make falco alerting opt in

2026-08-16 21:36:09 -04:00
parent 6c79340d9a
commit 6e7f5b39fb
11 changed files with 163 additions and 29 deletions
@@ -0,0 +1,25 @@
+apiVersion: instance.falcosecurity.dev/v1alpha1
+kind: Component
+metadata:
+  name: falcosidekick
+  namespace: falco
+  annotations:
+    # Deploy the event forwarder only when the alerting Secret is enabled.
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  component:
+    type: falcosidekick
+  replicas: 1
+  podTemplateSpec:
+    spec:
+      containers:
+        - name: falcosidekick
+          env:
+            - name: SLACK_WEBHOOKURL
+              valueFrom:
+                secretKeyRef:
+                  name: falco-alerting
+                  key: webhook-url
+            # Keep low-priority events in Falco logs instead of Slack.
+            - name: SLACK_MINIMUMPRIORITY
+              value: warning