Skip to content

Commit 75b2c66

Browse files
authored
Merge pull request #28 from danquack/docs
migrate bullets to table
2 parents aff34c0 + 0ae18b5 commit 75b2c66

File tree

1 file changed

+63
-51
lines changed

1 file changed

+63
-51
lines changed

README.md

Lines changed: 63 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
Threat Stack Agent Helm Chart
22
=============================
33

4-
### Overview
4+
![Release Version](https://img.shields.io/github/v/release/threatstack/threatstack-helm)
5+
6+
7+
## Overview
58

69
This project defines the helm chart to deploy the Threat Stack container agent in the recommended configuration for kubernetes.
710

@@ -30,13 +33,59 @@ The following kubernetes objects are created when the chart is installed:
3033
* A ConfigMap will be created to store the Threat Stack agent's setup and runtime configuration options.
3134
* Optionally a Pod Security Policy for clusters with strict pod admission control requirements.
3235

33-
### Installation
3436

35-
>>>
36-
These instructions assume that you already have helm (and the server-side component tiller, if using helm 2) installed in your environment, and that any RBAC configuration for proper operation of helm has been completed.
37-
>>>
3837

39-
#### Local Installation
38+
## Values
39+
40+
| Key | Type | Default | Description |
41+
|-----|------|---------|-------------|
42+
| additionalSetupConfig | string | `""` | A list of command line arguments used when the agent container registers itself with the Threat Stack platform. See official documentation for details. |
43+
| agentDeployKey | string | `""` | |
44+
| agentSetupExternalSecretRef | object | `{}` | |
45+
| apiReader.additionalRuntimeConfig | string | `"log.level info"` | |
46+
| apiReader.affinity | object | `{}` | |
47+
| apiReader.nodeSelector | object | `{}` | |
48+
| apiReader.tolerations | list | `[]` | |
49+
| capabilities | string | `"[\"AUDIT_CONTROL\", \"SYS_ADMIN\", \"SYS_PTRACE\"]\n"` | Docker capabilites required for the proper operation of the agent |
50+
| customDaemonsetCmd | object | `{}` | Uncomment the `command` and `args` sub-attributes, and define them as desired to run custom commands in the daemonset. |
51+
| daemonset.additionalRuntimeConfig | string | `"log.level info"` | |
52+
| daemonset.affinity | object | `{}` | |
53+
| daemonset.customAuditRules | string | `""` | |
54+
| daemonset.customLuaFilter | string | `""` | |
55+
| daemonset.customTsAuditdConfig | string | `""` | |
56+
| daemonset.enableContainerd | bool | `false` | Defaults to `false`, configures the daemonset agents to listen to the containerd daemon socket |
57+
| daemonset.enableDocker | bool | `true` | Defaults to `true`, configures the daemonset agents to listen to the docker daemon socket |
58+
| daemonset.nodeSelector | object | `{}` | |
59+
| daemonset.podAnnotations."container.apparmor.security.beta.kubernetes.io/threatstack-agent" | string | `"unconfined"` | |
60+
| daemonset.priorityClassName | string | `""` | Optionally set the priority class name for the daemonset pods. Note that priority classes are not created via this helm chart. Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ |
61+
| daemonset.tolerations | list | `[]` | |
62+
| daemonset.volumes.containerdsocket.hostPath | string | `"/run/containerd/containerd.sock"` | Path to docker daemon's socket |
63+
| daemonset.volumes.dockersocket.hostPath | string | `"/var/run/docker.sock"` | Path to docker daemon's socket |
64+
| daemonset.volumes.oldcontainerdsocket.hostPath | string | `"/var/run/docker/containerd/docker-containerd.sock"` | Path to older containerd daemon's socket |
65+
| eksAmazon2 | bool | `false` | If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on EKS with Amazon Linux 2 nodes. Defaults to `false` |
66+
| eksAmazon2Cmd.args[0] | string | `"-c"` | |
67+
| eksAmazon2Cmd.args[1] | string | `"chroot /threatstackfs /bin/bash -c 'service auditd stop; systemctl disable auditd'; eval tsagent setup $THREATSTACK_SETUP_ARGS; eval tsagent config --set $THREATSTACK_CONFIG_ARGS; sleep 5; /opt/threatstack/sbin/tsagentd -logstdout"` | |
68+
| eksAmazon2Cmd.command[0] | string | `"bash"` | |
69+
| fullnameOverride | string | `""` | |
70+
