watching every system call on every node and routing alerts through Falcosidekick to the UI dashboard.

Challenge progress

Tasks

Install Falco for Runtime Security Monitoring Using Helm

Scenario

Task

Understanding the Challenge

Step 1 : Add the falcosecurity Helm Repository

Step 2 : Update the Repository Cache

Step 3 : Install Falco

Step 4 : Wait for Falco Pods to be Ready

Step 5 : Upgrade the Falcosidekick UI Service to NodePort

Step 6 : Verify Everything is Correct