Skip to content

Commit 445f3c0

Browse files
aroberts87mavimo
aroberts87
and
mavimo
authored
feat(agent): Add Local Forwarder support for Agent (#1458)
Co-authored-by: Marco Vito Moscaritolo <[email protected]>
1 parent cf079ae commit 445f3c0

File tree

10 files changed

+245
-4
lines changed

10 files changed

+245
-4
lines changed

‎charts/agent/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,4 @@ sources:
3030
- https://app.sysdigcloud.com/#/settings/user
3131
- https://github.com/draios/sysdig
3232
type: application
33-
version: 1.16.0
33+
version: 1.17.0

‎charts/agent/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,9 @@ The following table lists the configurable parameters of the Sysdig chart and th
153153
| `sysdig.disableCaptures` | Disables capture functionality. See https://docs.sysdig.com/en/disable-captures.html. | `false` |
154154
| `sysdig.settings` | Provides additional settings that are given in the `dragent.yaml`file. | `{}` |
155155
| `logPriority` | Sets both agent console and file logging priorities. Possible values are: `"info"`, `"debug"`. Mutually exclusive with `sysdig.settings.log`. | ` ` |
156+
| `localForwarder.enabled` | Enable the Agent Local Forwarder | `false` |
157+
| `localForwarder.transmitMessageTypes` | Message types to forward from the Agent to the Agent Local Forwarder | `[POLICY_EVENTS, SECURE_AUDIT]` |
158+
| `localForwarder.integrations` | List of configurations for how and where the Agent Local Forwarder should forward messages | `[]` |
156159
| `secure.enabled` | Enables Sysdig Secure. | `true` |
157160
| `monitor.enabled` | Enables Sysdig Monitor. | `true` |
158161
| `auditLog.enabled` | Enables Kubernetes audit log support for Sysdig Secure. | `false` |

‎charts/agent/templates/_helpers.tpl‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -506,3 +506,8 @@ sysdig_capture_enabled: false
506506
true
507507
{{- end }}
508508
{{- end }}
509+
510+
{{/* Return the name of the local forwarder configmap */}}
511+
{{- define "agent.localForwarderConfigMapName" }}
512+
{{- include "agent.configmapName" . | trunc 46 | trimSuffix "-" | printf "%s-local-forwarder" }}
513+
{{- end }}

‎charts/agent/templates/configmap-local-forwarder.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if .Values.localForwarder.enabled }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "agent.localForwarderConfigMapName" . }}
6+
namespace: {{ include "agent.namespace" . }}
7+
labels:
8+
{{ (include "agent.labels" .) | indent 4 }}
9+
data:
10+
local_forwarder_config.yaml: |
11+
integrations:
12+
{{- toYaml .Values.localForwarder.integrations | nindent 6 }}
13+
{{- end }}

‎charts/agent/templates/configmap.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,12 @@ data:
4545
enforce_leader_election: true
4646
namespace: {{ include "agent.namespace" . }}
4747
{{- end }}
48+
{{- if .Values.localForwarder.enabled }}
49+
local_forwarder:
50+
enabled: true
51+
transmit_message_types:
52+
{{- toYaml .Values.localForwarder.transmitMessageTypes | nindent 8 }}
53+
{{- end }}
4854
{{- if .Values.prometheus.file }}
4955
prometheus.yaml: |
5056
{{ toYaml .Values.prometheus.yaml | indent 4 }}

‎charts/agent/templates/daemonset.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,11 @@ spec:
223223
command: [ "test", "-e", "/opt/draios/logs/running" ]
224224
initialDelaySeconds: {{ .Values.daemonset.probes.initialDelay }}
225225
volumeMounts:
226+
{{- if .Values.localForwarder.enabled }}
227+
- mountPath: /opt/draios/etc/local_forwarder_config.yaml
228+
subPath: local_forwarder_config.yaml
229+
name: local-forwarder-config
230+
{{- end }}
226231
{{- /* Always requested */}}
227232
- mountPath: /host/dev
228233
name: dev-vol
@@ -344,6 +349,12 @@ spec:
344349
configMap:
345350
name: {{ include "agent.configmapName" . }}
346351
optional: true
352+
{{- if .Values.localForwarder.enabled }}
353+
- name: local-forwarder-config
354+
configMap:
355+
name: {{ include "agent.localForwarderConfigMapName" . }}
356+
optional: true
357+
{{- end }}
347358
- name: sysdig-agent-secrets
348359
secret:
349360
{{- if not ( include "agent.accessKeySecret" . ) }}

