You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Traefik expects a resource of "Middleware" type named "bouncer", which we will create now.
33
+
34
+
Here is bouncer-middleware.yaml:
35
+
36
+
```yaml
37
+
apiVersion: traefik.io/v1alpha1
38
+
kind: Middleware
39
+
metadata:
40
+
name: bouncer
41
+
namespace: traefik
42
+
spec:
43
+
plugin:
44
+
bouncer:
45
+
enabled: true
46
+
crowdsecMode: stream
47
+
crowdsecLapiScheme: https
48
+
crowdsecLapiHost: crowdsec-service.crowdsec:8080
49
+
crowdsecLapiKey: mysecretkey12345
50
+
```
51
+
52
+
You can see all the configuration options in the [bouncer documentation](https://plugins.traefik.io/plugins/6335346ca4caa9ddeffda116/crowdsec-bouncer-traefik-plugin).
53
+
You can also refer to a [full traefik and CrowdSec stack on kubernetes](https://raw.githubusercontent.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/main/examples/kubernetes/README.md)
Copy file name to clipboardExpand all lines: crowdsec-docs/unversioned/getting_started/installation/kubernetes.mdx
+74-81Lines changed: 74 additions & 81 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,13 +12,17 @@ import CodeBlock from '@theme/CodeBlock';
12
12
13
13
# Kubernetes Deployment
14
14
15
-
Before getting started, it is advised to read the [introduction](/unversioned/getting_started/introduction.mdx) page to understand the prerequisites and concepts for running CrowdSec.
15
+
Before getting started, it is advised to read the
16
+
[introduction](/unversioned/getting_started/introduction.mdx) page to understand
17
+
the prerequisites and concepts for running CrowdSec.
Even if an installation could be possible without Helm, it's not documented for now.
25
+
22
26
## Helm Repository Installation
23
27
24
28
Add the CrowdSec helm repository to your Helm installation:
@@ -58,7 +62,33 @@ lapi:
58
62
value: "k8s linux test"
59
63
```
60
64
61
-
If you want more information about the configuration, you can check the default [values.yaml](https://artifacthub.io/packages/helm/crowdsec/crowdsec#values)
65
+
Acquisition is done by reading logs directly from pods. You select which pods to
66
+
watch thanks to `namespace` and `podName`, and you have to tag the logs with a
67
+
program so CrowdSec knows which parser should handle them. For example, if you
68
+
set program: nginx, the nginx parser will pick them up. CrowdSec will
69
+
automatically attach to the right pods and feed the logs into the right parsers.
70
+
71
+
<details>
72
+
<summary>Why `program` and not `type` ?</summary>
73
+
74
+
In standard standalone setups, documentation states that the labels should be
75
+
name `type` with the type being the parsed log program (eg nginx, traefik). A
76
+
transformation from `type` to `program` is done by the first stage parser
77
+
`crowdsecurity/syslog-logs`which is not relevant in a Kubernetes context.
78
+
</details>
79
+
80
+
<details>
81
+
<summary>How collections fit in kubernetes environment?</summary>
82
+
83
+
Collections are "recipes" for understanding logs; they don’t find pods on their
84
+
own. You choose which pods to read, and you tag those logs with a program (like
85
+
nginx or traefik). When the tag matches what a collection expects, its rules
86
+
run; if it doesn’t, they stay idle. One log stream can match several collections
87
+
if the tags fit.
88
+
</details>
89
+
90
+
If you want more information about the configuration, you can check the default
Traefik expects a resource of "Middleware" type named "bouncer", which we will create now.
180
+
Configuration those databases is out of scope of this documentation.
181
+
<!-- We want to create blogpost where we do it -->
128
182
129
-
Here is bouncer-middleware.yaml:
130
-
131
-
```yaml
132
-
apiVersion: traefik.io/v1alpha1
133
-
kind: Middleware
134
-
metadata:
135
-
name: bouncer
136
-
namespace: traefik
137
-
spec:
138
-
plugin:
139
-
bouncer:
140
-
enabled: true
141
-
crowdsecMode: stream
142
-
crowdsecLapiScheme: https
143
-
crowdsecLapiHost: crowdsec-service.crowdsec:8080
144
-
crowdsecLapiKey: mysecretkey12345
145
-
```
146
-
147
-
You can see all the configuration options in the [bouncer documentation](https://plugins.traefik.io/plugins/6335346ca4caa9ddeffda116/crowdsec-bouncer-traefik-plugin).
183
+
:::warning
148
184
149
-
Now, you can install the remediation component:
185
+
SQLite may be suitable for testing or low traffic clusters, but it is not
186
+
recommended for Kubernetes production deployments. Besides the lack of
187
+
replication, SQLite can also become a performance bottleneck under heavy load.
150
188
151
-
```bash
152
-
kubectl apply -f bouncer-middleware.yaml
153
-
```
154
-
155
-
#### Nginx
156
-
157
-
:::info
158
-
We supposed that you have already installed the Nginx ingress controller using this [helm chart](https://artifacthub.io/packages/helm/ingress-nginx/ingress-nginx).
159
189
:::
160
190
161
-
We need to patch ingress-nginx helm chart to add and enable [the crowdsec lua plugin](https://github.com/crowdsecurity/cs-openresty-bouncer).
162
-
You can put this configuration example in a file `crowdsec-ingress-nginx.yaml`:
Great, you now have CrowdSec installed on your system. Within the [post installation steps](/getting_started/next_steps.mdx) you will find the next steps to configure and optimize your installation.
193
+
Great, you now have CrowdSec installed on your system. Within the [post
194
+
installation steps](/getting_started/next_steps.mdx) you will find the next
195
+
steps to configure and optimize your installation.
0 commit comments