falco helm release - kubesearch

No introduction found. Create it?

Name	Repo	Stars	Version	Timestamp
falco	oscaromeu/home-ops	34	9.2.0	3 days ago
falco	xunholy/k8s-gitops	641	9.2.0	6 months ago

Name

Repo

Stars

Version

Timestamp

falco

oscaromeu/home-ops

9.2.0

3 days ago

falco

xunholy/k8s-gitops

641

9.2.0

6 months ago

Key	Types
falcosidekick.enabled (5) `true`	boolean
falcosidekick.replicaCount (5) `1`	number
falcosidekick.webui.enabled (5) `true`	boolean
falcosidekick.webui.replicaCount (4) `1`	number
falcosidekick.webui.disableauth (1) `true`	boolean
falcosidekick.webui.ingress.annotations."cert-manager.io/cluster-issuer" (1) `letsencrypt-prod`	string
falcosidekick.webui.ingress.enabled (1) `true`	boolean
falcosidekick.webui.ingress.hosts[].host (1) `falco.${DOMAIN}`	string
falcosidekick.webui.ingress.hosts[].paths[].path (1) `/`	string
falcosidekick.webui.ingress.ingressClassName (1) `nginx`	string
falcosidekick.webui.ingress.tls[].hosts[] (1) `- falco.${DOMAIN}`	string
falcosidekick.webui.ingress.tls[].secretName (1) `falco-${DOMAIN/./-}-tls`	string
falcosidekick.config.alertmanager.hostport (3) `http://vmalertmanager-victoria-metrics.observability.svc.cluster.local:9093`	string
falcosidekick.config.alertmanager.endpoint (2) `/api/v2/alerts`	string
falcosidekick.config.alertmanager.customseveritymap (1) `emergency:critical,alert:critical,critical:critical,error:warning,warning:warning,notice:info,informational:info,debug:info`	string
falcosidekick.config.alertmanager.extralabels (1) `category:security,component:falco`	string
falcosidekick.config.alertmanager.minimumpriority (1) `warning`	string
falcosidekick.config.customfields (1) `cluster:main`	string
falcosidekick.config.debug (1) `false`	boolean
falcosidekick.resources.limits.memory (2) `256Mi`	string
falcosidekick.resources.requests.cpu (2) `10m`	string
falcosidekick.resources.requests.memory (2) `64Mi`	string
falcosidekick.grafana.dashboards.enabled (1) `true`	boolean
falcosidekick.prometheus.serviceMonitor.enabled (1) `true`	boolean
falcosidekick.prometheusRules.enabled (1) `true`	boolean
falcosidekick.serviceMonitor.enabled (1) `true`	boolean
driver.kind (4) `modern_ebpf`	string
driver.enabled (1) `true`	boolean
collectors.kubernetes.enabled (3) `true`	boolean
collectors.containerd.enabled (2) `true`	boolean
collectors.containerd.socket (1) `/run/containerd/containerd.sock`	string
collectors.crio.enabled (2) `false`	boolean
collectors.docker.enabled (2) `false`	boolean
collectors.containerEngine.enabled (1) `true`	boolean
collectors.containerEngine.engines.bpm.enabled (1) `false`	boolean
collectors.containerEngine.engines.containerd.enabled (1) `true`	boolean
collectors.containerEngine.engines.containerd.sockets[] (1) `- /run/k3s/containerd/containerd.sock`	string
collectors.containerEngine.engines.docker.enabled (1) `false`	boolean
collectors.containerEngine.engines.libvirt_lxc.enabled (1) `false`	boolean
collectors.containerEngine.engines.lxc.enabled (1) `false`	boolean
collectors.containerEngine.engines.podman.enabled (1) `false`	boolean
collectors.enabled (1) `true`	boolean
falco.json_output (2) `true`	boolean
falco.buffered_outputs (1) `true`	boolean
falco.grpc_output.enabled (1) `true`	boolean
falco.grpc.enabled (1) `true`	boolean
falco.json_include_output_property (1) `true`	boolean
falco.log_level (1) `info`	string
falco.metrics.enabled (1) `false`	boolean
falco.metrics.interval (1) `15m`	string
falco.priority (1) `notice`	string
falco.syscall_event_drops.actions[] (1) `- log - alert`	string
falco.syscall_event_drops.max_burst (1) `1`	number
falco.syscall_event_drops.rate (1) `0.03333`	number
metrics.enabled (2) `true`	boolean
metrics.convertMemoryToMB (1) `true`	boolean
metrics.interval (1) `15m`	string
metrics.resourceUtilizationEnabled (1) `true`	boolean
metrics.rulesCountersEnabled (1) `true`	boolean
resources.limits.memory (2) `1Gi`	string
resources.requests.cpu (2) `100m`	string
resources.requests.memory (2) `512Mi`	string
serviceMonitor.create (2) `true`	boolean
serviceMonitor.interval (1) `30s`	string
affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key (1) `kubernetes.io/arch`	string
affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator (1) `In`	string
affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].values[] (1) `- amd64`	string
controller.kind (1) `daemonset`	string
customRules."kube-vip.yaml" (1) `- rule: Packet socket created in container exceptions: - name: kube_vip_arp fields: - k8s.ns.name - container.image.repository - container.name - proc.name - proc.exepath - evt.arg.type - evt.arg.proto comps: [=, =, =, =, =, =, =] values: - - kube-system - ghcr.io/kube-vip/kube-vip - kube-vip - kube-vip - /kube-vip - 2 - 1544 override: exceptions: append`	string
customRules."overrides.yaml" (1) - rule: Drop and execute new binary in container override: exceptions: append exceptions: - name: cni_plugins fields: [proc.exepath] comps: [startswith] values: - [/opt/cni/bin/] - name: ci_namespaces fields: [k8s.ns.name] comps: [in] values: - [[actions-runner-system, development]] # Patches its bundled chromedriver into /app on every start, so # the binary is always newer than the image layer. - name: flaresolverr_chromedriver fields: [container.image.repository, proc.exepath] comps: [=, =] values: - [ghcr.io/flaresolverr/flaresolverr, /app/chromedriver] # Wazuh's own file-integrity monitoring reads /etc/shadow inside its # container -- that is the product working, not credential theft. - rule: Read sensitive file untrusted override: exceptions: append exceptions: - name: wazuh_fim fields: [container.image.repository, proc.name] comps: [=, in] values: - [docker.io/wazuh/wazuh-manager, [wazuh-syscheckd, wazuh-modulesd]]	string
ebpf.enabled (1) `true`	boolean
falcoctl.artifact.follow.enabled (1) `true`	boolean
falcoctl.artifact.install.enabled (1) `true`	boolean
falcoctl.config.artifact.allowedTypes[] (1) `- rulesfile`	string
falcoctl.config.artifact.follow.refs[] (1) `- falco-rules:4`	string
falcoctl.config.artifact.install.refs[] (1) `- falco-rules:4`	string
tty (1) `true`	boolean

