60 lines
2.3 KiB
YAML
60 lines
2.3 KiB
YAML
---
|
|
- name: Validate Falco alerting inputs
|
|
ansible.builtin.assert:
|
|
that:
|
|
- not (falco_alerting_enabled | bool) or falco_slack_webhook_url | length > 0
|
|
fail_msg: falco_slack_webhook_url is required when falco_alerting_enabled is true.
|
|
|
|
- name: Ensure the Falco namespace exists for alerting resources
|
|
ansible.builtin.raw: >-
|
|
{{ k3d_tool_dir }}/kubectl create namespace falco
|
|
--dry-run=client -o yaml |
|
|
{{ k3d_tool_dir }}/kubectl apply -f -
|
|
become_user: "{{ k3d_user }}"
|
|
when: falco_alerting_enabled | bool
|
|
|
|
- name: Create or update the Falco alerting Secret
|
|
ansible.builtin.raw: >-
|
|
{{ k3d_tool_dir }}/kubectl -n falco create secret generic falco-alerting
|
|
--from-literal=webhook-url='{{ falco_slack_webhook_url }}'
|
|
--dry-run=client -o yaml |
|
|
{{ k3d_tool_dir }}/kubectl apply --server-side --force-conflicts -f -
|
|
become_user: "{{ k3d_user }}"
|
|
no_log: true
|
|
when: falco_alerting_enabled | bool
|
|
|
|
- name: Apply the optional Falco alerting ArgoCD Application
|
|
ansible.builtin.raw: >-
|
|
{{ k3d_tool_dir }}/kubectl apply --server-side --force-conflicts
|
|
-f {{ falco_alerting_application_manifest }}
|
|
become_user: "{{ k3d_user }}"
|
|
when: falco_alerting_enabled | bool
|
|
|
|
- name: Remove the optional Falco alerting ArgoCD Application when disabled
|
|
ansible.builtin.raw: >-
|
|
{{ k3d_tool_dir }}/kubectl -n argocd delete application falco-alerting
|
|
--ignore-not-found=true --wait=true
|
|
become_user: "{{ k3d_user }}"
|
|
when: not (falco_alerting_enabled | bool)
|
|
|
|
- name: Remove the Falcosidekick Component when alerting is disabled
|
|
ansible.builtin.raw: >-
|
|
{{ k3d_tool_dir }}/kubectl -n falco delete component falcosidekick
|
|
--ignore-not-found=true --wait=true
|
|
become_user: "{{ k3d_user }}"
|
|
when: not (falco_alerting_enabled | bool)
|
|
|
|
- name: Remove the Falcosidekick output Config when alerting is disabled
|
|
ansible.builtin.raw: >-
|
|
{{ k3d_tool_dir }}/kubectl -n falco delete config falco-falcosidekick-output
|
|
--ignore-not-found=true --wait=true
|
|
become_user: "{{ k3d_user }}"
|
|
when: not (falco_alerting_enabled | bool)
|
|
|
|
- name: Remove the Falco alerting Secret when alerting is disabled
|
|
ansible.builtin.raw: >-
|
|
{{ k3d_tool_dir }}/kubectl -n falco delete secret falco-alerting
|
|
--ignore-not-found=true --wait=true
|
|
become_user: "{{ k3d_user }}"
|
|
when: not (falco_alerting_enabled | bool)
|