‎charts/agent/tests/local_forwarder_test.yaml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
suite: Test enabling the agent local forwarder
2+
templates:
3+
- configmap.yaml
4+
- configmap-local-forwarder.yaml
5+
- daemonset.yaml
6+
tests:
7+
- it: Check the enabling the forwarder
8+
set:
9+
localForwarder:
10+
enabled: true
11+
integrations:
12+
- channels:
13+
- SECURE_EVENTS_POLICIES
14+
- ACTIVITY_AUDIT
15+
configuration:
16+
output: stdout
17+
type: LOCAL
18+
asserts:
19+
- equal:
20+
path: data["local_forwarder_config.yaml"]
21+
value: |
22+
integrations:
23+
- channels:
24+
- SECURE_EVENTS_POLICIES
25+
- ACTIVITY_AUDIT
26+
configuration:
27+
output: stdout
28+
type: LOCAL
29+
template: configmap-local-forwarder.yaml
30+
- matchRegex:
31+
path: data["dragent.yaml"]
32+
pattern: |
33+
local_forwarder:
34+
enabled: true
35+
transmit_message_types:
36+
- POLICY_EVENTS
37+
- SECURE_AUDIT
38+
template: configmap.yaml
39+
- contains:
40+
path: spec.template.spec.volumes
41+
content:
42+
name: local-forwarder-config
43+
configMap:
44+
name: sysdig-agent-local-forwarder
45+
optional: true
46+
template: daemonset.yaml
47+
- contains:
48+
path: spec.template.spec.containers[0].volumeMounts
49+
content:
50+
mountPath: /opt/draios/etc/local_forwarder_config.yaml
51+
subPath: local_forwarder_config.yaml
52+
name: local-forwarder-config
53+
template: daemonset.yaml
54+
- it: Ensure items are absent if local forwarder is disabled
55+
set:
56+
localForwarder:
57+
enabled: false
58+
asserts:
59+
- notMatchRegex:
60+
path: data["dragent.yaml"]
61+
pattern: |
62+
local_forwarder:
63+
enabled: true
64+
transmit_message_types:
65+
- POLICY_EVENTS
66+
- SECURE_AUDIT
67+
template: configmap.yaml
68+
- notContains:
69+
path: spec.template.spec.volumes
70+
content:
71+
name: local-forwarder-config
72+
configMap:
73+
name: sysdig-agent-local-forwarder
74+
optional: true
75+
template: daemonset.yaml
76+
- notContains:
77+
path: spec.template.spec.containers[0].volumeMounts
78+
content:
79+
mountPath: /opt/draios/etc/local_forwarder_config.yaml
80+
subPath: local_forwarder_config.yaml
81+
name: local-forwarder-config
82+
template: daemonset.yaml
83+
- it: Customize the forwarded message types
84+
set:
85+
localForwarder:
86+
enabled: true
87+
transmitMessageTypes:
88+
- POLICY_EVENTS
89+
integrations:
90+
- channels:
91+
- SECURE_EVENTS_POLICIES
92+
- ACTIVITY_AUDIT
93+
configuration:
94+
output: stdout
95+
type: LOCAL
96+
asserts:
97+
- matchRegex:
98+
path: data["dragent.yaml"]
99+
pattern: |
100+
local_forwarder:
101+
enabled: true
102+
transmit_message_types:
103+
- POLICY_EVENTS
104+
template: configmap.yaml

