When the `Contact K8S API Server From Container` Rule Runs Silent

The shipped k8s_api_server FQDN condition (fd.sip.name="kubernetes.default.svc.cluster.local") fired on neither Falco 0.43.1 nor 0.40.0 in our lab — and the falco.org example still shows pre-v0.19.0 fd.sip="1.2.3.4"

When It Runs — Run Report #RR02 · Testing what infrastructure actually does.

Provider · Component: Falco · the k8s_api_server macro and the Contact K8S API Server From Container rule (published docs vs. shipped default)

Versions tested: Docs — live on falco.org (checked 2026-08-18). Shipped rule defaults — 0.18.0, 0.19.0, and current falcosecurity/rules main. Runtime firing — our lab (2026-08-18, one kind cluster): Falco 0.43.1 and 0.40.0, both observed not firing on a benign in-cluster API-server contact.

Config profile: Default shipped rules, no override — for the desk layers, the published documentation and versioned shipped rule files; for the lab, each image's bundled falco_rules.yaml as shipped (plus one added observation-only rule that changes no detection logic; full text in §2).

Verified on: 2026-08-18 (desk sources and lab run) — to be re-verified against live sources immediately before publication.

Affects: Operators who set the k8s_api_server macro by following the currently published example, and environments where the shipped DNS-associated condition never matches — as in a community report (#3834) and in our own lab.

TL;DR: Falco's published k8s_api_server override example still shows the placeholder 1.2.3.4:8080 that the shipped rules replaced with a DNS-associated FQDN condition in v0.19.0 — and in our lab that current condition fired on neither Falco 0.43.1 nor 0.40.0 for a benign in-cluster API-server contact, because the field it matches on (fd.sip.name) stayed empty.

Full report: https://whenitruns.substack.com/p/when-the-contact-k8s-api-server-from