| gkeContainerOs | bool | `false` | If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on GKE with ContainerOS node |
71+
| gkeContainerOsCmd.args[0] | string | `"-c"` | |
72+
| gkeContainerOsCmd.args[1] | string | `"chroot /threatstackfs /bin/bash -c 'systemctl stop systemd-journald-audit.socket; systemctl mask systemd-journald-audit.socket; systemctl restart systemd-journald; auditctl --backlog_wait_time 0'; eval tsagent setup $THREATSTACK_SETUP_ARGS; eval tsagent config --set $THREATSTACK_CONFIG_ARGS; sleep 5; /opt/threatstack/sbin/tsagentd -logstdout"` | |
73+
| gkeContainerOsCmd.command[0] | string | `"bash"` | |
74+
| gkeUbuntu | bool | `false` | If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on GKE with Ubuntu nodes. Defaults to `false` |
75+
| gkeUbuntuCmd.args[0] | string | `"-c"` | |
76+
| gkeUbuntuCmd.args[1] | string | `"chroot /threatstackfs /bin/bash -c 'systemctl stop auditd; systemctl disable auditd'; eval tsagent setup $THREATSTACK_SETUP_ARGS; eval tsagent config --set $THREATSTACK_CONFIG_ARGS; sleep 5; /opt/threatstack/sbin/tsagentd -logstdout"` | |
77+
| gkeUbuntuCmd.command[0] | string | `"bash"` | |
78+
| image.pullPolicy | string | `"Always"` | |
79+
| image.repository | string | `"threatstack/ts-docker2"` | The docker repository for the container image to install. It defaults to Threat Stack's offical docker hub repository for the agent. **NOTE:** Changing this could lead to pulling an unofficial, incorrect, or incompatible image, and is strongly discouraged. |
80+
| image.version | string | `""` | The docker tag for the container image to install. It defaults to Threat Stack's latest offical docker image version for the agent at the time the chart was released. **NOTE:** Changing this could lead to pulling an unofficial, incorrect, or incompatible image, and is strongly discouraged. >>> **Warning:** Setting `customDaemonsetCmd` improperly can result in the Threat Stack agent not running correctly >>> |
81+
| imagePullSecrets | list | `[]` | If pulling the agent from a private/internal docker registry that requires credentials, you will need to add the name of your docker credentials secret to this array. *This secret needs to be defined outside of installing this helm chart.* Defaults to an empty array which will only work with public registries. * For more guidance with using private container registries, please review the following kubernetes documentation for details around how to set this upcorrectly with your registry service: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-by-providing-credentials-on-the-command-line https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry |
82+
| nameOverride | string | `""` | |
83+
| podSecurityPolicyEnabled | bool | `false` | Deploy Threat Stack with the Pod Security Policy for clusters with strict admission control requirements. |
84+
| rbac.create | bool | `true` | If `true`, will create the needed service account to run. If false, the chart will leverage the service account defined in `rbac.serviceAccountName` |
85+
| rbac.serviceAccountName | string | `"threatstack-agent"` | |
86+
| rulesets | string | `"Base Rule Set, Docker Rule Set, Kubernetes Rule Set"` | The list of Threat Stack rulesets that the againt container should run with. The single-quotes in the double-quotes are intentional and not optional. |
87+
88+
## Local Installation
4089

4190
The instructions below assume the helm chart has been released to a repository. Alternatively, you can clone this git repository and run `helm package .` in the repository's root to get a `.tgz` file built locally.
4291

@@ -65,7 +114,7 @@ The threatstack agent helm chart follows the standard installation process for c
65114
> helm install <HELM_RELEASE_NAME> --values ./<values-override-filename>.yaml threatstack/threatstack-agent
66115
```
67116

68-
#### Updating the chart
117+
## Updating the chart
69118

70119
After making changes, run:
71120

@@ -79,7 +128,7 @@ After making changes, run:
79128
> helm delete <HELM_RELEASE_NAME>
80129
```
81130

82-
#### Additional Installation Notes
131+
## Additional Installation Notes
83132

84133
There is one chart values setting, `agentDeployKey`, that is not defined in the default chart `values.yaml`. The reason is two-fold:
85134

