Improvements to the "Install and Operate" Documentation

[pmusa]

Dear Falco community,
@mikegcoleman, @n1g3ld0ugla5 and I would like to propose improvements to the "Install and Operate" documentation.

The current structure is the following:

Install and Operate
  - Download
  - Install
  - Upgrade
  - Running
  - Deployment
  - Falco Performance in Production
  - Build Falco from source
  - Third Party Integrations
      - Installation Tools
      - Learning Environment
      - Production Environment

The new (proposed) structure is the following:

Install and Run
  - Host
  - Docker
  - Kubernetes
  - Specific Environment Tips
  - Build Falco from Source
Operate
  - Upgrade
  - Falco Performance in Production

The steps to improve the documentation and the rationale are the following:

• Split Install and Operate into separate sections.
  split and operate are two different parts. Install contains day-1 tasks, while operate contains day-2 tasks.

• Add new "Introduction" sections
  the install section is one of the first sections that users go to. It is important to have an overview of Falco and discuss some central topics that apply to every installation. The "Operate" section will also need an introduction.

• Refactor Install, Running, and Deployment
  merging all steps for each type under the type (host, docker, Kubernetes) simplifies accessing the information you need and also navigating the documents. Deployment is a generic term that covers Kubernetes (so it should be renamed).

• Merge "Third Party Integrations" content into other sections
  the current content under this section is not about third-party integration, but about other environments (so it should be merged).

• Move Upgrade and Falco Performance to a separate entry
  as we said before, Operate should have day-2 tasks. For now, those are the two pages with day-2 content. We expect later expansion of this section later (e.g. troubleshooting).

• Rethink Learning and Production Environments
  this one is not set in stone as there are a few possibilities and we couldn't reach an agreement (please, let us know your thoughts). "Production Environments" is a misleading title for CoreOS, EKS, and GKE (every production environment is a production environment regardless of the infra). "Learning Environments" is not a great name either. Also, k3s, minikube, kind, EKS and GKE could be under Kubernetes. However, there might be more tips for specific environments in the future, such as open-shift. Shall we get rid of this page and merge the content into other pages or keep all tips in here?

/area documentation

[Andreagit97]

Thank you very much for the amazing proposal! I'm fully onboard!

-[ ] Refactor Install, Running, and Deployment
merging all steps for each type under the type (host, docker, Kubernetes) simplifies accessing the information you need and also navigating the documents. Deployment is a generic term that covers Kubernetes (so it should be renamed).

Just one side question/suggestion, why don't we use minikube+modern-ebpf as a unique example way to deploy Falco on Linux/Mac/Windows? I see here https://falco.org/docs/getting-started/falco-linux-quickstart/ that we have quite detailed steps for example with lima on Apple silicon (M1/M2), is there a particular reason for using lima?
If not, we could simplify the whole page, with a simple:

minikube start --driver=virtualbox 
helm install falco falcosecurity/falco \
    --set driver.kind=modern-bpf

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[poiana]

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

[poiana]

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Andreagit97]

/reopen

[poiana]

@Andreagit97: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Andreagit97]

/remove-lifecycle rotten

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[poiana]

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

[poiana]

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.