Add the ability to define custom LUA filters

Author: Michael Chmielewski

templates/configmap.yaml

@@ -16,3 +16,6 @@ data:
 {{- if .Values.daemonset.customTsAuditd }}
   custom-tsauditd-config: {{ toYaml .Values.daemonset.customTsAuditd | indent 4 }}
 {{- end }}
+{{- if .Values.daemonset.customLuaFilters }}
+  custom-luafilters-config: {{ toYaml .Values.daemonset.customLuaFilters | indent 4 }}
+{{- end }}

templates/daemonset.yaml

@@ -132,6 +132,11 @@ spec:
           - name: custom-tsauditd-config
             mountPath: /opt/threatstack/etc/tsauditd-custom.cfg
             subPath: tsauditd-custom.cfg
+{{- end }}
+{{- if .Values.daemonset.customLuaFilters }}
+          - name: custom-luafilters-config
+            mountPath: /opt/threatstack/etc/tsauditd-custom.lua
+            subPath: tsauditd-custom.lua
 {{- end }}
       volumes:
         - hostPath:
@@ -161,4 +166,12 @@ spec:
             items:
               - key: custom-tsauditd-config
                 path: tsauditd-custom.cfg
+{{- end }}
+{{- if .Values.daemonset.customLuaFilters }}
+        - name: custom-luafilters-config
+          configMap:
+            name: {{ include "threatstack-agent.name" . }}-config-args
+            items:
+              - key: custom-luafilters-config
+                path: tsauditd-custom.lua
 {{- end }}

values.yaml

@@ -223,3 +223,15 @@ daemonset:
   #     }
   #
   customTsAuditdConfig: ""
+
+  # Override this to provide custom lua filters to the agent.
+  # Make sure to use | to ensure the custom rules data is
+  # properly parsed and output.
+  #
+  # Example:
+  #   customLuaFilters: |
+  #     foo
+  #     bar
+  #     the end
+  #
+  customLuaFilters: ""