@@ -117,53 +166,16 @@ The value defined in the secret by `agentSetupExternalSecretRef.name`/`agentSetu
117166
--deploy-key <your-deploy-key> --ruleset '<your-rulesets>' <additional-setup-configuration>"
118167
```
119168
120-
#### Important Configuration Settings
121-
122-
The following values settings for the helm chart are important to note, or expected to be modified for each target environment:
123-
124-
* `image.repository` :: The docker repository for the container image to install. It defaults to Threat Stack's offical docker hub repository for the agent. **NOTE:** Changing this could lead to pulling an unofficial, incorrect, or incompatible image, and is strongly discouraged.
125-
* `image.version` :: The docker tag for the container image to install. It defaults to Threat Stack's latest offical docker image version for the agent at the time the chart was released. **NOTE:** Changing this could lead to pulling an unofficial, incorrect, or incompatible image, and is strongly discouraged.
126-
* `gkeContainerOs` :: If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on GKE with ContainerOS nodes. Defaults to `false`
127-
* `gkeUbuntu` :: If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on GKE with Ubuntu nodes. Defaults to `false`
128-
* `eksAmazon2` :: If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on EKS with Amazon Linux 2 nodes. Defaults to `false`
129-
* `customDaemonsetCmd` :: Uncomment the `command` and `args` sub-attributes, and define them as desired to run custom commands in the daemonset.
130-
>>>
131-
**Warning:** Setting `customDaemonsetCmd` improperly can result in the Threat Stack agent not running correctly
132-
>>>
133-
* `rbac.create` :: If `true`, will create the needed service account to run. If false, the chart will leverage the service account defined in `rbac.serviceAccountName`
134-
* `imagePullSecrets` :: If pulling the agent from a private/internal docker registry that requires credentials, you will need to add the name of your docker credentials secret to this array. *This secret needs to be defined outside of installing this helm chart.* Defaults to an empty array which will only work with public registries.
135-
* For more guidance with using private container registries, please review the following kubernetes documentation for details around how to set this upcorrectly with your registry service:
136-
* https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
137-
* https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-by-providing-credentials-on-the-command-line
138-
* https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry
139-
* `rulesets` :: The list of Threat Stack rulesets that the againt container should run with. The single-quotes in the double-quotes are intentional and not optional.
140-
* `additionalSetupConfig` :: A list of command line arguments used when the agent container registers itself with the Threat Stack platform. See official documentation for details.
141-
* `additionalConfig` :: **(No longer supported)** This parameter has been replaced with `additionalRuntimeConfig`, which allows you to define configuration separately for the daemonset and the api-reader deployment with:
142-
* `daemonset.additionalRuntimeConfig` :: Additional runtime configuration for the daemonset agents
143-
* `apiReader.additionalRuntimeConfig` :: Additional runtime configuration for the api-reader deployment agent
144-
* `podSecurityPolicyEnabled` :: If `true`, will create a pod security policy and configure the cluster role rules with that policy.
145-
* `daemonset.priorityClassName` :: Optionally set the priority class name for the daemonset pods. Note that priority classes are not created via this helm chart.
146-
* `daemonset.enableDocker` :: Defaults to `true`, configures the daemonset agents to listen to the docker daemon socket
147-
* `daemonset.enableContainerd` :: Defaults to `false`, configures the daemonset agents to listen to the containerd daemon socket
148-
149-
#### Adding annotations to the Daemonset Pods
150-
151-
The following value can be configured as a map to add custom pod annotations (key/value pairs) to the agent daemonset.
152-
153-
* `daemonset.podAnnotations` :: Defaults to an empty hash
154-
155-
#### Overriding Container Daemon Socket Paths
156-
157-
There are three paths that get mounted into the container agent. They point to the default paths if not overridden. You can now override where to get these mounts from the underlying host with the following configuration:
158-
159-
* `daemonset.volumes.dockersocket.hostPath` :: Path to docker daemon's socket
160-
* `daemonset.volumes.containerdsocket.hostPath` :: Path to containerd daemon's socket
161-
* `daemonset.volumes.oldcontainerdsocket.hostPath` :: Path to older containerd daemon's socket
162-
163169
### Contributing enhancements/fixes
164170
165171
See the [CONTRIBUTING document](CONTRIBUTING.md) for details.
166172
167173
### Licensing
168174
169175
See the [LICENSE](LICENSE)
176+
177+
### Maintainers
178+
179+
| Name | Email | Url |
180+
| ---- | ------ | --- |
181+
| Threat Stack Inc. | [email protected] | |

0 commit comments

Comments
 (0)