configure Falcosidekick Slack forwarding

2026-08-15 13:38:42 -04:00
parent 6632c91f9f
commit 0db746af71
4 changed files with 45 additions and 6 deletions
@@ -0,0 +1,22 @@
+apiVersion: instance.falcosecurity.dev/v1alpha1
+kind: Component
+metadata:
+  name: falcosidekick
+  namespace: falco
+  annotations:
+    # Deploy the event forwarder after the Falco instance and its CRDs exist.
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  component:
+    type: falcosidekick
+  replicas: 1
+  podTemplateSpec:
+    spec:
+      containers:
+        - name: falcosidekick
+          env:
+            - name: SLACK_WEBHOOKURL
+              valueFrom:
+                secretKeyRef:
+                  name: falco-alerting
+                  key: webhook-url
@@ -0,0 +1,15 @@
+apiVersion: artifact.falcosecurity.dev/v1alpha1
+kind: Config
+metadata:
+  name: falco-falcosidekick-output
+  namespace: falco
+  annotations:
+    # Apply the output configuration after the Falcosidekick service exists.
+    argocd.argoproj.io/sync-wave: "3"
+spec:
+  priority: 60
+  config:
+    json_output: true
+    http_output:
+      enabled: true
+      url: http://falcosidekick:2801
@@ -7,6 +7,8 @@ resources:
  - falco-config.yaml
  - container-plugin.yaml
  - custom-rulesfile.yaml
+  - falcosidekick-component.yaml
+  - falcosidekick-config.yaml

 configMapGenerator:
  - name: falco-custom-rules