Deploying Falco on Kubernetes

Summary

A security audit found no runtime monitoring layer on the cluster beyond network policy, so Falco was deployed to detect anomalous behavior (container exec, sensitive file reads), with custom rules and Falcosidekick integration.

System Context

• •Cluster: K8s 1.29 (kubeadm), 3 control-plane + 5 worker nodes
• •Existing CNI: Cilium (eBPF enabled)
• •No centralized SIEM yet — alerting stops at Prometheus/Alertmanager

Checklist

• ☑Falco pods healthy across all nodes (DaemonSet)
• ☑Audit-mode rules don't block existing production workloads
• ☑Simulated exec into a foreign container triggers a Slack alert within 5s
• ☑Node CPU/memory overhead stays under 3% after 24h of observation

Commands

helm repo add falcosecurity https://falcosecurity.github.io/charts

helm install falco falcosecurity/falco -n falco --create-namespace

kubectl apply -f falco-custom-rules.yaml

helm install falcosidekick falcosecurity/falcosidekick -n falco

Conclusion

Falco provides excellent runtime visibility with minimal overhead. Custom rules should be tested in audit mode before enabling enforcement. Falcosidekick integration with Slack provides actionable alerts within minutes.