Mayne0213
50ceb6d98d
- application - Falco: 100m → 30m - Falcosidekick Web UI: 50m → 30m The previous commit only updated helm-values/falco.yaml which wasn't being used. The ArgoCD Application uses inline helm values.
120 lines
2.7 KiB
YAML
120 lines
2.7 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: falco
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
project: default
|
|
|
|
source:
|
|
# Helm chart from Falcosecurity repository
|
|
repoURL: https://falcosecurity.github.io/charts
|
|
chart: falco
|
|
targetRevision: 4.20.0
|
|
helm:
|
|
values: |
|
|
# Driver configuration - use modern_ebpf
|
|
driver:
|
|
enabled: true
|
|
kind: modern_ebpf
|
|
|
|
# Image configuration - use Falco 0.40.0 for kernel 6.14 support
|
|
image:
|
|
registry: docker.io
|
|
repository: falcosecurity/falco
|
|
tag: 0.40.0
|
|
|
|
# Resource requests
|
|
resources:
|
|
requests:
|
|
cpu: 30m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: null # Delete Helm chart default CPU limit
|
|
memory: 1Gi
|
|
|
|
# Falco configuration
|
|
falco:
|
|
json_output: true
|
|
json_include_output_property: true
|
|
log_stderr: true
|
|
log_syslog: false
|
|
log_level: info
|
|
rules_files:
|
|
- /etc/falco/falco_rules.yaml
|
|
- /etc/falco/falco_rules.local.yaml
|
|
|
|
# Metrics
|
|
metrics:
|
|
enabled: true
|
|
|
|
# Service Monitor
|
|
serviceMonitor:
|
|
enabled: true
|
|
interval: 30s
|
|
|
|
# Falcosidekick
|
|
falcosidekick:
|
|
enabled: true
|
|
config:
|
|
debug: false
|
|
webui:
|
|
enabled: true
|
|
replicaCount: 1
|
|
resources:
|
|
requests:
|
|
cpu: 30m
|
|
memory: 128Mi
|
|
|
|
# RBAC
|
|
rbac:
|
|
create: true
|
|
|
|
serviceAccount:
|
|
create: true
|
|
name: falco
|
|
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
key: node-role.kubernetes.io/master
|
|
- effect: NoSchedule
|
|
key: node-role.kubernetes.io/control-plane
|
|
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: falco
|
|
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
allowEmpty: false
|
|
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
- PrunePropagationPolicy=foreground
|
|
- PruneLast=true
|
|
- ServerSideApply=true
|
|
- RespectIgnoreDifferences=true
|
|
- ApplyOutOfSyncOnly=true
|
|
|
|
retry:
|
|
limit: 5
|
|
backoff:
|
|
duration: 5s
|
|
factor: 2
|
|
maxDuration: 3m
|
|
|
|
# Ignore StatefulSet differences managed by Kubernetes
|
|
ignoreDifferences:
|
|
- group: apps
|
|
kind: StatefulSet
|
|
jqPathExpressions:
|
|
- '.spec.persistentVolumeClaimRetentionPolicy'
|
|
- '.spec.volumeClaimTemplates[]?.metadata.creationTimestamp'
|
|
- '.spec.volumeClaimTemplates[]?.status'
|
|
|
|
revisionHistoryLimit: 10
|