configure Falcosidekick Slack forwarding

deployments/falco/README.md

@@ -4,7 +4,7 @@ Falco alert delivery must use a Kubernetes Secret. Do not commit a Slack
 Incoming Webhook URL, Slack token, Discord webhook URL, or generated Secret
 manifest to this repository.
 
-The expected Secret contract for the future alerting configuration is:
+The expected Secret contract for the Git-managed Falcosidekick configuration is:
 
 ```yaml
 apiVersion: v1
@@ -28,8 +28,8 @@ kubectl create secret generic falco-alerting \
   --dry-run=client -o yaml | kubectl apply -f -
 ```
 
-The `webhook-url` key is the interface that the Falco alerting configuration
+The `webhook-url` key is injected into Falcosidekick as `SLACK_WEBHOOKURL`.
-will consume. The Secret is intentionally not included in the Falco
+The Secret is intentionally not included in the Falco
 Kustomization because ArgoCD must not manage or render the credential from
 Git.
 
@@ -44,6 +44,6 @@ Avoid printing Secret data in shared terminals or CI logs. To rotate the
 webhook, update the Secret in place with the creation command and restart the
 Falco workloads after the alerting integration is configured.
 
-The repository currently verifies Falco runtime detections locally. Webhook
+The repository verifies Falco runtime detections locally. Webhook delivery is
-delivery remains a separate configuration step because it requires an
+enabled by the Git-managed Falcosidekick resources after the Secret exists, and
-interactive Slack or Discord credential.
+still requires an interactive Slack or Discord credential for end-to-end testing.

deployments/falco/operator-resources/falcosidekick-component.yaml

@@ -0,0 +1,22 @@
+apiVersion: instance.falcosecurity.dev/v1alpha1
+kind: Component
+metadata:
+  name: falcosidekick
+  namespace: falco
+  annotations:
+    # Deploy the event forwarder after the Falco instance and its CRDs exist.
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  component:
+    type: falcosidekick
+  replicas: 1
+  podTemplateSpec:
+    spec:
+      containers:
+        - name: falcosidekick
+          env:
+            - name: SLACK_WEBHOOKURL
+              valueFrom:
+                secretKeyRef:
+                  name: falco-alerting
+                  key: webhook-url

deployments/falco/operator-resources/falcosidekick-config.yaml

@@ -0,0 +1,15 @@
+apiVersion: artifact.falcosecurity.dev/v1alpha1
+kind: Config
+metadata:
+  name: falco-falcosidekick-output
+  namespace: falco
+  annotations:
+    # Apply the output configuration after the Falcosidekick service exists.
+    argocd.argoproj.io/sync-wave: "3"
+spec:
+  priority: 60
+  config:
+    json_output: true
+    http_output:
+      enabled: true
+      url: http://falcosidekick:2801

deployments/falco/operator-resources/kustomization.yaml

@@ -7,6 +7,8 @@ resources:
   - falco-config.yaml
   - container-plugin.yaml
   - custom-rulesfile.yaml
+  - falcosidekick-component.yaml
+  - falcosidekick-config.yaml
 
 configMapGenerator:
   - name: falco-custom-rules