From 30d878c899054067fc92363af9b80f79034450be Mon Sep 17 00:00:00 2001
From: Jochem <j.bruijns@fullstaq.com>
Date: Tue, 9 Jul 2024 17:20:27 +0200
Subject: [PATCH] Make 'for' configurable for falco exporter prometheus rules

Signed-off-by: Jochem <j.bruijns@fullstaq.com>
---
 charts/falco-exporter/templates/prometheusrule.yaml | 10 +++++-----
 charts/falco-exporter/values.yaml                   |  5 +++++
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/charts/falco-exporter/templates/prometheusrule.yaml b/charts/falco-exporter/templates/prometheusrule.yaml
index d495d70f2..c50f185f5 100644
--- a/charts/falco-exporter/templates/prometheusrule.yaml
+++ b/charts/falco-exporter/templates/prometheusrule.yaml
@@ -31,7 +31,7 @@ spec:
         summary: Falco is experiencing high rate of warning events
         description: A high rate of warning events are being detected by Falco
       expr: rate(falco_events{priority="4"}[{{ .Values.prometheusRules.alerts.warning.rate_interval }}]) > {{ .Values.prometheusRules.alerts.warning.threshold }}
-      for: 15m
+      for: {{ .Values.prometheusRules.alerts.warning.for }}
       labels:
         severity: warning
     {{- end }}
@@ -41,7 +41,7 @@ spec:
         summary: Falco is experiencing high rate of error events
         description: A high rate of error events are being detected by Falco
       expr: rate(falco_events{priority="3"}[{{ .Values.prometheusRules.alerts.error.rate_interval }}]) > {{ .Values.prometheusRules.alerts.error.threshold }}
-      for: 15m
+      for: {{ .Values.prometheusRules.alerts.error.for }}
       labels:
         severity: warning
     {{- end }}
@@ -51,7 +51,7 @@ spec:
         summary: Falco is experiencing high rate of critical events
         description: A high rate of critical events are being detected by Falco
       expr: rate(falco_events{priority="2"}[{{ .Values.prometheusRules.alerts.critical.rate_interval }}]) > {{ .Values.prometheusRules.alerts.critical.threshold }}
-      for: 15m
+      {{ .Values.prometheusRules.alerts.critical.for }}
       labels:
         severity: critical
     {{- end }}
@@ -61,7 +61,7 @@ spec:
         summary: Falco is experiencing high rate of alert events
         description: A high rate of alert events are being detected by Falco
       expr: rate(falco_events{priority="1"}[{{ .Values.prometheusRules.alerts.alert.rate_interval }}]) > {{ .Values.prometheusRules.alerts.alert.threshold }}
-      for: 5m
+      for: {{ .Values.prometheusRules.alerts.alert.for }}
       labels:
         severity: critical
     {{- end }}
@@ -71,7 +71,7 @@ spec:
         summary: Falco is experiencing high rate of emergency events
         description: A high rate of emergency events are being detected by Falco
       expr: rate(falco_events{priority="0"}[{{ .Values.prometheusRules.alerts.emergency.rate_interval }}]) > {{ .Values.prometheusRules.alerts.emergency.threshold }}
-      for: 1m
+      for: {{ .Values.prometheusRules.alerts.emergency.for }}
       labels:
         severity: critical
     {{- end }}
diff --git a/charts/falco-exporter/values.yaml b/charts/falco-exporter/values.yaml
index 2015a2aff..3c6d12fb1 100644
--- a/charts/falco-exporter/values.yaml
+++ b/charts/falco-exporter/values.yaml
@@ -198,20 +198,25 @@ prometheusRules:
       enabled: true
       rate_interval: "5m"
       threshold: 0
+      for: "15m"
     error:
       enabled: true
       rate_interval: "5m"
       threshold: 0
+      for: "15m"
     critical:
       enabled: true
       rate_interval: "5m"
       threshold: 0
+      for: "15m"
     alert:
       enabled: true
       rate_interval: "5m"
       threshold: 0
+      for: "5m"
     emergency:
       enabled: true
       rate_interval: "1m"
       threshold: 0
+      for: "1m"
     additionalAlerts: {}