@@ -61,6 +61,8 @@ global:
6161 existingCaConfigMap : null
6262 # Provide the filename that is defined inside the existing ConfigMap
6363 existingCaConfigMapKeyName : null
64+
65+
6466cluster_shield :
6567 cluster_config :
6668 # The name of the cluster. Make sure to set a unique value for all the
@@ -83,9 +85,11 @@ cluster_shield:
8385 # Region name for Sysdig.
8486 # When no region is suitable (e.g. on-premise installations) set the value to "custom"
8587 region :
88+
8689 kubernetes :
8790 # The system namespace of your Kubernetes cluster
8891 root_namespace : kube-system
92+
8993 # Features
9094 features :
9195 admission_control :
@@ -142,6 +146,7 @@ cluster_shield:
142146 posture :
143147 # Enable the posture feature
144148 enabled : false
149+
145150 container_vulnerability_management :
146151 # Enable the container vulnerability management feature
147152 enabled : false
@@ -168,24 +173,29 @@ cluster_shield:
168173 # If set to false it allows insecure connections to registries,
169174 # Such as for registries with self-signed or private certificates.
170175 verify : true
176+
171177 investigations :
172178 network_security :
173179 # Enable the network security feature
174180 enabled : false
181+
175182 kubernetes_metadata :
176183 # Enable the Kubernetes Metadata feature
177184 enabled : false
185+
178186 respond :
179187 # Enable the responder feature
180188 response_actions :
181189 enabled : false
190+
182191 monitor :
183192 kube_state_metrics :
184193 # Enable the Kubernetes State Metrics feature
185194 enabled : false
186195 kubernetes_events :
187196 # Enable the Kubernetes Events feature
188197 enabled : false
198+
189199ca :
190200 # A PEM-encoded x509 certificate. This can also be a bundle with multiple certificates.
191201 certs : []
@@ -207,25 +217,29 @@ ca:
207217 existingCaConfigMap : null
208218 # Provide the filename that is defined inside the existing ConfigMap
209219 existingCaConfigMapKeyName : null
220+
210221# The command executed by the Cluster Shield POD
211222run_command : " run-all-namespaced"
223+
212224image :
213225 # The Sysdig Registry Scanner image registry.
214226 registry : quay.io
215227 # The Cluster Shield container image repository
216228 repository : sysdig/cluster-shield
217229 # The Cluster Shield container image pull policy
218230 pullPolicy :
231+
219232proxy :
220233 # Sets the HTTP Proxy address.
221234 httpProxy :
222235 # Sets the HTTPS Proxy address.
223236 httpsProxy :
224237 # Sets IPs/URLs that should not pass trough a Proxy Server.
225238 noProxy :
239+
226240# The Cluster Shield container image pull secrets
227241imagePullSecrets : []
228- # - name: regcred
242+ # - name: regcred
229243
230244probes :
231245 liveness :
@@ -238,10 +252,12 @@ probes:
238252 initialDelaySeconds : 10
239253 # The readiness probe period
240254 periodSeconds : 5
255+
241256# Additional pod annotations
242257podAnnotations : {}
243258# Additional pod labels
244259podLabels : {}
260+
245261service :
246262 # The Cluster Shield service type
247263 type : ClusterIP
@@ -255,6 +271,7 @@ service:
255271 labels : {}
256272 # Additional service annotations
257273 annotations : {}
274+
258275serviceAccount :
259276 # Specifies whether a service account should be created
260277 create : true
@@ -264,37 +281,44 @@ serviceAccount:
264281 labels : {}
265282 # Additional service account annotations
266283 annotations : {}
284+
267285resources : {}
268- # We usually recommend not to specify default resources and to leave this as a conscious
269- # choice for the user. This also increases chances charts run on environments with little
270- # resources, such as Minikube. If you do want to specify resources, uncomment the following
271- # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
272- # limits:
273- # cpu: 100m
274- # memory: 128Mi
275- # requests:
276- # cpu: 100m
277- # memory: 128Mi
286+ # We usually recommend not to specify default resources and to leave this as a conscious
287+ # choice for the user. This also increases chances charts run on environments with little
288+ # resources, such as Minikube. If you do want to specify resources, uncomment the following
289+ # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
290+ # limits:
291+ # cpu: 100m
292+ # memory: 128Mi
293+ # requests:
294+ # cpu: 100m
295+ # memory: 128Mi
278296
279297# Set Cluster Shield deployment priorityClassName
280298priorityClassName :
281299# Specifies whether a PriorityClass should be created
282300createPriorityClass : false
283301# Set Cluster Shield deployment priorityClassValue
284302priorityClassValue : 10
303+
285304# Node labels for pod assignment
286305nodeSelector : {}
306+
287307# Tolerations for pod assignment
288308tolerations : []
309+
289310# Affinity for pod assignment
290311affinity : {}
312+
291313# The number of replicas for the Cluster Shield deployment
292314replicaCount : 2
315+
293316updateStrategy :
294317 # The update strategy for the Cluster Shield deployment
295318 type : RollingUpdate
296319 # The rolling update strategy for the Cluster Shield deployment
297320 rollingUpdate : {}
321+
298322# Optional parameter used to check the compatibility of cluster-shield
299323# component versions with the on-premised backend version.
300324#
@@ -303,12 +327,15 @@ updateStrategy:
303327#
304328# If you are runinng on SaaS, do NOT provide this parameter.
305329onPremCompatibilityVersion :
330+
306331# Specifies if Cluster Shield should be started in hostNetwork mode.
307332# This field is required if you are using a custom CNI where the control plane nodes are unable to initiate
308333# network connections to the pods, for example, using Calico CNI plugin on EKS.
309334hostNetwork : false
335+
310336# Define Cluster Shield Pods DNS Policy
311337dnsPolicy :
338+
312339existingTLSSecret :
313340 # Provide the name of an existing Secret that contains the TLS certificate required
314341 name :
@@ -318,22 +345,23 @@ existingTLSSecret:
318345 tlsCertKeyName :
319346 # Provide the certificate authority filename that is defined inside the existing Secret (default ca.crt)
320347 caCertName :
348+
321349# Optional parameter used to add environment variables to the Cluster Shield pods
322350env : []
323- # - name: MY_ENV_VAR
324- # value: my-env-var-value
351+ # - name: MY_ENV_VAR
352+ # value: my-env-var-value
325353
326354# Optional parameter to specify additional host volumes for the Cluster Shield pods
327355volumes : []
328- # - name: my-volume
329- # hostPath:
330- # path: /path/to/host/folder
356+ # - name: my-volume
357+ # hostPath:
358+ # path: /path/to/host/folder
331359
332360# Optional parameter to specify additional volume mounts for the Cluster Shield pods
333361volumeMounts : []
334- # - name: my-volume
335- # mountPath: /host/path/to/mount/folder
336- # readOnly: true
362+ # - name: my-volume
363+ # mountPath: /host/path/to/mount/folder
364+ # readOnly: true
337365
338366# Define Pod Disruption Budget
339367podDisruptionBudget :
0 commit comments