‎charts/agent/values.schema.json‎

Lines changed: 94 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
"$schema": "http://json-schema.org/schema#",
33
"type": "object",
44
"required": [
5-
"ebpf"
5+
"ebpf",
6+
"localForwarder"
67
],
78
"properties": {
89
"ebpf": {
@@ -23,6 +24,98 @@
2324
]
2425
}
2526
}
27+
},
28+
"localForwarder": {
29+
"type": "object",
30+
"required": [
31+
"enabled",
32+
"integrations",
33+
"transmitMessageTypes"
34+
],
35+
"if": {
36+
"properties": {
37+
"enabled": {
38+
"const": true
39+
}
40+
}
41+
},
42+
"then": {
43+
"properties": {
44+
"integrations": {
45+
"type": "array",
46+
"minItems": 1,
47+
"items": {
48+
"$ref": "#/$defs/AgentLocalForwarderIntegrations"
49+
}
50+
},
51+
"enabled": {
52+
"type": "boolean"
53+
},
54+
"transmitMessageTypes": {
55+
"type": "array",
56+
"items": {
57+
"type": "string",
58+
"enum": [
59+
"POLICY_EVENTS",
60+
"SECURE_AUDIT"
61+
]
62+
}
63+
}
64+
}
65+
}
66+
}
67+
},
68+
"$defs": {
69+
"AgentLocalForwarderIntegrations": {
70+
"type": "object",
71+
"required": [
72+
"channels",
73+
"configuration"
74+
],
75+
"properties": {
76+
"channels": {
77+
"type": "array",
78+
"items": {
79+
"type": "string",
80+
"enum": [
81+
"POLICY_EVENTS",
82+
"ACTIVITY_AUDIT",
83+
"MONITOR_EVENTS",
84+
"SECURE_EVENTS_POLICIES",
85+
"SECURE_EVENTS_SCANNING",
86+
"SECURE_EVENTS_BENCHMARK",
87+
"SECURE_EVENTS_HOSTSCANNING",
88+
"SECURE_EVENTS_COMPLIANCE",
89+
"SECURE_EVENTS_AUDIT_TRAIL",
90+
"SECURE_OBJECT_STORE_RUNTIME",
91+
"SECURE_OBJECT_STORE_REGISTRY",
92+
"SECURE_OBJECT_STORE_PIPELINE"
93+
]
94+
}
95+
},
96+
"configuration": {
97+
"type": "object"
98+
},
99+
"type": {
100+
"type": "string",
101+
"enum": [
102+
"SYSLOG",
103+
"SPLUNK",
104+
"MCM",
105+
"QRADAR",
106+
"WEBHOOK",
107+
"KAFKA",
108+
"CHRONICLE",
109+
"SENTINEL",
110+
"SQS",
111+
"PUBSUB",
112+
"SCC",
113+
"LOCAL",
114+
"ELASTIC",
115+
"S3"
116+
]
117+
}
118+
}
26119
}
27120
}
28121
}

‎charts/agent/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,12 @@ tolerations:
280280
value: "true"
281281
leaderelection:
282282
enable: false
283+
localForwarder:
284+
enabled: false
285+
transmitMessageTypes:
286+
- POLICY_EVENTS
287+
- SECURE_AUDIT
288+
integrations: []
283289
delegatedAgentDeployment:
284290
# Enable a specialized installation where an Agent Deployment is installed
285291
# in addition to the traditional DaemonSet. The DaemonSet Agents will not

‎charts/sysdig-deploy/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: sysdig-deploy
33
description: A chart with various Sysdig components for Kubernetes
44
type: application
5-
version: 1.30.1
5+
version: 1.31.0
66
maintainers:
77
- name: AlbertoBarba
88
email: [email protected]
@@ -26,7 +26,7 @@ dependencies:
2626
- name: agent
2727
# repository: https://charts.sysdig.com
2828
repository: file://../agent
29-
version: ~1.16.0
29+
version: ~1.17.0
3030
alias: agent
3131
condition: agent.enabled
3232
- name: common

0 commit comments

Comments
 (0)