You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This project defines the helm chart to deploy the Threat Stack container agent in the recommended configuration for kubernetes.
7
10
@@ -30,13 +33,59 @@ The following kubernetes objects are created when the chart is installed:
30
33
* A ConfigMap will be created to store the Threat Stack agent's setup and runtime configuration options.
31
34
* Optionally a Pod Security Policy for clusters with strict pod admission control requirements.
32
35
33
-
### Installation
34
36
35
-
>>>
36
-
These instructions assume that you already have helm (and the server-side component tiller, if using helm 2) installed in your environment, and that any RBAC configuration for proper operation of helm has been completed.
37
-
>>>
38
37
39
-
#### Local Installation
38
+
## Values
39
+
40
+
| Key | Type | Default | Description |
41
+
|-----|------|---------|-------------|
42
+
| additionalSetupConfig | string |`""`| A list of command line arguments used when the agent container registers itself with the Threat Stack platform. See official documentation for details. |
| capabilities | string |`"[\"AUDIT_CONTROL\", \"SYS_ADMIN\", \"SYS_PTRACE\"]\n"`| Docker capabilites required for the proper operation of the agent |
50
+
| customDaemonsetCmd | object |`{}`| Uncomment the `command` and `args` sub-attributes, and define them as desired to run custom commands in the daemonset. |
| daemonset.priorityClassName | string |`""`| Optionally set the priority class name for the daemonset pods. Note that priority classes are not created via this helm chart. Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/|
| eksAmazon2 | bool |`false`| If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on EKS with Amazon Linux 2 nodes. Defaults to `false`|
| gkeContainerOs | bool |`false`| If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on GKE with ContainerOS node |
| gkeUbuntu | bool |`false`| If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on GKE with Ubuntu nodes. Defaults to `false`|
| image.repository | string |`"threatstack/ts-docker2"`| The docker repository for the container image to install. It defaults to Threat Stack's offical docker hub repository for the agent. **NOTE:** Changing this could lead to pulling an unofficial, incorrect, or incompatible image, and is strongly discouraged. |
80
+
| image.version | string |`""`| The docker tag for the container image to install. It defaults to Threat Stack's latest offical docker image version for the agent at the time the chart was released. **NOTE:** Changing this could lead to pulling an unofficial, incorrect, or incompatible image, and is strongly discouraged. >>> **Warning:** Setting `customDaemonsetCmd` improperly can result in the Threat Stack agent not running correctly >>> |
81
+
| imagePullSecrets | list |`[]`| If pulling the agent from a private/internal docker registry that requires credentials, you will need to add the name of your docker credentials secret to this array. *This secret needs to be defined outside of installing this helm chart.* Defaults to an empty array which will only work with public registries. * For more guidance with using private container registries, please review the following kubernetes documentation for details around how to set this upcorrectly with your registry service: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-accounthttps://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-by-providing-credentials-on-the-command-linehttps://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry|
82
+
| nameOverride | string |`""`||
83
+
| podSecurityPolicyEnabled | bool |`false`| Deploy Threat Stack with the Pod Security Policy for clusters with strict admission control requirements. |
84
+
| rbac.create | bool |`true`| If `true`, will create the needed service account to run. If false, the chart will leverage the service account defined in `rbac.serviceAccountName`|
| rulesets | string |`"Base Rule Set, Docker Rule Set, Kubernetes Rule Set"`| The list of Threat Stack rulesets that the againt container should run with. The single-quotes in the double-quotes are intentional and not optional. |
87
+
88
+
## Local Installation
40
89
41
90
The instructions below assume the helm chart has been released to a repository. Alternatively, you can clone this git repository and run `helm package .` in the repository's root to get a `.tgz` file built locally.
42
91
@@ -65,7 +114,7 @@ The threatstack agent helm chart follows the standard installation process for c
The following values settings for the helm chart are important to note, or expected to be modified for each target environment:
123
-
124
-
*`image.repository` :: The docker repository for the container image to install. It defaults to Threat Stack's offical docker hub repository for the agent. **NOTE:** Changing this could lead to pulling an unofficial, incorrect, or incompatible image, and is strongly discouraged.