Key

Types

falcosidekick.enabled (5)

true

boolean

falcosidekick.replicaCount (5)

number

falcosidekick.webui.enabled (5)

true

boolean

falcosidekick.webui.replicaCount (4)

number

falcosidekick.webui.disableauth (1)

true

boolean

falcosidekick.webui.ingress.annotations."cert-manager.io/cluster-issuer" (1)

letsencrypt-prod

string

falcosidekick.webui.ingress.enabled (1)

true

boolean

falcosidekick.webui.ingress.hosts[].host (1)

falco.${DOMAIN}

string

falcosidekick.webui.ingress.hosts[].paths[].path (1)

string

falcosidekick.webui.ingress.ingressClassName (1)

nginx

string

falcosidekick.webui.ingress.tls[].hosts[] (1)

- falco.${DOMAIN}

string

falcosidekick.webui.ingress.tls[].secretName (1)

falco-${DOMAIN/./-}-tls

string

falcosidekick.config.alertmanager.hostport (3)

http://vmalertmanager-victoria-metrics.observability.svc.cluster.local:9093

string

falcosidekick.config.alertmanager.endpoint (2)

/api/v2/alerts

string

falcosidekick.config.alertmanager.customseveritymap (1)

emergency:critical,alert:critical,critical:critical,error:warning,warning:warning,notice:info,informational:info,debug:info

string

falcosidekick.config.alertmanager.extralabels (1)

category:security,component:falco

string

falcosidekick.config.alertmanager.minimumpriority (1)

warning

string

falcosidekick.config.customfields (1)

cluster:main

string

falcosidekick.config.debug (1)

false

boolean

falcosidekick.resources.limits.memory (2)

256Mi

string

falcosidekick.resources.requests.cpu (2)

10m

string

falcosidekick.resources.requests.memory (2)

