make falco alerting opt in

2026-08-16 21:36:09 -04:00
parent 6c79340d9a
commit 6e7f5b39fb
11 changed files with 163 additions and 29 deletions
@@ -0,0 +1,25 @@
+apiVersion: instance.falcosecurity.dev/v1alpha1
+kind: Component
+metadata:
+  name: falcosidekick
+  namespace: falco
+  annotations:
+    # Deploy the event forwarder only when the alerting Secret is enabled.
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  component:
+    type: falcosidekick
+  replicas: 1
+  podTemplateSpec:
+    spec:
+      containers:
+        - name: falcosidekick
+          env:
+            - name: SLACK_WEBHOOKURL
+              valueFrom:
+                secretKeyRef:
+                  name: falco-alerting
+                  key: webhook-url
+            # Keep low-priority events in Falco logs instead of Slack.
+            - name: SLACK_MINIMUMPRIORITY
+              value: warning
@@ -0,0 +1,15 @@
+apiVersion: artifact.falcosecurity.dev/v1alpha1
+kind: Config
+metadata:
+  name: falco-falcosidekick-output
+  namespace: falco
+  annotations:
+    # Apply the output configuration after the Falcosidekick service exists.
+    argocd.argoproj.io/sync-wave: "3"
+spec:
+  priority: 60
+  config:
+    json_output: true
+    http_output:
+      enabled: true
+      url: http://falcosidekick:2801
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: falco
+resources:
+  - falcosidekick-component.yaml
+  - falcosidekick-config.yaml