Falco

eks-service-definition.yml

@@ -53,6 +53,10 @@ provision:
     required: false
     type: boolean
     details: "Specify whether the managed node group should span only a single availability zone"
+  - field_name: slack_webhookurl
+    type: string
+    required: false
+    details: "Slack webhookurl to get Falco alerts"
 
   computed_inputs:
   - name: instance_name
@@ -97,6 +101,10 @@ provision:
     type: boolean
     default: false
     overwrite: true
+  - name: slack_webhookurl
+    type: string
+    default: ""
+    overwrite: true
 
   outputs:
   - field_name: domain_name
@@ -151,6 +159,7 @@ provision:
     k8s-admin-account:      terraform/modules/provision-k8s/k8s-admin-account.tf
     k8s-autoscaler:         terraform/modules/provision-k8s/k8s-autoscaler.tf
     k8s-external-dns:       terraform/modules/provision-k8s/k8s-external-dns.tf
+    k8s-falco:              terraform/modules/provision-k8s/k8s-falco.tf
     k8s-logging:            terraform/modules/provision-k8s/k8s-logging.tf
     k8s-network-policy:     terraform/modules/provision-k8s/k8s-network-policy.tf
     k8s-outputs:            terraform/modules/provision-k8s/k8s-outputs.tf

terraform/modules/provision-aws/variables.tf

@@ -50,3 +50,7 @@ variable "single_az" {
   type    = bool
   default = false
 }
+
+variable "slack_webhookurl" {
+  type = string
+}

terraform/modules/provision-k8s/k8s-falco.tf

@@ -0,0 +1,30 @@
+# Creating namespace for falco.
+# So that the default-deny-egress network policy does not affect falco pods.
+resource "kubernetes_namespace" "falco" {
+  metadata {
+    name = "falco"
+  }
+}
+
+resource "helm_release" "falco" {
+  name       = "falco"
+  chart      = "falco"
+  repository = "https://falcosecurity.github.io/charts"
+  version    = "1.18.3"
+
+  namespace       = kubernetes_namespace.falco.metadata[0].name
+  cleanup_on_fail = "true"
+  timeout         = 600
+
+  dynamic "set" {
+    for_each = {
+      "falcosidekick.enabled"                      = true,
+      "falcosidekick.config.slack.webhookurl"      = var.slack_webhookurl,
+      "falcosidekick.config.slack.minimumpriority" = "warning",
+    }
+    content {
+      name  = set.key
+      value = set.value
+    }
+  }
+}