make falco alerting opt in

2026-08-16 21:36:09 -04:00
parent 6c79340d9a
commit 6e7f5b39fb
11 changed files with 163 additions and 29 deletions
@@ -10,3 +10,6 @@ spec:
  config:
    json_output: true
    json_include_output_property: true
+    # Avoid the Falco inotify watcher in nested k3d nodes. Configuration and
+    # rule changes are applied through GitOps reconciliation and pod rollout.
+    watch_config_files: false
@@ -1,26 +0,0 @@
-apiVersion: instance.falcosecurity.dev/v1alpha1
-kind: Component
-metadata:
-  name: falcosidekick
-  namespace: falco
-  annotations:
-    # Deploy the event forwarder after the Falco instance and its CRDs exist.
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  component:
-    type: falcosidekick
-  replicas: 1
-  podTemplateSpec:
-    spec:
-      containers:
-        - name: falcosidekick
-          env:
-            - name: SLACK_WEBHOOKURL
-              valueFrom:
-                secretKeyRef:
-                  name: falco-alerting
-                  key: webhook-url
-            # Keep low-priority Falco events in cluster logs, but do not send
-            # NOTICE-level activity to the Slack alert channel.
-            - name: SLACK_MINIMUMPRIORITY
-              value: warning
@@ -1,15 +0,0 @@
-apiVersion: artifact.falcosecurity.dev/v1alpha1
-kind: Config
-metadata:
-  name: falco-falcosidekick-output
-  namespace: falco
-  annotations:
-    # Apply the output configuration after the Falcosidekick service exists.
-    argocd.argoproj.io/sync-wave: "3"
-spec:
-  priority: 60
-  config:
-    json_output: true
-    http_output:
-      enabled: true
-      url: http://falcosidekick:2801
@@ -7,8 +7,6 @@ resources:
  - falco-config.yaml
  - container-plugin.yaml
  - custom-rulesfile.yaml
-  - falcosidekick-component.yaml
-  - falcosidekick-config.yaml

 configMapGenerator:
  - name: falco-custom-rules