# ═══════════════════════════════════════════════════════════════
# Falco + Falco Sidekick Helm Values — STAGING
# Chart: falcosecurity/falco 9.1.0 (Falco 0.44.1 / Sidekick 2.32.0)
# ═══════════════════════════════════════════════════════════════

customRules:
  falco_rules.local.yaml: |-
    # Rule overrides verified with falco --validate on 0.44.1.
    # override only declares the fields to replace; condition is inherited from
    # the upstream default rule. Note: "Write below binary dir" / "Write below etc"
    # were removed from the upstream ruleset, and "Launch Package Management Process"
    # moved to incubating (not loaded in prod), so none of them can be overridden.
    - rule: Terminal shell in container
      override:
        priority: replace
        output: replace
      priority: CRITICAL
      output: "终端 Shell 启动 | 用户=%user.name 容器=%container.name 命令=%proc.cmdline"
    - rule: Read sensitive file untrusted
      override:
        priority: replace
        output: replace
      priority: WARNING
      output: "敏感文件读取 | 用户=%user.name 文件=%fd.name 命令=%proc.cmdline"

    # Exempt buildkit/CI build workloads: buildkitd legitimately writes and
    # executes temporary binaries (e.g. qemu-check) during image builds.
    # See the 2026-07-28 buildkit-liubo02-test false positive.
    - rule: Drop and execute new binary in container
      override:
        exceptions: append
      exceptions:
        - name: buildkit_workloads
          fields: [k8s.ns.name, container.image.repository]
          comps: [startswith, =]
          values:
            - [buildkit, docker.io/moby/buildkit]
        # Exempt ops cleanup workloads: mysql-cleanup pods run metadb maintenance
        # SQL as part of normal operations (2026-07-30 f01 perfmysql cleanup false
        # positive). Whitelisted by container name; no cluster/namespace/image scoping.
        - name: ops_mysql_cleanup
          fields: [container.name]
          comps: [startswith]
          values:
            - [mysql-cleanup]

tolerations:
  - operator: Exists

metrics:
  enabled: true

falco:
  rules_files:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/rules.d/falco_rules.local.yaml
  json_output: true
  json_include_output_property: true
  priority: info
  watch_config_files: true

falcosidekick:
  enabled: true

  # 2026-07-28: force a sidekick rollout to re-enable the S3 output (Enabled
  # Outputs must include AWSS3) after the IAM trust fix (single-statement
  # multi-OIDC AND-condition bug). Remove in a follow-up PR once verified.
  podAnnotations:
    falco.pingcap.com/s3-trust-fix: "2026-07-28"

  # Sidekick 2.31.0: uses S3 SDK v1 (avoids the aws.NewConfig bug in 2.32.0);
  # webhook output works. Feishu goes through the format forwarder (no native
  # feishu support in any 2.30+ version).
  image:
    tag: 2.31.0

  config:
    # The S3 archive bucket lives in us-west-2. The pod-identity webhook injects
    # AWS_REGION=<cluster region> as a direct env var, which beats the chart
    # secret's envFrom and breaks S3 request signing on us-east-1 clusters
    # (AuthorizationHeaderMalformed). An explicit direct env is NOT overridden
    # by the webhook (verified on f01).
    extraEnv:
      - name: AWS_REGION
        value: "us-west-2"
      - name: AWS_DEFAULT_REGION
        value: "us-west-2"
    # [REQUIRED for new envs] Cluster label: sidekick attaches it to every event
    # as output_fields.cluster; feishu alerts use it to locate the source cluster.
    # After deploy-new-region.sh copies this file, replace the value with the
    # target cluster name (must match the ArgoCD registered name), otherwise
    # alerts show "cluster: ?".
    customfields: "cluster:REPLACE_WITH_CLUSTER_NAME"
    # Generic webhook -> feishu format forwarder
    webhook:
      address: "http://feishu-forwarder.falco:8080"
      customHeaders: "Content-Type: application/json"
      minimumpriority: "warning"

    # S3 full log archive (keeps info and above for audit)
    aws:
      useirsa: true
      rolearn: "arn:aws:iam::385595570414:role/falco-sidekick-s3-write"
      region: "us-west-2"
      s3:
        bucket: "tidbcloud-falco-security-logs"
        prefix: "falco"
        minimumpriority: "info"