---
# Source: falco/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: falco
  namespace: default
  labels:
    helm.sh/chart: falco-9.0.0
    app.kubernetes.io/name: falco
    app.kubernetes.io/instance: falco
    app.kubernetes.io/version: "0.44.0"
    app.kubernetes.io/managed-by: Helm
---
# Source: falco/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: falco
  namespace: default
  labels:
    helm.sh/chart: falco-9.0.0
    app.kubernetes.io/name: falco
    app.kubernetes.io/instance: falco
    app.kubernetes.io/version: "0.44.0"
    app.kubernetes.io/managed-by: Helm
data:
  falco.yaml: |-
    append_output:
    - suggested_output: true
    base_syscalls:
      all: false
      custom_set: []
      repair: false
    buffer_format_base64: false
    buffered_outputs: false
    capture:
      default_duration: 5000
      enabled: false
      mode: rules
      path_prefix: /tmp/falco
    config_files:
    - /etc/falco/config.d
    engine:
      kind: modern_ebpf
      kmod:
        buf_size_preset: 4
        drop_failed_exit: false
      modern_ebpf:
        buf_size_preset: 4
        cpus_for_each_buffer: 2
        drop_failed_exit: false
    falco_libs:
      snaplen: 80
      thread_table_auto_purging_interval_s: 300
      thread_table_auto_purging_thread_timeout_s: 300
      thread_table_size: 262144
    file_output:
      enabled: false
      filename: ./events.txt
      keep_alive: false
    http_output:
      ca_bundle: ""
      ca_cert: ""
      ca_path: /etc/falco/certs/
      client_cert: /etc/falco/certs/client/client.crt
      client_key: /etc/falco/certs/client/client.key
      compress_uploads: false
      echo: false
      enabled: false
      insecure: false
      keep_alive: false
      max_consecutive_timeouts: 5
      mtls: false
      url: ""
      user_agent: falcosecurity/falco
    json_include_message_property: false
    json_include_output_fields_property: true
    json_include_output_property: true
    json_include_tags_property: true
    json_output: false
    libs_logger:
      enabled: true
      severity: info
    load_plugins:
    - container
    log_level: info
    log_stderr: true
    log_syslog: true
    output_timeout: 2000
    outputs_queue:
      capacity: 0
    plugins:
    - init_config:
        engines:
          bpm:
            enabled: true
          containerd:
            enabled: true
            sockets:
            - /run/host-containerd/containerd.sock
          cri:
            enabled: true
            sockets:
            - /run/containerd/containerd.sock
            - /run/crio/crio.sock
            - /run/k3s/containerd/containerd.sock
            - /run/host-containerd/containerd.sock
          docker:
            enabled: true
            sockets:
            - /var/run/docker.sock
          libvirt_lxc:
            enabled: true
          lxc:
            enabled: true
          podman:
            enabled: true
            sockets:
            - /run/podman/podman.sock
        hooks:
        - create
        label_max_len: 100
        with_size: false
      library_path: libcontainer.so
      name: container
    plugins_hostinfo: true
    priority: debug
    program_output:
      enabled: false
      keep_alive: false
      program: 'jq ''{text: .output}'' | curl -d @- -X POST https://hooks.slack.com/services/XXX'
    rule_matching: first
    rules_files:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco_rules.local.yaml
    - /etc/falco/rules.d
    stdout_output:
      enabled: true
    syscall_event_drops:
      actions:
      - log
      - alert
      max_burst: 1
      rate: 0.03333
      simulate_drops: false
      threshold: 0.1
    syscall_event_timeouts:
      max_consecutives: 1000
    syslog_output:
      enabled: true
    time_format_iso_8601: false
    watch_config_files: true
    webserver:
      enabled: true
      k8s_healthz_endpoint: /healthz
      listen_address: 0.0.0.0
      listen_port: 8765
      prometheus_metrics_enabled: false
      ssl_certificate: /etc/falco/falco.pem
      ssl_enabled: false
      threadiness: 0
---
# Source: falco/templates/falcoctl-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: falco-falcoctl
  namespace: default
  labels:
    helm.sh/chart: falco-9.0.0
    app.kubernetes.io/name: falco
    app.kubernetes.io/instance: falco
    app.kubernetes.io/version: "0.44.0"
    app.kubernetes.io/managed-by: Helm
data:
  falcoctl.yaml: |-
    artifact:
      allowedTypes:
      - rulesfile
      - plugin
      follow:
        every: 168h
        falcoversions: http://localhost:8765/versions
