From 2ca1b150ccdf6c4485e78ada98f094a57ddad0bb Mon Sep 17 00:00:00 2001 From: swaphb Date: Sat, 15 Aug 2026 14:13:53 -0400 Subject: [PATCH] reduce low priority Falco Slack alerts --- deployments/falco/README.md | 2 ++ .../falco/operator-resources/falcosidekick-component.yaml | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/deployments/falco/README.md b/deployments/falco/README.md index 38d765a..dcebe6e 100644 --- a/deployments/falco/README.md +++ b/deployments/falco/README.md @@ -29,6 +29,8 @@ kubectl create secret generic falco-alerting \ ``` The `webhook-url` key is injected into Falcosidekick as `SLACK_WEBHOOKURL`. +Falcosidekick sends only `WARNING` and higher priority events to Slack through +`SLACK_MINIMUMPRIORITY`. Lower-priority events remain available in Falco logs. The Secret is intentionally not included in the Falco Kustomization because ArgoCD must not manage or render the credential from Git. diff --git a/deployments/falco/operator-resources/falcosidekick-component.yaml b/deployments/falco/operator-resources/falcosidekick-component.yaml index 2cb240a..7b3a5f2 100644 --- a/deployments/falco/operator-resources/falcosidekick-component.yaml +++ b/deployments/falco/operator-resources/falcosidekick-component.yaml @@ -20,3 +20,7 @@ spec: secretKeyRef: name: falco-alerting key: webhook-url + # Keep low-priority Falco events in cluster logs, but do not send + # NOTICE-level activity to the Slack alert channel. + - name: SLACK_MINIMUMPRIORITY + value: warning