# Blog: Deploy Falco on a Talos cluster

DevFeed: [Blog: Deploy Falco on a Talos cluster](<https://devfeed.tech/articles/blog-deploy-falco-on-a-talos-cluster-32477.md>)

Original publisher: [Read original article](<https://falco.org/blog/deploy-falco-talos-cluster/>)

Published: 2024-07-22T00:00:00Z

Content type: tutorial

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Tutorial](<https://devfeed.tech/topics/tutorial.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [eBPF](<https://devfeed.tech/topics/ebpf.md>), [audit](<https://devfeed.tech/topics/audit.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>)

Tags: [audit](<https://devfeed.tech/tags/audit.md>), [blog](<https://devfeed.tech/tags/blog.md>), [cli](<https://devfeed.tech/tags/cli.md>), [containers](<https://devfeed.tech/tags/containers.md>), [deploy](<https://devfeed.tech/tags/deploy.md>), [docker](<https://devfeed.tech/tags/docker.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [falco](<https://devfeed.tech/tags/falco.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [tools](<https://devfeed.tech/tags/tools.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>)

## AI overview

A tutorial showing how to deploy Falco on a local Talos Linux Kubernetes cluster created with Docker containers. It covers cluster setup, kubeconfig retrieval, patching Talos nodes for the eBPF probe, Helm installation, and forwarding Kubernetes audit logs to Falco.

## Source excerpt

Talos Linux is an OS designed for Kubernetes, with in mind to be secure, immutable and minimal. It offers a solution for having secure nodes for your Kubernetes cluster. Running Falco on them requires some configurations we'll see in this blog post. The good news is everything is available to collect the syscalls with eBPF and also the audit logs from the Kubernetes control plane. In this tutorial we'll use a local Talos cluster created with Docker containers for convenience, adapt the configurations to your own context. Requirements For this tutorial, you'll need several tools installed: Docker Helm talosctl kubectl Set up the Talos cluster We'll start with a 2 workers cluster: talosctl cluster create --workers 2 --wait-timeout 5m After a few minutes, your containers and so your cluster should be up and running. You can check the status with: talosctl cluster show --nodes 10.5.0.2,10.5.0.3,10.5.0.4 Output: PROVISIONER docker NAME talos-default NETWORK NAME talos-default NETWORK CIDR 10.5.0.0/24 NETWORK GATEWAY NETWORK MTU 1500 NODES: NAME TYPE IP CPU RAM DISK talos-default-controlplane-1 controlplane 10.5.0.2 - - - talos-default-worker-1 worker 10.5.0.3 - - - talos-default-worker-2 worker 10.5.0.4 - - - Get the kubeconfig The talosctl CLI allows to easily set up your kubeconfig file for managing the apps in your fresh new cluster: talosctl kubeconfig -n 10.5.0.2 -f Check you have access to the cluster: kubectl cluster-info Output: Kubernetes control plane is running at https://10.5.0.2:6443 CoreDNS is running at https://10.5.0.2:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. Patch the cluster When you deploy Falco with Helm in a Kubernetes cluster, an initContainer is bootstrapped to inject the eBPF probe into the kernel of each node. This behavior requires some privileges but Talos, designed to be secured, doesn't allow that by default. It's possible anyway by patching