apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: falco
  namespace: falco
  labels:
    app.kubernetes.io/name: falco
    app.kubernetes.io/part-of: falco
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: falco
      app.kubernetes.io/part-of: falco
  template:
    metadata:
      labels:
        app.kubernetes.io/name: falco
        app.kubernetes.io/part-of: falco
    spec:
      automountServiceAccountToken: true
      serviceAccountName: falco
      dnsPolicy: ClusterFirstWithHostNet
      hostNetwork: true
      containers:
      - name: falco
        image: falcosecurity/falco:latest
        imagePullPolicy: Always
        args:
        - /usr/bin/falco
        - --cri
        - /run/containerd/containerd.sock
        - -K
        - /var/run/secrets/kubernetes.io/serviceaccount/token
        - -k
        - https://kubernetes.default
        - -pk
        env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: FALCO_BPF_PROBE
          value: ""
        securityContext:
          privileged: true
        volumeMounts:
        - mountPath: /etc/falco/falco.yaml
          name: falco-config
          subPath: falco.yaml
          readOnly: true
        - mountPath: /host/var/run/docker.sock
          name: docker-socket
          readOnly: true
        - mountPath: /host/run/containerd/containerd.sock
          name: containerd-socket
          readOnly: true
        - mountPath: /host/dev
          name: dev-fs
          readOnly: true
        - mountPath: /host/proc
          name: proc-fs
          readOnly: true
        - mountPath: /host/boot
          name: boot-fs
          readOnly: true
        - mountPath: /host/lib/modules
          name: lib-modules
          readOnly: true
        - mountPath: /host/usr
          name: usr-fs
          readOnly: true
        - mountPath: /dev/shm
          name: dshm
        - mountPath: /host/etc
          name: etc-fs
          readOnly: true
      volumes:
      - name: falco-config
        configMap:
          name: falco-config
      - name: containerd-socket
        hostPath:
          path: /var/run/containerd.sock
      - name: docker-socket
        hostPath:
          path: /var/run/docker.sock
      - name: dev-fs
        hostPath:
          path: /dev
      - name: etc-fs
        hostPath:
          path: /etc
      - name: proc-fs
        hostPath:
          path: /proc
      - name: boot-fs
        hostPath:
          path: /boot
      - name: lib-modules
        hostPath:
          path: /lib/modules
      - name: usr-fs
        hostPath:
          path: /usr
      - name: dshm
        emptyDir:
          medium: Memory