        pluginsDir: /plugins
        refs:
        - falco-rules:5
        rulesfilesDir: /rulesfiles
        stateDir: /artifactstate
      install:
        pluginsDir: /plugins
        refs:
        - falco-rules:5
        - ghcr.io/falcosecurity/plugins/plugin/container:0.7.1
        resolveDeps: true
        rulesfilesDir: /rulesfiles
        stateDir: /artifactstate
    indexes:
    - name: falcosecurity
      url: https://falcosecurity.github.io/falcoctl/index.yaml
---
# Source: falco/templates/role.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: falco
  namespace: default
  labels:
    helm.sh/chart: falco-9.0.0
    app.kubernetes.io/name: falco
    app.kubernetes.io/instance: falco
    app.kubernetes.io/version: "0.44.0"
    app.kubernetes.io/managed-by: Helm
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - update
---
# Source: falco/templates/roleBinding.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: falco
  namespace: default
  labels:
    helm.sh/chart: falco-9.0.0
    app.kubernetes.io/name: falco
    app.kubernetes.io/instance: falco
    app.kubernetes.io/version: "0.44.0"
    app.kubernetes.io/managed-by: Helm
subjects:
  - kind: ServiceAccount
    name: falco
    namespace: default
roleRef:
  kind: Role
  name: falco
  apiGroup: rbac.authorization.k8s.io
---
# Source: falco/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: falco
  namespace: default
  labels:
    helm.sh/chart: falco-9.0.0
    app.kubernetes.io/name: falco
    app.kubernetes.io/instance: falco
    app.kubernetes.io/version: "0.44.0"
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: falco
      app.kubernetes.io/instance: falco
  template:
    metadata:
      name: falco
      labels:
        app.kubernetes.io/name: falco
        app.kubernetes.io/instance: falco
      annotations:
        checksum/config: 931891c60e5ffdbeba6bf0e02bead849d65d8805eec35307931fa6e8b0458416
        checksum/rules: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
        checksum/certs: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
    spec:
      serviceAccountName: falco
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
      containers:
        - name: falco
          image: docker.io/falcosecurity/falco:0.44.0
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              cpu: 1000m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 512Mi
          securityContext:
            privileged: true
          args:
            - /usr/bin/falco
          env:
            - name: HOST_ROOT
              value: /host
            - name: FALCO_HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: FALCO_K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          tty: false
          ports:
            - containerPort: 8765
              name: web
              protocol: TCP
          startupProbe:
            initialDelaySeconds: 3
            timeoutSeconds: 5
            periodSeconds: 5
            failureThreshold: 20
            httpGet:
              path: /healthz
              port: 8765
          livenessProbe:
            initialDelaySeconds: 0
            timeoutSeconds: 5
            periodSeconds: 15
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8765
          readinessProbe:
            initialDelaySeconds: 0
            timeoutSeconds: 5
            periodSeconds: 15
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8765
          volumeMounts:
            - mountPath: /host/var/run/docker.sock
              name: container-engine-socket-0
            - mountPath: /host/run/podman/podman.sock
              name: container-engine-socket-1
            - mountPath: /host/run/host-containerd/containerd.sock
              name: container-engine-socket-2
            - mountPath: /host/run/containerd/containerd.sock
              name: container-engine-socket-3
            - mountPath: /host/run/crio/crio.sock
              name: container-engine-socket-4
            - mountPath: /host/run/k3s/containerd/containerd.sock
              name: container-engine-socket-5
            - mountPath: /etc/falco
              name: rulesfiles-install-dir
            - mountPath: /usr/share/falco/plugins
              name: plugins-install-dir
            - mountPath: /etc/falco/config.d
              name: specialized-falco-configs
            - mountPath: /root/.falco
              name: root-falco-fs
            - mountPath: /host/proc
              name: proc-fs
            - mountPath: /host/etc
              name: etc-fs
              readOnly: true