64Mi

string

falcosidekick.grafana.dashboards.enabled (1)

true

boolean

falcosidekick.prometheus.serviceMonitor.enabled (1)

true

boolean

falcosidekick.prometheusRules.enabled (1)

true

boolean

falcosidekick.serviceMonitor.enabled (1)

true

boolean

driver.kind (4)

modern_ebpf

string

driver.enabled (1)

true

boolean

collectors.kubernetes.enabled (3)

true

boolean

collectors.containerd.enabled (2)

true

boolean

collectors.containerd.socket (1)

/run/containerd/containerd.sock

string

collectors.crio.enabled (2)

false

boolean

collectors.docker.enabled (2)

false

boolean

collectors.containerEngine.enabled (1)

true

boolean

collectors.containerEngine.engines.bpm.enabled (1)

false

boolean

collectors.containerEngine.engines.containerd.enabled (1)

true

boolean

collectors.containerEngine.engines.containerd.sockets[] (1)

- /run/k3s/containerd/containerd.sock

string

collectors.containerEngine.engines.docker.enabled (1)

false

boolean

collectors.containerEngine.engines.libvirt_lxc.enabled (1)

false

boolean

collectors.containerEngine.engines.lxc.enabled (1)

false

boolean

collectors.containerEngine.engines.podman.enabled (1)

false

boolean

collectors.enabled (1)

true

boolean

falco.json_output (2)

true

boolean

falco.buffered_outputs (1)

true

boolean

falco.grpc_output.enabled (1)

true

boolean

falco.grpc.enabled (1)

true

boolean

falco.json_include_output_property (1)

true

boolean

falco.log_level (1)

info

string

falco.metrics.enabled (1)

false

boolean

falco.metrics.interval (1)

15m

string

falco.priority (1)

notice

string

falco.syscall_event_drops.actions[] (1)

- log
- alert

string

falco.syscall_event_drops.max_burst (1)

number

falco.syscall_event_drops.rate (1)

0.03333

number

metrics.enabled (2)

true

boolean

metrics.convertMemoryToMB (1)

true

boolean

metrics.interval (1)

15m

string

metrics.resourceUtilizationEnabled (1)

true

boolean

metrics.rulesCountersEnabled (1)

true

boolean

resources.limits.memory (2)

1Gi

string

resources.requests.cpu (2)

100m

string

resources.requests.memory (2)

512Mi

string

serviceMonitor.create (2)

true

boolean

serviceMonitor.interval (1)

30s

string

affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key (1)

kubernetes.io/arch

string

affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator (1)

In

string

affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].values[] (1)

- amd64

string

controller.kind (1)

daemonset

string

customRules."kube-vip.yaml" (1)

- rule: Packet socket created in container
  exceptions:
    - name: kube_vip_arp
      fields:
        - k8s.ns.name
        - container.image.repository
        - container.name
        - proc.name
        - proc.exepath
        - evt.arg.type
        - evt.arg.proto
      comps: [=, =, =, =, =, =, =]
      values:
        - - kube-system
          - ghcr.io/kube-vip/kube-vip
          - kube-vip
          - kube-vip
          - /kube-vip
          - 2
          - 1544
  override:
    exceptions: append

string

customRules."overrides.yaml" (1)

- rule: Drop and execute new binary in container
  override:
    exceptions: append
  exceptions:
    - name: cni_plugins
      fields: [proc.exepath]
      comps: [startswith]
      values:
        - [/opt/cni/bin/]
    - name: ci_namespaces
      fields: [k8s.ns.name]
      comps: [in]
      values:
        - [[actions-runner-system, development]]
    # Patches its bundled chromedriver into /app on every start, so
    # the binary is always newer than the image layer.
    - name: flaresolverr_chromedriver
      fields: [container.image.repository, proc.exepath]
      comps: [=, =]
      values:
        - [ghcr.io/flaresolverr/flaresolverr, /app/chromedriver]

# Wazuh's own file-integrity monitoring reads /etc/shadow inside its
# container -- that is the product working, not credential theft.
- rule: Read sensitive file untrusted
  override:
    exceptions: append
  exceptions:
    - name: wazuh_fim
      fields: [container.image.repository, proc.name]
      comps: [=, in]
      values:
        - [docker.io/wazuh/wazuh-manager, [wazuh-syscheckd, wazuh-modulesd]]

string

ebpf.enabled (1)