apiVersion: instance.falcosecurity.dev/v1alpha1
kind: Component
metadata:
  name: falcosidekick
  namespace: falco
  annotations:
    # Deploy the event forwarder after the Falco instance and its CRDs exist.
    argocd.argoproj.io/sync-wave: "2"
spec:
  component:
    type: falcosidekick
  replicas: 1
  podTemplateSpec:
    spec:
      containers:
        - name: falcosidekick
          env:
            - name: SLACK_WEBHOOKURL
              valueFrom:
                secretKeyRef:
                  name: falco-alerting
                  key: webhook-url
            # Keep low-priority Falco events in cluster logs, but do not send
            # NOTICE-level activity to the Slack alert channel.
            - name: SLACK_MINIMUMPRIORITY
              value: warning