# Falco operators A collection of [Juju](https://juju.is/) [charms](https://documentation.ubuntu.com/juju/3.6/reference/charm/) for deploying and managing [Falco](https://falco.org/) runtime security monitoring. Falco is an open-source cloud native security tool that provides runtime security across hosts, containers, Kubernetes, and cloud environments. Falcosidekick connects Falco to your ecosystem by forwarding alerts to observability platforms, incident response tools, and other integrations. This repository contains: - **Falco operator**: A subordinate charm that deploys Falco on physical or virtual machines - **Falcosidekick K8s operator**: A Kubernetes charm that receives and forwards Falco alerts to various outputs Like any Juju charm, these charms support one-line deployment, configuration, integration, and scaling. These charms make operating Falco and Falcosidekick straightforward for DevOps and SRE teams through Juju’s clean interface. ## In this documentation Use the following guides to move from first deployment to ongoing operations, integrations, and security hardening. | | | |------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Get started** | [Deploy Falco operator](https://canonical.com/juju/docs/falco-charms/latest/tutorial/getting-started/index.html.md#tutorial-getting-started) | [Deploy Falcosidekick K8s operator](https://canonical.com/juju/docs/falco-charms/latest/tutorial/deploy-falcosidekick/index.html.md#tutorial-deploy-falcosidekick) | [Connect Falco to Falcosidekick](https://canonical.com/juju/docs/falco-charms/latest/tutorial/end-to-end-deployment/index.html.md#tutorial-end-to-end) | | **Operations** | [Configure custom repository](https://canonical.com/juju/docs/falco-charms/latest/how-to/configure-custom-repository/index.html.md#how-to-configure-custom-repository) | [Configurations](https://canonical.com/juju/docs/falco-charms/latest/reference/configurations/index.html.md#reference-configurations) | [Actions](https://canonical.com/juju/docs/falco-charms/latest/reference/actions/index.html.md#reference-actions) | [Troubleshoot](https://canonical.com/juju/docs/falco-charms/latest/how-to/troubleshoot/index.html.md#how-to-troubleshoot) | [Upgrade](https://canonical.com/juju/docs/falco-charms/latest/how-to/upgrade/index.html.md#how-to-upgrade) | | **Integrations and observability** | [Integrate with the Canonical Observability Stack](https://canonical.com/juju/docs/falco-charms/latest/how-to/integrate-with-cos/index.html.md#how-to-integrate-with-cos) | [Integration endpoints](https://canonical.com/juju/docs/falco-charms/latest/reference/integrations/index.html.md#reference-integrations) | [Metrics](https://canonical.com/juju/docs/falco-charms/latest/reference/metrics/index.html.md#reference-metrics) | | **Design** | [Architecture](https://canonical.com/juju/docs/falco-charms/latest/reference/architecture/index.html.md#reference-architecture) | [Charm design](https://canonical.com/juju/docs/falco-charms/latest/explanation/charm-design/index.html.md#explanation-charm-design) | | **Security** | [Overview](https://canonical.com/juju/docs/falco-charms/latest/explanation/security/index.html.md#explanation-security) | [Configure TLS termination with ingress](https://canonical.com/juju/docs/falco-charms/latest/how-to/configure-tls-ingress/index.html.md#how-to-configure-tls-ingress) | ## How this documentation is organized This documentation uses the [Diátaxis documentation structure](https://diataxis.fr/). - The [Tutorial](https://canonical.com/juju/docs/falco-charms/latest/tutorial/index.html.md#tutorial) section walks through end-to-end deployments of Falco, Falcosidekick, and their alert pipeline. - The [How to](https://canonical.com/juju/docs/falco-charms/latest/how-to/index.html.md#how-to) section covers practical tasks for configuring integrations, managing runtime rules, troubleshooting issues, and upgrading the charms. - The [Reference](https://canonical.com/juju/docs/falco-charms/latest/reference/index.html.md#reference) section provides technical details on configurations, actions, integrations, metrics, and architecture. - The [Explanation](https://canonical.com/juju/docs/falco-charms/latest/explanation/index.html.md#explanation) section gives background on the charm design and the security model behind the operators. - The [Changelog](https://canonical.com/juju/docs/falco-charms/latest/changelog/index.html.md#changelog) records notable user-facing documentation changes over time. ## Contributing to this documentation Documentation is an important part of this project, and we take the same open-source approach to the documentation as the code. As such, we welcome community contributions, suggestions, and constructive feedback on our documentation. See [How to contribute](https://canonical.com/juju/docs/falco-charms/latest/how-to/contribute/index.html.md#how-to-contribute) for more information. If there’s a particular area of documentation that you’d like to see that’s missing, please [file a bug](https://github.com/canonical/falco-operators/issues). ## Project and community The Falco Operators are members of the Ubuntu family. This is an open-source project that warmly welcomes community projects, contributions, suggestions, fixes, and constructive feedback. - [Code of conduct](https://ubuntu.com/community/code-of-conduct) - [Get support](https://discourse.charmhub.io/) - [Join our online chat](https://matrix.to/#/#charmhub-charmdev:ubuntu.com) - [Contribute](https://github.com/canonical/falco-operators/blob/main/CONTRIBUTING.md) Thinking about using the Falco Operators for your next project? [Get in touch](https://matrix.to/#/#charmhub-charmdev:ubuntu.com)!