values.yaml

# MIT License
#
# Copyright (c) 2020-2023 F5, Inc.
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
#######

### Overriding default helm chart/kubernetes object names
nameOverride: ""
fullnameOverride: ""
imagePullSecrets: []

## Set the appropriate variable to true for your node OS type, if running on GKE
## NOTE: DO NOT MODIFY THESE! If you want custom commands, use the`customDaemonsetCmd` attributes

# Using ContainerOS nodes
gkeContainerOs: false
gkeContainerOsCmd:
  command: ["bash"]
  args:
    - -c
    - >-
        chroot /threatstackfs /bin/bash -c 'systemctl stop systemd-journald-audit.socket;
        systemctl mask systemd-journald-audit.socket;
        systemctl restart systemd-journald; auditctl --backlog_wait_time 0' ;
        eval tsagent setup --deploy-key $THREATSTACK_SETUP_DEPLOY_KEY $THREATSTACK_SETUP_ARGS;
        eval tsagent config --set $THREATSTACK_CONFIG_ARGS;
        sleep 5;
        unset THREATSTACK_SETUP_DEPLOY_KEY THREATSTACK_SETUP_ARGS THREATSTACK_CONFIG_ARGS;
        exec /opt/threatstack/sbin/tsagentd -logstdout=1

# Using Ubuntu nodes
gkeUbuntu: false
gkeUbuntuCmd:
  command: ["bash"]
  args:
    - -c
    - >-
        chroot /threatstackfs /bin/bash -c 'systemctl stop auditd';
        eval tsagent setup --deploy-key $THREATSTACK_SETUP_DEPLOY_KEY $THREATSTACK_SETUP_ARGS;
        eval tsagent config --set $THREATSTACK_CONFIG_ARGS;
        sleep 5;
        unset THREATSTACK_SETUP_DEPLOY_KEY THREATSTACK_SETUP_ARGS THREATSTACK_CONFIG_ARGS;
        exec /opt/threatstack/sbin/tsagentd -logstdout=1

# Using EKS Amazon Linux 2 nodes
eksAmazon2: false
eksAmazon2Cmd:
  command: ["bash"]
  args:
    - -c
    - >-
        chroot /threatstackfs /bin/bash -c 'service auditd stop';
        eval tsagent setup --deploy-key $THREATSTACK_SETUP_DEPLOY_KEY $THREATSTACK_SETUP_ARGS;
        eval tsagent config --set $THREATSTACK_CONFIG_ARGS;
        sleep 5;
        unset THREATSTACK_SETUP_DEPLOY_KEY THREATSTACK_SETUP_ARGS THREATSTACK_CONFIG_ARGS;
        exec /opt/threatstack/sbin/tsagentd -logstdout=1

# Uncomment the command and args sub-attributes, and define them as desired to run custom commands in the Daemonset.
#
# Important:
# Setting customDaemonsetCmd improperly can result in the Threat Stack Agent not running correctly.
# This example turns off and disables auditd running on the host so the container agent can properly monitor activity
customDaemonsetCmd: {}
  # command: ["bash"]
  # args:
  #   - -c
  #   - >-
  #       chroot /threatstackfs /bin/bash -c 'service auditd stop >/dev/null || systemctl stop auditd;
  #       systemctl disable auditd' &&
  #       eval tsagent setup --deploy-key $THREATSTACK_SETUP_DEPLOY_KEY $THREATSTACK_SETUP_ARGS &&
  #       eval tsagent config --set $THREATSTACK_CONFIG_ARGS &&
  #       sleep 5 &&
  #       unset THREATSTACK_SETUP_DEPLOY_KEY THREATSTACK_SETUP_ARGS THREATSTACK_CONFIG_ARGS &&
  #       exec /opt/threatstack/sbin/tsagentd -logstdout=1

# Using OpenShift
#
# If you are using OpenShift, and set this value to true, the Daemonset will increase it's memory limit to `1Gi`
#
# Important: Make sure to set the privileged attribute to `true` in the DaemonSet's securityContext configuration below
openShift: false

# Use ebpf monitoring where applicable
# Enabling this setting has been observed to cause an increase in resource usage by the agent with some workloads,
# so you may need to increase cpu and/or memory limits when enabling eBPF sensors
ebpfEnabled: false

### Default values for threatstack-agent chart
image:
  repository: threatstack/ts-docker2
  version: ""
  pullPolicy: Always

### RBAC and namespacing settings for release
# create              :: If `true`, the chart will generate a service account
# serviceAccountName  :: If `rbac.create` is set to `false`, use this as the service account name
rbac:
  create: true
  serviceAccountName: "threatstack-agent"

### Threat Stack Agent settings
#
# rulesets              :: Define what rules will be applied to the agent by default
# additionalSetupConfig :: Additional parameters passed to the backend during initial agent registration
# capabilities          :: Docker capabilites required for the proper operation of the agent
rulesets: "Base Rule Set, Docker Rule Set, Kubernetes Rule Set"
additionalSetupConfig: ""
capabilities:
  - AUDIT_CONTROL
  - SYS_ADMIN
  - SYS_PTRACE
  - SYS_NICE

#####
# WARNING!
#
# Do not store the deploy key in a source control system!
# Pass this in via an addditional values yaml file when installing this helm chart
#
# Example: `helm install --name threatstack-agent -f values.yaml -f overriding-deploy-key.yaml threatstack-agent`
#
#####
agentDeployKey: ""

