If you’ve been in the cloud native community, chances are you’ve heard the term ‘ctl’ (pronounced cuttle or c-t-l). Just as Kubectl allows you to run commands against Kubernetes clusters, Falcoctl is a command line tool and daemon that lets you perform various tasks, such as installing or updating Falco artifacts, and periodically checking their repositories to install new tagged versions.

Since the launch of the plugin framework in January 2022, Falco adopters requested an out-of-the-box solution to help with the management of the lifecycle of rules and plugins. In the recent release of Falco v0.34.0, maintainers introduced Falcoctl to help address the challenges the community experiences with the lifecycle management and distribution of artifacts while following the GitOps precepts.

Join this hands-on-keyboard session to learn the terminology, key concepts and a step-by-step demonstration of how ‘Falcoctl’ works so you can easily deploy Falco rules, install plugins and keep them up to date automatically in your local host or Kubernetes cluster.