make falco alerting opt in

ansible/README.md

@@ -76,9 +76,23 @@ profile's routing assumptions and provide a stable control-plane API address.
 The dedicated VM profile defaults to Geneve tunneling. Native routing should
 only be selected when the VM network routes the pod CIDR between nodes.
 
-The playbook does not create Slack or Discord credentials. Those will be added
-through a separate opt-in Ansible secret toggle so ordinary bootstrap remains
-credential-free.
+The playbook does not create Slack or Discord credentials by default. The
+opt-in `falco_alerting` role enables Slack forwarding only when supplied with a
+Vault-protected webhook value.
+
+Store these variables in an Ansible Vault file:
+
+```yaml
+falco_alerting_enabled: true
+falco_slack_webhook_url: https://hooks.slack.com/services/REPLACE/ME
+```
+
+Then run the bootstrap with `--ask-vault-pass -e
+@ansible/vars/falco-alerting.vault.yml`. The role creates the
+`falco-alerting` Secret without logging its value, applies the optional
+Falcosidekick ArgoCD Application, and lets ArgoCD reconcile the deployment. If
+the toggle is false, the role removes the optional Application and related
+resources.
 
 If CoreDNS cannot resolve external names from a nested Docker network, set
 `k3d_dns_servers` to DNS servers reachable from the Flatcar host. Ansible

ansible/bootstrap-flatcar-k3d.yml

@@ -8,6 +8,7 @@
     argocd_enabled: true
     cilium_enabled: false
     cilium_profile: k3d
+    falco_alerting_enabled: false
 
   pre_tasks:
     - name: Read host operating system identity
@@ -21,3 +22,4 @@
       when: cilium_enabled | bool
     - role: argocd_bootstrap
       when: argocd_enabled | bool
+    - role: falco_alerting

ansible/roles/falco_alerting/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+falco_alerting_enabled: false
+falco_slack_webhook_url: ""
+falco_alerting_application_manifest: "{{ k3d_workspace }}/deployments/argocd/optional-apps/falco-alerting.yaml"

ansible/roles/falco_alerting/tasks/main.yml

@@ -0,0 +1,59 @@
+---
+- name: Validate Falco alerting inputs
+  ansible.builtin.assert:
+    that:
+      - not (falco_alerting_enabled | bool) or falco_slack_webhook_url | length > 0
+    fail_msg: falco_slack_webhook_url is required when falco_alerting_enabled is true.
+
+- name: Ensure the Falco namespace exists for alerting resources
+  ansible.builtin.raw: >-
+    {{ k3d_tool_dir }}/kubectl create namespace falco
+    --dry-run=client -o yaml |
+    {{ k3d_tool_dir }}/kubectl apply -f -
+  become_user: "{{ k3d_user }}"
+  when: falco_alerting_enabled | bool
+
+- name: Create or update the Falco alerting Secret
+  ansible.builtin.raw: >-
+    {{ k3d_tool_dir }}/kubectl -n falco create secret generic falco-alerting
+    --from-literal=webhook-url='{{ falco_slack_webhook_url }}'
+    --dry-run=client -o yaml |
+    {{ k3d_tool_dir }}/kubectl apply --server-side --force-conflicts -f -
+  become_user: "{{ k3d_user }}"
+  no_log: true
+  when: falco_alerting_enabled | bool
+
+- name: Apply the optional Falco alerting ArgoCD Application
+  ansible.builtin.raw: >-
+    {{ k3d_tool_dir }}/kubectl apply --server-side --force-conflicts
+    -f {{ falco_alerting_application_manifest }}
+  become_user: "{{ k3d_user }}"
+  when: falco_alerting_enabled | bool
+
+- name: Remove the optional Falco alerting ArgoCD Application when disabled
+  ansible.builtin.raw: >-
+    {{ k3d_tool_dir }}/kubectl -n argocd delete application falco-alerting
+    --ignore-not-found=true --wait=true
+  become_user: "{{ k3d_user }}"
+  when: not (falco_alerting_enabled | bool)
+
+- name: Remove the Falcosidekick Component when alerting is disabled
+  ansible.builtin.raw: >-
+    {{ k3d_tool_dir }}/kubectl -n falco delete component falcosidekick
+    --ignore-not-found=true --wait=true
+  become_user: "{{ k3d_user }}"
+  when: not (falco_alerting_enabled | bool)
+
+- name: Remove the Falcosidekick output Config when alerting is disabled
+  ansible.builtin.raw: >-
+    {{ k3d_tool_dir }}/kubectl -n falco delete config falco-falcosidekick-output
+    --ignore-not-found=true --wait=true
+  become_user: "{{ k3d_user }}"
+  when: not (falco_alerting_enabled | bool)
+
+- name: Remove the Falco alerting Secret when alerting is disabled
+  ansible.builtin.raw: >-
+    {{ k3d_tool_dir }}/kubectl -n falco delete secret falco-alerting
+    --ignore-not-found=true --wait=true
+  become_user: "{{ k3d_user }}"
+  when: not (falco_alerting_enabled | bool)