The module lifecycle stage: General Availability
The module has requirements for installation

v1.1.6

Release date: 2026-08-19

Rewrote rules-loader in Go, enabled mTLS on the FalcoAuditRules validating webhook, added the builtInRulesTypes setting, enriched Falco output with pod metadata, and removed containerd and LVM false positives.

Highlights

Changes in this release:

  • The rules-loader component is rewritten in Go and no longer ships the shell-operator and Python runtime.
  • The FalcoAuditRules validating webhook requires and verifies client certificates, so only the Kubernetes API server can send it admission requests.
  • The new builtInRulesTypes setting disables built-in rules by event source type; k8sAudit rules are also disabled automatically when the security-events-manager module is enabled.
  • Falco syscall events carry pod namespace, pod name, and service account via the k8s_pod_info plugin.
  • False positives on containerd temporary, ingest, and sandbox paths and on LVM lock files are gone.

New features

This release adds:

  • Added the builtInRulesTypes parameter to disable built-in rules by event source type (k8sAudit, syscall).
  • Built-in k8sAudit rules are disabled automatically when the security-events-manager module is enabled, to avoid duplicated Kubernetes audit events.
  • Split the SSH rule into Inbound SSH Connection Attempt (TCP accept, pre-auth) and Inbound SSH Connection (post-auth execve, captures the username).
  • Added proc.aname[1], proc.aname[3], and proc.vpid to the Falco output of containerd host rules for additional process context.
  • Added pod namespace, pod name, and service account to Falco syscall rule outputs and to SecurityEvents, resolved by container ID through the k8s_pod_info plugin.

Improvements

This release improves:

  • Rewrote rules-loader from shell-operator with Python hooks to Go: the image no longer contains the shell-operator runtime or Python dependencies.
  • The falco container runs with the Unconfined AppArmor profile: the containerd default profile denies ptrace, which Falco needs to enrich events with data from /proc/<pid>.

Fixes

This release fixes:

  • Excluded containerd .tmp-status* temporary files and io.containerd.content.v1.content/ingest paths from the Write below containerd images dir and Read below containerd images dir rules.
  • Excluded the containerd sandbox directory (sandboxes/) from the Write below containerd images dir and Read below containerd images dir rules — these are legitimate containerd sandbox metadata operations.
  • Excluded LVM lock files (/run/lock/lvm/) created by lvm, lvs, vgs, and pvs from the Container drift detected (open+create) rule — LVM creates its flock files with mode 0777, which is not container drift.
  • Anchored security event regexes to Falco’s JSON "output":" field to prevent false positives from rules-loader validation logs.
  • Added user.uid to the Falco SSH rule output and metadata.extra for additional process context.

Security updates

Security updates in this release:

  • The FalcoAuditRules validating webhook now requires and verifies client certificates against the cluster admission webhook client CA, so only the Kubernetes API server can send AdmissionReview requests.
  • Rebuilt module images with updated Go dependencies to remediate known vulnerabilities (CVE) in falcoctl, falcosidekick, k8s-metacollector, event-generator, and rules-loader.

Breaking changes

Changes that affect backward compatibility:

  • The module requires Kubernetes 1.31 or later and is not installed on older clusters: it sets the AppArmor profile through the securityContext field, which is only available starting from that version. Upgrade the cluster to Kubernetes 1.31 or later before upgrading the module.

Upgrade notes

Before upgrading, note the following:

  • If the security-events-manager module is enabled and you want to keep the built-in k8sAudit rules, set builtInRulesTypes.k8sAudit to true explicitly: otherwise these rules are no longer rendered.

Dependencies

Dependency updates:

  • kubernetes: >= 1.31

    • Required for the appArmorProfile field in securityContext.

v1.1.4

Release date: 2026-07-21

Updated Falco to 0.44.1, Falcosidekick to 2.34.1, related components, and moved the named webhook port 4227 from the falcosidekick container to rules-loader.

Highlights

Changes in this release:

  • Falco is updated to 0.44.1.
  • Falcosidekick is updated to 2.34.1.
  • k8s-metacollector is updated to 0.1.3.
  • The k8saudit plugin is updated to 0.18.0.
  • The named webhook port 4227 now belongs to the rules-loader container.

Improvements

This release improves:

  • Moved the named webhook port 4227 from the falcosidekick container to the rules-loader container.

Security updates

Security updates in this release:

  • Component updates in this release address known vulnerabilities (see Dependencies).

