mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
133 lines
3.2 KiB
YAML
133 lines
3.2 KiB
YAML
# CrowdSec Helm chart values
|
|
# IP reputation + behavioral detection (Layer 0 of zero-trust stack)
|
|
#
|
|
# Components:
|
|
# LAPI - Central decision engine (PostgreSQL backend via CNPG)
|
|
# Agent - DaemonSet parsing pod logs from /var/log/pods/
|
|
# Firewall Bouncer - Deployed separately (see firewall-bouncer.yaml)
|
|
|
|
container_runtime: containerd
|
|
|
|
lapi:
|
|
env:
|
|
# PostgreSQL password from CNPG auto-generated secret
|
|
- name: DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-crowdsec-app
|
|
key: password
|
|
# CAPI enrollment (optional — user registers at app.crowdsec.net)
|
|
- name: ENROLL_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: crowdsec-capi-key
|
|
key: enrollment-key
|
|
optional: true
|
|
- name: ENROLL_INSTANCE_NAME
|
|
value: "homelabv5"
|
|
- name: ENROLL_TAGS
|
|
value: "k8s homelab talos"
|
|
# Registration token for agent auto-registration (from chart-generated secret)
|
|
- name: REGISTRATION_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: crowdsec-lapi-secrets
|
|
key: registrationToken
|
|
# Pre-register firewall bouncer API key
|
|
- name: BOUNCER_KEY_firewall
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: crowdsec-bouncer-key
|
|
key: api-key
|
|
optional: true
|
|
persistentVolume:
|
|
data:
|
|
enabled: false
|
|
config:
|
|
enabled: false
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
dashboard:
|
|
enabled: false
|
|
strategy:
|
|
type: Recreate
|
|
|
|
agent:
|
|
# Log acquisition sources
|
|
acquisition:
|
|
# Istio ingress gateway logs (all external traffic)
|
|
- namespace: istio-system
|
|
podName: istio-ingressgateway-*
|
|
program: nginx
|
|
poll_without_inotify: true
|
|
# Netbird management logs
|
|
- namespace: netbird
|
|
podName: netbird-management-*
|
|
program: netbird
|
|
poll_without_inotify: true
|
|
# Authentik server logs
|
|
- namespace: authentik
|
|
podName: authentik-server-*
|
|
program: authentik
|
|
poll_without_inotify: true
|
|
|
|
env:
|
|
# Install community collections for log parsing
|
|
- name: COLLECTIONS
|
|
value: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/http-cve"
|
|
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
# Wait for LAPI to be ready (must be a map, not scalar)
|
|
wait_for_lapi:
|
|
image:
|
|
repository: busybox
|
|
tag: "1.28"
|
|
|
|
# PostgreSQL database backend (CNPG) + auto-registration for agents
|
|
config:
|
|
config.yaml.local: |
|
|
db_config:
|
|
type: postgresql
|
|
user: app
|
|
password: ${DB_PASSWORD}
|
|
db_name: crowdsec
|
|
host: pg-crowdsec-rw.crowdsec.svc
|
|
port: 5432
|
|
sslmode: prefer
|
|
api:
|
|
server:
|
|
auto_registration:
|
|
enabled: true
|
|
token: ${REGISTRATION_TOKEN}
|
|
allowed_ranges:
|
|
- "10.244.0.0/16"
|
|
- "127.0.0.1/32"
|