#####
#
# Alterntatively, define your own secret, and put the secret's name/key in the child values
#
######
agentSetupExternalSecretRef: {}
  # name: ""
  # key: ""

#####
#
# Deploy Threat Stack with the Pod Security Policy for clusters with
# strict admission control requirements.
#
#####
podSecurityPolicyEnabled: false

########
#
# API Server reader Deployment settings
#
# This section configures a single-instance ReplicaSet threatstack-agent pod
#
# The pod makes requests to kubernetes api-server to retrieve information
# on the state of the cluster.
#
# NOTE: This pod DOES NOT monitor its node activity.
#
########
apiReader:
  additionalRuntimeConfig: "log.level info"

  # Override the agent's liveness probe logic from the default:
  # In case of issues with the probe, you can disable it with the
  # following values, to allow easier investigating:
  #
  #  livenessProbe:
  #    exec:
  #      command: ["/bin/true"]

  # The below values are suggestions. Individual workloads may vary
  #   and require higher or lower resource requirements. It is
  #   highly recommended to validate these settings in the target
  #   environment, and adjust to achieve desired performance.
  #
  # Ref: http://kubernetes.io/docs/user-guide/compute-resources/
  #
  #  resources:
  #    requests:
  #      memory: "256Mi"
  #      cpu: "200m"
  #    limits:
  #      memory: "512Mi"
  #      cpu: "400m"
  # Override kubernetes api reader agent's default target nodes
  # Default is any node within the target namespace
  #
  # Set these as desired to only install the kubernetes api reader agent on
  # one of a subset of your kubernetes nodes
  nodeSelector: {}
    # foo: bar
  # Optional
  affinity: {}
  # Optional
  tolerations: []

  # Optional
  # Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
  priorityClassName: ""

  ## Annotations to add to the threatstack api reader agent pod
  #
  # To remove the apparmor annotation, add a comment as the attribute value,
  # Example:
  #   podAnnotations:
  #     # This comment triggers REMOVING any podAnnotations!
  #
  # podAnnotations:
  #   key: "value"
  # Optional
  podAnnotations: {}

  securityContext:
    privileged: false

########
#
# Threat Stack Agent Daemonset settings
#
# This section configures a daemonset of threatstack-agent pods
#
# The pods monitor the activity of other pods/deployments on
# the node.
#
########
daemonset:
  # Override the agent's default detection behavior that determines
  # which docker service to monitor
  #
  # enableDocker: false
  # enableContainerd: false
  # enableCrio: false

  # Enable low-power mode
  # Configures the daemonset agents to perform better in 
  # tightly-resourced environments. The agent trades some telemetry
  # reporting for reduced CPU and memory consumption.
  #
  # Ref: https://threatstack.zendesk.com/hc/en-us/articles/360016132692-Threat-Stack-Kubernetes-Deployment
  #
  enableLowPowerMode: false

  additionalRuntimeConfig: "log.level info"
  # Override the agent's liveness probe logic from the default:
  # In case of issues with the probe, you can disable it with the
  # following values, to allow easier investigating:
  #
  #  livenessProbe:
  #    exec:
  #      command: ["/bin/true"]

  # The below values are suggestions. Individual workloads may vary
  #   and require higher or lower resource requirements. It is
  #   highly recommended to validate these settings in the target
  #   environment, and adjust to achieve desired performance.
  #
  # Ref: http://kubernetes.io/docs/user-guide/compute-resources/
  #
  #
  #  resources:
  #    requests:
  #      memory: "256Mi"
  #      cpu: "200m"
  #    limits:
  #      memory: "512Mi"
  #      cpu: "400m"

  # Override agent's default target nodes
  # Default is all nodes within the target namespace
  #
  # Set these as desired to only install agent on a subset of your kubernetes nodes.
  nodeSelector: {}
    # threatstack-agent: "true"
  # Optional
  affinity: {}
  # Optional
  tolerations: []

  # Optional
  # Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
  priorityClassName: ""

  ## Annotations to add to the threatstack daemonset pod(s)
  #
  # To remove the apparmor annotation, add a comment as the attribute value,
  # Example:
  #   podAnnotations:
  #     # This comment triggers REMOVING any podAnnotations!
  #
  # podAnnotations:
  #   key: "value"
  podAnnotations:
    container.apparmor.security.beta.kubernetes.io/threatstack-agent: unconfined

  # Override this to provide custom audit rules to the agent.
  # Make sure to use | to ensure the custom rules data is
  # properly parsed and output.
  #
  # Example:
  #   customAuditRules: |
  #     foo
  #     bar
  #     the end
  #
  customAuditRules: ""

  # Override this to provide custom auditd config
  # https://threatstack.zendesk.com/hc/en-us/articles/360030897272-FAQ-Workaround-for-the-Known-Linux-Limitation-with-auditd
  #
  # Example:
  #   customTsAuditdConfig: |
  #     {
  #       ...
  #     }
  #
  customTsAuditdConfig: ""

  # Override this to provide a custom lua filter to the agent.
  # Make sure to use | to ensure the custom lua filter is
  # properly parsed and output.
  #
  # Example:
  #   customLuaFilter: |
  #     foo
  #     bar
  #     the end
  #
  customLuaFilter: ""

  securityContext:
    privileged: false