Falco operators¶
A collection of Juju charms for deploying and managing Falco runtime security monitoring. Falco is an open-source cloud native security tool that provides runtime security across hosts, containers, Kubernetes, and cloud environments. Falcosidekick connects Falco to your ecosystem by forwarding alerts to observability platforms, incident response tools, and other integrations.
This repository contains:
Falco operator: A subordinate charm that deploys Falco on physical or virtual machines
Falcosidekick K8s operator: A Kubernetes charm that receives and forwards Falco alerts to various outputs
Like any Juju charm, these charms support one-line deployment, configuration, integration, and scaling.
These charms make operating Falco and Falcosidekick straightforward for DevOps and SRE teams through Juju’s clean interface.
In this documentation¶
Use the following guides to move from first deployment to ongoing operations, integrations, and security hardening.
Get started |
Deploy Falco operator | Deploy Falcosidekick K8s operator | Connect Falco to Falcosidekick |
Operations |
Configure custom repository | Configurations | Actions | Troubleshoot | Upgrade |
Integrations and observability |
Integrate with the Canonical Observability Stack | Integration endpoints | Metrics |
Design |
|
Security |
How this documentation is organized¶
This documentation uses the Diátaxis documentation structure.
The Tutorial section walks through end-to-end deployments of Falco, Falcosidekick, and their alert pipeline.
The How to section covers practical tasks for configuring integrations, managing runtime rules, troubleshooting issues, and upgrading the charms.
The Reference section provides technical details on configurations, actions, integrations, metrics, and architecture.
The Explanation section gives background on the charm design and the security model behind the operators.
The Changelog records notable user-facing documentation changes over time.
Contributing to this documentation¶
Documentation is an important part of this project, and we take the same open-source approach to the documentation as the code. As such, we welcome community contributions, suggestions, and constructive feedback on our documentation. See How to contribute for more information.
If there’s a particular area of documentation that you’d like to see that’s missing, please file a bug.
Project and community¶
The Falco Operators are members of the Ubuntu family. This is an open-source project that warmly welcomes community projects, contributions, suggestions, fixes, and constructive feedback.
Thinking about using the Falco Operators for your next project? Get in touch!