Tracee with Falcosidekick in Kubernetes

tracee-falcosidekick.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app.kubernetes.io/name: tracee
    app.kubernetes.io/component: tracee
    app.kubernetes.io/part-of: tracee
  name: tracee
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: tracee
  template:
    metadata:
      labels:
        app.kubernetes.io/name: tracee
      name: tracee
    spec:
      containers:
      - image: aquasec/tracee:latest
        imagePullPolicy: Always
        args:
          - --webhook http://falcosidekick:2801 --webhook-template ./templates/falcosidekick.tmpl --webhook-content-type application/json
        name: tracee
        securityContext:
          privileged: true
        volumeMounts:
        - name: tmp-tracee
          mountPath: /tmp/tracee
        - name: usr-src
          mountPath: /usr/src
          readOnly: true
        - name: lib-modules
          mountPath: /lib/modules/
          readOnly: true
        resources:
          limits:
            cpu: 500m
            memory: 300Mi
          requests:
            cpu: 350m
            memory: 50Mi
      tolerations:
        - effect: NoSchedule
          operator: Exists
        - effect: NoExecute
          operator: Exists
      volumes:
      - hostPath:
          path: /tmp/tracee
        name: tmp-tracee
      - hostPath:
          path: /usr/src
        name: usr-src
      - hostPath:
          path: /lib/modules
        name: lib-modules

---

kind: ConfigMap
apiVersion: v1
metadata:
  name: falcosidekick-config
data:
  cfg.yaml: |-
    debug: true
    # Reference: https://github.com/falcosecurity/falcosidekick/blob/master/config_example.yaml
    # slack:
    #   webhookurl: "https://hooks.slack.com/xxxxxxxx"
    # teams:
    #   webhookurl: "https://xxxxxxx"
    
---

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: falcosidekick
    app.kubernetes.io/component: falcosidekick
    app.kubernetes.io/part-of: tracee
  name: falcosidekick
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: falcosidekick
  template:
    metadata:
      labels:
        app.kubernetes.io/name: falcosidekick
      name: falcosidekick
    spec:
      containers:
      - name: falcosidekick
        image: falcosecurity/falcosidekick
        imagePullPolicy: Always
        ports:
        - containerPort: 2801
        args: ["-c","/app/config/cfg.yaml"]
        volumeMounts:
          - name: webhook-volume
            mountPath: /app/config
      volumes:
        - configMap:
            name: falcosidekick-config
          name: webhook-volume
---
apiVersion: v1
kind: Service
metadata:
  name: falcosidekick
  labels:
    app.kubernetes.io/name: falcosidekick
    app.kubernetes.io/component: falcosidekick
    app.kubernetes.io/part-of: tracee
spec:
  ports:
    - name: http
      port: 2801
  selector:
    app.kubernetes.io/name: falcosidekick