Dependencies

Dependency updates:

  • falco: 0.43.1 → 0.44.1

  • falcosidekick: 2.33.0 → 2.34.1

  • k8s-metacollector: 0.1.2 → 0.1.3

  • k8saudit: 0.17.0 → 0.18.0

v1.1.3

Release date: 2026-05-21

Added documentation for built-in rules, new Vertical Pod Autoscaler (VPA) and LimitRange settings, Falco non-ASCII output cleanup, and updated Falcoctl, event-generator, and plugins.

Highlights

Changes in this release:

  • Documentation now describes the built-in rules shipped with the module.
  • Operators can configure separate VPA calculation by node label and a LimitRange for module pods.
  • Falco output strips non-ASCII characters.
  • Falcoctl, event-generator, and the k8saudit / json plugins are updated.

New features

This release adds:

  • Added a module setting to enable separate VPA calculation for runtime-audit-engine pods based on a node label (enabled by default for Deckhouse 1.76 or later).
  • Added a module setting to configure a LimitRange for pods in the runtime-audit-engine namespace.
  • Added cleanup of non-ASCII characters in Falco output.

Security updates

Security updates in this release:

  • Component updates in this release address known vulnerabilities (see Dependencies).

Upgrade notes

Before upgrading, note the following:

  • This release removes the LimitRange previously introduced because of a Falco memory leak and enables VPA by default.
  • Review and, if needed, configure the new LimitRange and VPA module settings after upgrade.

Docs

Documentation changes:

  • Added a documentation page that describes the built-in rules installed with the module.

Dependencies

Dependency updates:

  • falcoctl: 0.13.0

  • event-generator: 0.13.0

  • k8saudit: 0.16.1 → 0.17.0

  • json: 0.7.4

v1.1.2

Release date: 2026-04-30

Adapted the module for the CSE edition of Deckhouse Kubernetes Platform (DKP).

Highlights

Changes in this release:

  • The module is adapted for operation in the CSE edition of DKP.

Improvements

This release improves:

  • Adjusted module packaging and runtime settings required for CSE clusters.

v1.1.1

Release date: 2026-04-27

Updated Falco to 0.43.1, Falcosidekick to 2.33.0, and related collectors and plugins, including CVE-oriented component fixes.

Highlights

Changes in this release:

  • Falco is updated to 0.43.1.
  • Falcosidekick is updated to 2.33.0.
  • k8s-metacollector is updated to 0.1.2.
  • The k8saudit and k8smeta plugins are updated.
  • CVE-oriented fixes are included for module components.

Security updates

Security updates in this release:

  • Applied CVE-oriented fixes in component images.
  • Component updates in this release address known vulnerabilities (see Dependencies).

Dependencies

Dependency updates:

  • falco: 0.43.0 → 0.43.1

  • falcosidekick: 2.33.0

  • k8s-metacollector: 0.1.2

  • k8saudit: 0.16.1

  • k8smeta: 0.4.1

v1.1.0

Release date: 2026-02-27

Updated Falco to 0.43.0 and Falcoctl to 0.12.2, including CVE-oriented fixes in module services.

Highlights

Changes in this release:

  • Falco is updated to 0.43.0.
  • Falcoctl is updated to 0.12.2.
  • CVE-oriented fixes are included for module services.

Security updates

Security updates in this release:

  • Component updates in this release address known vulnerabilities (see Dependencies).
  • Applied CVE-oriented fixes for module service images.

Dependencies

Dependency updates:

  • falco: 0.43.0

    • Runtime detection engine update.

  • falcoctl: 0.12.2

    • Falco tooling update.

v1.0.11

Release date: 2026-02-20

Added SecurityPolicyException objects for security policy exceptions, fixed critical vulnerabilities, and raised the Deckhouse Kubernetes Platform (DKP) requirement to 1.74 or later.

Highlights

Changes in this release:

  • Operators can create SecurityPolicyException objects to exclude selected workloads from security policies.
  • Critical vulnerabilities in module components are fixed.
  • The module now requires DKP 1.74 or later.
  • Documentation and examples for Falco audit rules are updated.

New features

This release adds:

  • Added support for SecurityPolicyException custom resources to define exceptions from security policies.

Security updates

Security updates in this release:

  • Fixed critical vulnerabilities (CVE) in module component images.

Upgrade notes

Before upgrading, note the following:

  • Before upgrading, ensure the cluster runs Deckhouse Kubernetes Platform 1.74 or later.

Docs

Documentation changes:

  • Updated the description and examples for Falco audit rules.

Dependencies

Dependency updates:

  • deckhouse: >= 1.74