apiVersion: v1
kind: ConfigMap
metadata:
  name: falco-config
  namespace: falco
  labels:
    app.kubernetes.io/name: falco
    app.kubernetes.io/part-of: falco
data:
  falco.yaml: |
    rules_file:
      - /etc/falco/falco_rules.yaml
      - /etc/falco/falco_rules.local.yaml
      - /etc/falco/k8s_audit_rules.yaml
      - /etc/falco/rules.d

    time_format_iso_8601: true
    json_output: true
    json_include_output_property: true

    log_stderr: true
    log_level: info

    # Minimum rule priority level to load and run. All rules having a
    # priority more severe than this level will be loaded/run.  Can be one
    # of "emergency", "alert", "critical", "error", "warning", "notice",
    # "info", "debug".
    priority: debug

    # Falco uses a shared buffer between the kernel and userspace to pass
    # system call information. When falco detects that this buffer is
    # full and system calls have been dropped, it can take one or more of
    # the following actions:
    #   - "ignore": do nothing. If an empty list is provided, ignore is assumed.
    #   - "log": log a CRITICAL message noting that the buffer was full.
    #   - "alert": emit a falco alert noting that the buffer was full.
    #   - "exit": exit falco with a non-zero rc.
    #
    # The rate at which log/alert messages are emitted is governed by a
    # token bucket. The rate corresponds to one message every 30 seconds
    # with a burst of 10 messages.

    syscall_event_drops:
      actions:
        - log
      rate: .03333
      max_burst: 10

    # A throttling mechanism implemented as a token bucket limits the
    # rate of falco notifications. This throttling is controlled by the following configuration
    # options:
    #  - rate: the number of tokens (i.e. right to send a notification)
    #    gained per second. Defaults to 1.
    #  - max_burst: the maximum number of tokens outstanding. Defaults to 1000.
    #
    # With these defaults, falco could send up to 1000 notifications after
    # an initial quiet period, and then up to 1 notification per second
    # afterward. It would gain the full burst back after 1000 seconds of
    # no activity.

    outputs:
      rate: 1
      max_burst: 1000

    syslog_output:
      enabled: false

    file_output:
      enabled: false
      keep_alive: false
      filename: ./events.txt

    stdout_output:
      enabled: false

    # Falco contains an embedded webserver that can be used to accept K8s
    # Audit Events. These config options control the behavior of that
    # webserver. (By default, the webserver is enabled).
    #
    # The ssl_certificate is a combination SSL Certificate and corresponding
    # key contained in a single file. You can generate a key/cert as follows:
    #
    # $ openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
    # $ cat certificate.pem key.pem > falco.pem
    # $ sudo cp falco.pem /etc/falco/falco.pem

    webserver:
      enabled: false
      listen_port: 8765
      k8s_audit_endpoint: /k8s-audit
      ssl_enabled: false
      ssl_certificate: /etc/falco/falco.pem

    http_output:
      enabled: true
      url: http://falcosidekick.falcosidekick:2801

    grpc_output:
      enabled: false