            - mountPath: /host/dev
              name: dev-fs
              readOnly: true
            - name: sys-module-fs
              mountPath: /sys/module
            - mountPath: /sys/kernel
              name: sys-fs
              readOnly: true
            - mountPath: /etc/falco/falco.yaml
              name: falco-yaml
              subPath: falco.yaml
        - name: falcoctl-artifact-follow
          image: docker.io/falcosecurity/falcoctl:0.13.0
          imagePullPolicy: IfNotPresent
          args:
            - artifact
            - follow
            - --log-format=json
          securityContext:
          volumeMounts:
            - mountPath: /plugins
              name: plugins-install-dir
            - mountPath: /rulesfiles
              name: rulesfiles-install-dir
            - mountPath: /etc/falcoctl
              name: falcoctl-config-volume
            - mountPath: /artifactstate
              name: artifact-state-dir
      initContainers:
        - name: falco-driver-loader
          image: docker.io/falcosecurity/falco-driver-loader:0.44.0
          imagePullPolicy: IfNotPresent
          args:
            - auto
          securityContext:
            privileged: true
          volumeMounts:
            - mountPath: /root/.falco
              name: root-falco-fs
            - mountPath: /host/proc
              name: proc-fs
              readOnly: true
            - mountPath: /host/boot
              name: boot-fs
              readOnly: true
            - mountPath: /host/lib/modules
              name: lib-modules
            - mountPath: /host/usr
              name: usr-fs
              readOnly: true
            - mountPath: /host/etc
              name: etc-fs
              readOnly: true
            - mountPath: /etc/falco/config.d
              name: specialized-falco-configs
          env:
            - name: HOST_ROOT
              value: /host
            - name: FALCOCTL_DRIVER_CONFIG_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: FALCOCTL_DRIVER_CONFIG_CONFIGMAP
              value: falco
        - name: falcoctl-artifact-install
          image: docker.io/falcosecurity/falcoctl:0.13.0
          imagePullPolicy: IfNotPresent
          args:
            - artifact
            - install
            - --log-format=json
          securityContext:
          volumeMounts:
            - mountPath: /plugins
              name: plugins-install-dir
            - mountPath: /rulesfiles
              name: rulesfiles-install-dir
            - mountPath: /etc/falcoctl
              name: falcoctl-config-volume
            - mountPath: /artifactstate
              name: artifact-state-dir
      volumes:
        - hostPath:
            path: /var/run/docker.sock
          name: container-engine-socket-0
        - hostPath:
            path: /run/podman/podman.sock
          name: container-engine-socket-1
        - hostPath:
            path: /run/host-containerd/containerd.sock
          name: container-engine-socket-2
        - hostPath:
            path: /run/containerd/containerd.sock
          name: container-engine-socket-3
        - hostPath:
            path: /run/crio/crio.sock
          name: container-engine-socket-4
        - hostPath:
            path: /run/k3s/containerd/containerd.sock
          name: container-engine-socket-5
        - name: specialized-falco-configs
          emptyDir: {}
        - name: plugins-install-dir
          emptyDir: {}
        - name: rulesfiles-install-dir
          emptyDir: {}
        - name: artifact-state-dir
          emptyDir: {}
        - name: root-falco-fs
          emptyDir: {}
        - name: boot-fs
          hostPath:
            path: /boot
        - name: lib-modules
          hostPath:
            path: /lib/modules
        - name: usr-fs
          hostPath:
            path: /usr
        - name: etc-fs
          hostPath:
            path: /etc
        - name: dev-fs
          hostPath:
            path: /dev
        - name: sys-module-fs
          hostPath:
            path: /sys/module
        - name: sys-fs
          hostPath:
            path: /sys/kernel
        - name: proc-fs
          hostPath:
            path: /proc
        - name: falcoctl-config-volume
          configMap:
            name: falco-falcoctl
            items:
              - key: falcoctl.yaml
                path: falcoctl.yaml
        - name: falco-yaml
          configMap:
            name: falco
            items:
            - key: falco.yaml
              path: falco.yaml
  updateStrategy:
    type: RollingUpdate