125
-
* `image.version` :: The docker tag for the container image to install. It defaults to Threat Stack's latest offical docker image version for the agent at the time the chart was released. **NOTE:** Changing this could lead to pulling an unofficial, incorrect, or incompatible image, and is strongly discouraged.
126
-
*`gkeContainerOs` :: If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on GKE with ContainerOS nodes. Defaults to `false`
127
-
*`gkeUbuntu` :: If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on GKE with Ubuntu nodes. Defaults to `false`
128
-
*`eksAmazon2` :: If `true`, the Daemonset definition will be modified to execute commands for the agent to work correctly on EKS with Amazon Linux 2 nodes. Defaults to `false`
129
-
*`customDaemonsetCmd` :: Uncomment the `command` and `args` sub-attributes, and define them as desired to run custom commands in the daemonset.
130
-
>>>
131
-
**Warning:** Setting `customDaemonsetCmd` improperly can result in the Threat Stack agent not running correctly
132
-
>>>
133
-
*`rbac.create` :: If `true`, will create the needed service account to run. If false, the chart will leverage the service account defined in`rbac.serviceAccountName`
134
-
*`imagePullSecrets` :: If pulling the agent from a private/internal docker registry that requires credentials, you will need to add the name of your docker credentials secret to this array. *This secret needs to be defined outside of installing this helm chart.* Defaults to an empty array which will only work with public registries.
135
-
* For more guidance with using private container registries, please review the following kubernetes documentation for details around how to set this upcorrectly with your registry service:
* `rulesets` :: The list of Threat Stack rulesets that the againt container should run with. The single-quotes in the double-quotes are intentional and not optional.
140
-
*`additionalSetupConfig` :: A list of command line arguments used when the agent container registers itself with the Threat Stack platform. See official documentation for details.
141
-
*`additionalConfig` :: **(No longer supported)** This parameter has been replaced with `additionalRuntimeConfig`, which allows you to define configuration separately for the daemonset and the api-reader deployment with:
142
-
*`daemonset.additionalRuntimeConfig` :: Additional runtime configuration for the daemonset agents
143
-
*`apiReader.additionalRuntimeConfig` :: Additional runtime configuration for the api-reader deployment agent
144
-
*`podSecurityPolicyEnabled` :: If `true`, will create a pod security policy and configure the cluster role rules with that policy.
145
-
*`daemonset.priorityClassName` :: Optionally set the priority class name for the daemonset pods. Note that priority classes are not created via this helm chart.
146
-
*`daemonset.enableDocker` :: Defaults to `true`, configures the daemonset agents to listen to the docker daemon socket
147
-
*`daemonset.enableContainerd` :: Defaults to `false`, configures the daemonset agents to listen to the containerd daemon socket
148
-
149
-
#### Adding annotations to the Daemonset Pods
150
-
151
-
The following value can be configured as a map to add custom pod annotations (key/value pairs) to the agent daemonset.
152
-
153
-
*`daemonset.podAnnotations` :: Defaults to an empty hash
154
-
155
-
#### Overriding Container Daemon Socket Paths
156
-
157
-
There are three paths that get mounted into the container agent. They point to the default paths if not overridden. You can now override where to get these mounts from the underlying host with the following configuration:
158
-
159
-
*`daemonset.volumes.dockersocket.hostPath` :: Path to docker daemon's socket
160
-
* `daemonset.volumes.containerdsocket.hostPath` :: Path to containerd daemon's socket
161
-
*`daemonset.volumes.oldcontainerdsocket.hostPath` :: Path to older containerd daemon's socket
162
-
163
169
### Contributing enhancements/fixes
164
170
165
171
See the [CONTRIBUTING document](CONTRIBUTING.md) for details.
0 commit comments