# ═══════════════════════════════════════════════════════════════
# Falco + Falco Sidekick Helm Values - PRODUCTION
# Chart: falcosecurity/falco 9.1.0 (Falco 0.44.1 / Sidekick 2.32.0)
# ═══════════════════════════════════════════════════════════════

customRules:
  falco_rules.local.yaml: |-
    # Rule overrides verified with falco --validate on 0.44.1.
    # override only declares the fields to replace; condition is inherited from
    # the upstream default rule. Note: "Write below binary dir" / "Write below etc"
    # were removed from the upstream ruleset, and "Launch Package Management Process"
    # moved to incubating (not loaded in prod), so none of them can be overridden.
    - rule: Terminal shell in container
      override:
        priority: replace
        output: replace
        exceptions: append
      priority: CRITICAL
      output: "Terminal shell started | user=%user.name container=%container.name command=%proc.cmdline"
      exceptions:
        - name: cockpit_container
          fields: [container.name]
          comps: [=]
          values:
            - [cockpit]
        # tidb-admin runs controlled etcd maintenance using the trusted etcd
        # image. Suppress shell events from this scoped workload.
        - name: tidb_admin_etcd_shell
          fields: [k8s.ns.name, container.image.repository]
          comps: [=, =]
          values:
            - [tidb-admin, gcr.io/etcd-development/etcd]
    - rule: Read sensitive file untrusted
      override:
        priority: replace
        output: replace
      priority: WARNING
      output: "Sensitive file read | user=%user.name file=%fd.name command=%proc.cmdline"

    # Exempt buildkit/CI build workloads: buildkitd legitimately writes and
    # executes temporary binaries (e.g. qemu-check) during image builds.
    # See the 2026-07-28 buildkit-liubo02-test false positive.
    - rule: Drop and execute new binary in container
      override:
        exceptions: append
      exceptions:
        - name: buildkit_workloads
          fields: [k8s.ns.name, container.image.repository]
          comps: [startswith, =]
          values:
            - [buildkit, docker.io/moby/buildkit]
        # Exempt ops cleanup workloads: mysql-cleanup pods run metadb maintenance
        # SQL as part of normal operations (2026-07-30 f01 perfmysql cleanup false
        # positive). Whitelisted by container name; no cluster/namespace/image scoping.
        - name: ops_mysql_cleanup
          fields: [container.name]
          comps: [startswith]
          values:
            - [mysql-cleanup]
        # Serverless PD uses etcdctl for scheduled metadata maintenance. Restrict
        # this to the trusted PD image and namespace, without coupling it to a
        # particular internal endpoint name.
        - name: serverless_pd_etcdctl_maintenance
          fields: [k8s.ns.name, container.image.repository, proc.name]
          comps: [=, =, =]
          values:
            - [tidb-serverless, 380838443567.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/serverless/pd, etcdctl]
        # BYOC dataplane-manager uses its trusted Alpine utility image for EKS
        # authentication and Kubernetes inspection. Scope this to the image and
        # namespace, while allowing its standard CLI entrypoints.
        - name: dataplane_manager_alpine_cli
          fields: [k8s.ns.name, container.image.repository, proc.name]
          comps: [=, =, in]
          values:
            - [dataplane-manager, docker.io/library/alpine, [aws-iam-authent, kubectl]]
        # The BYOC archive job packages its own scheduled collection output.
        - name: dataplane_manager_archive_tools
          fields: [k8s.ns.name, container.image.repository, proc.name]
          comps: [=, =, in]
          values:
            - [dataplane-manager, public.ecr.aws/aws-cli/aws-cli, [tar, gzip]]

tolerations:
  - operator: Exists

image:
  registry: 380838443567.dkr.ecr.us-west-2.amazonaws.com
  repository: third-party/falcosecurity/falco
  tag: "0.44.1"

driver:
  loader:
    initContainer:
      image:
        registry: 380838443567.dkr.ecr.us-west-2.amazonaws.com
        repository: third-party/falcosecurity/falco-driver-loader
        tag: "0.44.1"

falcoctl:
  image:
    registry: 380838443567.dkr.ecr.us-west-2.amazonaws.com
    repository: third-party/falcosecurity/falcoctl
    tag: "0.13.0"

metrics:
  enabled: true

podPriorityClassName: falco-critical

# Resources for the falco container (top-level chart key; sidekick is unaffected).
# request 512Mi (chart default) -> 256Mi -> 128Mi: the production fleet capacity
# assessment found memory request headroom was a major deployment blocker. Runtime
# measurements on production Falco showed approximately 82.5-86.8Mi RSS, so 128Mi
# is the lowest first-stage canary request selected with measured headroom.
# ~401Mi allocatable memory left, so 512Mi could never schedule (DaemonSet pods are
# pinned to their nodes by nodeAffinity; adding nodes does not help). request only
# affects scheduling; limit stays 1024Mi so runtime is unchanged. This change is
# deployed first to an 18-cluster cohort and must be observed before expansion.
resources:
  requests:
    cpu: 50m
    memory: 128Mi

falco:
  rules_files:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/rules.d/falco_rules.local.yaml
  json_output: true
  json_include_output_property: true
  priority: info
  watch_config_files: true

falcosidekick:
  enabled: true

  # Sidekick 2.31.0: uses S3 SDK v1 (avoids the aws.NewConfig bug in 2.32.0);
  # webhook output works. Feishu goes through the format forwarder (no native
  # feishu support in any 2.30+ version).
  image:
    registry: 380838443567.dkr.ecr.us-west-2.amazonaws.com
    repository: third-party/falcosecurity/falcosidekick
    tag: 2.31.0

  config:
    # The S3 archive bucket lives in us-west-2. The pod-identity webhook injects
    # AWS_REGION=<cluster region> as a direct env var, which beats the chart
    # secret's envFrom and breaks S3 request signing on us-east-1 clusters
    # (AuthorizationHeaderMalformed). An explicit direct env is NOT overridden
    # by the webhook (verified on f01).
    extraEnv:
      - name: AWS_REGION
        value: "us-west-2"
      - name: AWS_DEFAULT_REGION
        value: "us-west-2"
    # [REQUIRED for new envs] Cluster label: sidekick attaches it to every event
    # as output_fields.cluster; feishu alerts use it to locate the source cluster.
    # After deploy-new-region.sh copies this file, replace the value with the
    # target cluster name (must match the ArgoCD registered name), otherwise
    # alerts show "cluster: ?".
    customfields: "cluster:REPLACE_WITH_CLUSTER_NAME"
    # Generic webhook -> feishu format forwarder
    webhook:
      address: "http://feishu-forwarder.falco:8080"
      customHeaders: "Content-Type: application/json"
      minimumpriority: "warning"

    # S3 full log archive (keeps info and above for audit)
    aws:
      useirsa: true
      rolearn: "arn:aws:iam::380838443567:role/falco-prod-sidekick-s3-write"
      region: "us-west-2"
      s3:
        bucket: "tidbcloud-falco-security-logs"
        # Each environment overrides this with a cluster-specific production
        # prefix so staging and production objects never share a path.
        prefix: "falco/prod"
        minimumpriority: "info"