falco: allow multiple socket paths for containerd

[leogr]

Motivation

We already support multiple containerd socket paths in Falco 👇
https://github.com/falcosecurity/libs/blob/34371e18cafa429107cf5d600bad5fd0c44718ab/userspace/libsinsp/container_engine/cri.cpp#L64-L68

This is not currently supported by the Falco chart.

This would particularly enable k3s by default but also allow users to add multiple paths in case their use case requires that.

Feature

Make the containerd.socket accept an array of paths. For example:

charts/charts/falco/values.yaml

Lines 266 to 270 in 8653678

	containerd:
	# -- Enable ContainerD support.
	enabled: true
	# -- The path of the ContainerD socket.
	socket: /run/containerd/containerd.sock

👇

 containerd: 
   # -- Enable ContainerD support. 
   enabled: true 
   # -- The paths to look for a ContainerD socket. The first match will be used.
   socket: [/run/containerd/containerd.sock, /run/k3s/containerd/containerd.sock]

Alternatives

The alternative would be to add a config node for each specific case (e.g., k3s). However, this is overkill and will not allow flexibility.

Additional context

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[leogr]

/remove-lifecycle stale

[leogr]

Related falcosecurity/falco#3266

[leogr]

This likely needs to be addressed in 0.39, since falcosecurity/falco#3266 has been merged.

/assign @alacuku