From caedb9ab8d237523e80bbc0058ac0e553e59ffec Mon Sep 17 00:00:00 2001
From: swaphb <s@swaphb.com>
Date: Mon, 10 Aug 2026 21:14:38 -0400
Subject: [PATCH] migrate falco deployment to operator

---
 argocd/apps/falco.yaml                       | 14 +++++++++-----
 falco/falco-operator-values.yaml             | 17 +++++++++++++++++
 falco/falco-values.yaml                      |  6 ------
 falco/operator-resources/falco-config.yaml   | 12 ++++++++++++
 falco/operator-resources/falco-instance.yaml |  9 +++++++++
 falco/operator-resources/kustomization.yaml  |  6 ++++++
 falco/operator-resources/namespace.yaml      |  4 ++++
 7 files changed, 57 insertions(+), 11 deletions(-)
 create mode 100644 falco/falco-operator-values.yaml
 delete mode 100644 falco/falco-values.yaml
 create mode 100644 falco/operator-resources/falco-config.yaml
 create mode 100644 falco/operator-resources/falco-instance.yaml
 create mode 100644 falco/operator-resources/kustomization.yaml
 create mode 100644 falco/operator-resources/namespace.yaml

diff --git a/argocd/apps/falco.yaml b/argocd/apps/falco.yaml
index d162ab5..e42ec5b 100644
--- a/argocd/apps/falco.yaml
+++ b/argocd/apps/falco.yaml
@@ -9,21 +9,25 @@ spec:
   project: default
   sources:
     - repoURL: https://falcosecurity.github.io/charts
-      chart: falco
-      # Chart 9.1.0 deploys Falco app version 0.44.1.
-      targetRevision: 9.1.0
+      chart: falco-operator
+      # Operator chart 0.3.1 deploys Falco Operator 0.4.1.
+      targetRevision: 0.3.1
       helm:
         valueFiles:
-          - $values/falco/falco-values.yaml
+          - $values/falco/falco-operator-values.yaml
     - repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git
       targetRevision: main
       ref: values
+    - repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git
+      targetRevision: main
+      path: falco/operator-resources
   destination:
     server: https://kubernetes.default.svc
-    namespace: falco
+    namespace: falco-operator
   syncPolicy:
     automated:
       prune: true
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+      - ServerSideApply=true
diff --git a/falco/falco-operator-values.yaml b/falco/falco-operator-values.yaml
new file mode 100644
index 0000000..3c8f3d9
--- /dev/null
+++ b/falco/falco-operator-values.yaml
@@ -0,0 +1,17 @@
+# Falco Operator settings. Falco instances and their artifacts are managed by
+# the CRs under falco/operator-resources.
+replicaCount: 1
+
+# Keep ArgoCD tracking labels on the operator itself, not on resources created
+# by the operator from Falco, Config, Plugin, or Rulesfile resources.
+excludedLabels:
+  - argocd.argoproj.io/instance
+  - argocd.argoproj.io/tracking-id
+
+resources:
+  requests:
+    cpu: 10m
+    memory: 64Mi
+  limits:
+    cpu: 500m
+    memory: 128Mi
diff --git a/falco/falco-values.yaml b/falco/falco-values.yaml
deleted file mode 100644
index 813bad5..0000000
--- a/falco/falco-values.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# Phase 2 placeholder values. Runtime rules and webhook output are added in
-# phase 5; keeping values in Git now establishes the ArgoCD ownership boundary.
-falco:
-  json_output: true
-  json_include_output_property: true
-
diff --git a/falco/operator-resources/falco-config.yaml b/falco/operator-resources/falco-config.yaml
new file mode 100644
index 0000000..10a134a
--- /dev/null
+++ b/falco/operator-resources/falco-config.yaml
@@ -0,0 +1,12 @@
+apiVersion: artifact.falcosecurity.dev/v1alpha1
+kind: Config
+metadata:
+  name: falco-output
+  namespace: falco
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  priority: 50
+  config:
+    json_output: true
+    json_include_output_property: true
diff --git a/falco/operator-resources/falco-instance.yaml b/falco/operator-resources/falco-instance.yaml
new file mode 100644
index 0000000..6ce4578
--- /dev/null
+++ b/falco/operator-resources/falco-instance.yaml
@@ -0,0 +1,9 @@
+apiVersion: instance.falcosecurity.dev/v1alpha1
+kind: Falco
+metadata:
+  name: falco
+  namespace: falco
+  annotations:
+    # Apply the instance after the Operator chart has installed its CRDs.
+    argocd.argoproj.io/sync-wave: "1"
+spec: {}
diff --git a/falco/operator-resources/kustomization.yaml b/falco/operator-resources/kustomization.yaml
new file mode 100644
index 0000000..3ab8a40
--- /dev/null
+++ b/falco/operator-resources/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - falco-instance.yaml
+  - falco-config.yaml
diff --git a/falco/operator-resources/namespace.yaml b/falco/operator-resources/namespace.yaml
new file mode 100644
index 0000000..5c4e302
--- /dev/null
+++ b/falco/operator-resources/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: falco