Integrations¶
Falco operator¶
Falco supports the following integrations with other charms.
Requires¶
general-info¶
Interface: juju-info
Supported charms: any principal charms
Since Falco is a subordinate charm, it needs to be integrated with a principal charm with this interface.
Example general-info integrate command:
juju integrate falco ubuntu
Provides¶
cos-agent¶
Interface: cos_agent
Supported charms: grafana-agent, opentelemetry-collector
Limit: 1
This integration provides a COS (Canonical Observability Stack) agent relation to enable metrics collection from Falco. When integrated with Grafana Agent or OpenTelemetry Collector, Falco will expose metrics on port 8765 at the /metrics endpoint, allowing the agent to scrape and forward metrics to Prometheus.
Example cos-agent integrate command:
juju integrate falco:cos-agent grafana-agent:cos-agent
http-endpoint¶
Interface: falcosidekick_http_endpoint
Supported charms: falcosidekick-k8s
Limit: 1
This integration allows Falco to send security alerts to a Falcosidekick instance through HTTP. Falcosidekick acts as a central hub for routing Falco alerts to various outputs (Loki, Slack, and so on).
When integrated, Falco will automatically configure its HTTP output to point to the Falcosidekick endpoint provided through this relation.
Example http-endpoint integrate command:
juju integrate falco:http-endpoint falcosidekick-k8s:http-endpoint
Falcosidekick K8s operator¶
Falcosidekick K8s supports the following integrations with other charms.
Provides¶
http-endpoint¶
Interface: falcosidekick_http_endpoint
Supported charms: falco
This integration provides an HTTP endpoint for receiving Falco security alerts. When integrated with the Falco charm, Falcosidekick will expose its HTTP endpoint, allowing Falco to send alerts directly to it.
Example integrate command:
juju integrate falcosidekick-k8s:http-endpoint falco:http-endpoint
grafana-dashboard¶
Interface: grafana_dashboard
Supported charms: grafana-k8s, opentelemetry-collector-k8s
This integration provides a pre-configured Grafana dashboard for visualizing Falcosidekick metrics and alerts. When integrated with Grafana, the dashboard will be automatically loaded, providing insights into alert volumes, processing rates, and output health.
Example integrate command:
juju integrate falcosidekick-k8s:grafana-dashboard grafana-k8s:grafana-dashboard
metrics-endpoint¶
Interface: prometheus_scrape
Supported charms: prometheus-k8s, opentelemetry-collector-k8s
This integration exposes Falcosidekick’s Prometheus metrics endpoint for scraping. When integrated with Prometheus, metrics about alert processing, output status, and performance will be collected and stored for monitoring and alerting.
Example integrate command:
juju integrate falcosidekick-k8s:metrics-endpoint prometheus-k8s:metrics-endpoint
Requires¶
send-loki-logs¶
Interface: loki_push_api
Supported charms: loki-k8s
Limit: 1
This integration allows Falcosidekick to forward Falco alerts to Loki for centralized logging and analysis. When integrated with Loki, all alerts received by Falcosidekick will be automatically pushed to the Loki instance.
Example integrate command:
juju integrate falcosidekick-k8s:send-loki-logs loki-k8s:logging
See also
logging¶
Interface: loki_push_api
Supported charms: loki-k8s, opentelemetry-collector-k8s
Limit: 1
This integration allows Falcosidekick to forward its internal logs to Loki for centralized log management. This is separate from the Falco alerts forwarding and captures operational logs from the Falcosidekick application itself.
Example integrate command:
juju integrate falcosidekick-k8s:logging loki-k8s:logging
certificates¶
Interface: tls-certificates
Supported charms: self-signed-certificates, tls-certificates-operator
Limit: 1
This integration enables TLS/HTTPS for the Falcosidekick HTTP endpoint. When integrated with a TLS certificate provider, Falcosidekick will automatically configure HTTPS with the provided certificates, securing the communication channel for receiving Falco alerts.
Example integrate command:
juju integrate falcosidekick-k8s:certificates self-signed-certificates:certificates
ingress¶
Interface: ingress
Supported charms: nginx-ingress-integrator, traefik-k8s, gateway-api-integrator
Limit: 1
This integration exposes the Falcosidekick HTTP endpoint through a Kubernetes ingress controller, making it accessible from outside the cluster.
Example integrate command:
juju integrate falcosidekick-k8s:ingress nginx-ingress-integrator:ingress