@@ -3,6 +3,154 @@ title: Helm's Parameters
33id : values_parameters
44---
55
6+ # How to write a values parameter file
7+
8+ The following configuration keeps the Helm chart close to its defaults while
9+ explicitly defining how CrowdSec discovers logs, which parsers and collections
10+ are enabled, and how state is persisted.
11+
12+ The container runtime ` container_runtime ` is set to ensure log lines are decoded
13+ in the correct format. The agent is scoped to only the namespaces and pods that
14+ matter, which reduces noise and limits resource usage. Each ` acquisition ` entry
15+ includes a program value that maps logs to the appropriate parser family, and
16+ this must stay consistent with the collections loaded through environment
17+ variables.
18+
19+ Debug logging is enabled here for visibility, but it should normally be disabled
20+ in production environments.
21+
22+ AppSec is enabled with a local listener so in-cluster components can forward
23+ HTTP security events. The corresponding AppSec rule collections are loaded to
24+ provide virtual patching and generic protections. The configuration is described
25+ after the ` appsec ` directive.
26+
27+ On the LAPI side, we strongly encourages the use of database to provide
28+ persistence of decisions and alerts.
29+
30+ ``` yaml
31+ # Log format emitted by the container runtime.
32+ # Use "containerd" for CRI-formatted logs (most modern Kubernetes clusters),
33+ # or "docker" if nodes still use the Docker runtime.
34+ container_runtime : containerd
35+
36+ agent :
37+ # Log acquisition configuration: tells CrowdSec which pod logs to read
38+ # and which parser family ("program") should process them.
39+ acquisition :
40+ # Postfix mail logs from the mail-system namespace
41+ - namespace : mail-system # Kubernetes namespace to watch
42+ podName : mail-system-postfix-* # Pod name glob pattern
43+ program : postfix/smtpd # Parser hint so postfix logs match correctly
44+ poll_without_inotify : true
45+
46+ # NGINX ingress controller logs
47+ - namespace : ingress-nginx
48+ podName : ingress-nginx-controller-* # Typical ingress-nginx controller pods
49+ program : nginx # Routes logs to nginx parsers
50+ poll_without_inotify : true
51+
52+ # It's recommended to avoid putting passwords directly in the values.yaml file
53+ # for security reasons. Instead, consider using Kubernetes Secrets or environment
54+ # variables to manage sensitive information securely.
55+ env :
56+ # Collections determine which parsers, scenarios, and postoverflows are installed.
57+ # Must match the log sources defined above.
58+ - name : COLLECTIONS
59+ value : crowdsecurity/postfix crowdsecurity/nginx
60+
61+ # Enables verbose logs from the CrowdSec agent.
62+ # Useful for troubleshooting, but should be "false" in steady-state production.
63+ # - name: DEBUG
64+ # value: "true"
65+ tolerations :
66+ # Allows the agent pod to run on control-plane nodes.
67+ # Only keep this if those nodes also run workloads you want to monitor.
68+ - key : " node-role.kubernetes.io/control-plane"
69+ operator : " Exists"
70+ effect : " NoSchedule"
71+ appsec :
72+ # Enables CrowdSec AppSec (WAF component)
73+ enabled : true
74+
75+ acquisitions :
76+ # Defines how AppSec receives HTTP security events
77+ - appsec_config : crowdsecurity/appsec-default # Default AppSec engine configuration
78+ labels :
79+ type : appsec # Label used internally to identify AppSec events
80+ listen_addr : 0.0.0.0:7422 # Address/port where AppSec listens for events
81+ path : / # URL path to inspect
82+ source : appsec # Marks events as coming from AppSec
83+
84+ env :
85+ # AppSec-specific rule sets (virtual patching + generic protections)
86+ - name : COLLECTIONS
87+ value : crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
88+ lapi :
89+ env :
90+ # Enrollment key used to register this CrowdSec instance with the console.
91+ # Should be stored in a Kubernetes Secret in production.
92+ - name : ENROLL_KEY
93+ valueFrom :
94+ secretKeyRef :
95+ name : crowdsec-keys
96+ key : ENROLL_KEY
97+
98+ # Human-readable name for this instance in the console
99+ - name : ENROLL_INSTANCE_NAME
100+ value : " sabban"
101+
102+ # Tags help group or filter instances in the console
103+ - name : ENROLL_TAGS
104+ value : " k8s"
105+
106+ # API key used by a bouncer (here: ingress) to query decisions from LAPI
107+ # Also should be stored as a Secret rather than plaintext.
108+ - name : BOUNCER_KEY_ingress
109+ valueFrom :
110+ secretKeyRef :
111+ name : crowdsec-keys
112+ key : BOUNCER_KEY_ingress
113+
114+ # It's recommended to avoid putting passwords directly in the values.yaml file
115+ # for security reasons. Instead, consider using Kubernetes Secrets or environment
116+ # variables to manage sensitive information securely.
117+ - name : DB_PASSWORD
118+ valueFrom :
119+ secretKeyRef :
120+ name : database-secret
121+ key : DB_PASSWORD
122+
123+ # The following piece configuration under config.config.yaml.local is merged
124+ # alongside the current conbfiguration. This mechanism allows
125+ # environment-specific overrides. This approach helps maintain
126+ # a clean and centralized configuration while enabling developers
127+ # to customize their local settings without modifying the primary
128+ # configuration files in pods with complex volumes and mount points.
129+
130+ config.config.yaml.local :
131+ # Using a database is strongly encouraged.
132+ db_config :
133+ type : postgresql
134+ user : crowdsec
135+ password : ${DB_PASSWORD}
136+ db_name : crowdsec
137+ host : <database-host>
138+ flush :
139+ bouncers_autodelete :
140+ api_key : 1h
141+ agents_autodelete :
142+ login_password : 1h
143+
144+ # persistentVolume in kubernetes for CrowdSec data and configuration is now
145+ # discouragfe in favor of a database and direct configuration through
146+ # values
147+ persistentVolume :
148+ data :
149+ enabled : false
150+ config :
151+ enabled : false
152+ ` ` `
153+
6154# Values parameters reference
7155
8156This page provides a complete, generated reference of all Helm chart
0 commit comments