Jeffrey
16e265239b
Chart defaults set requests == limits == 500m for both. The node is at 95% of allocatable CPU in requests while actually using about 10%, so lapi sat Pending with Insufficient cpu. Requests dropped to 50m/100m with the limits left generous, since appsec runs inline on every public request.
76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
# CrowdSec core — chart crowdsecurity/crowdsec 0.24.0 (appVersion v1.7.8)
|
|
# Deploys: LAPI (decisions DB), log-processing agent, and AppSec (WAF) component.
|
|
#
|
|
# Detection strategy here = CAPI community blocklists + AppSec (inline WAF).
|
|
# We intentionally do NOT parse Envoy access logs (no reliable first-party
|
|
# Envoy parser); the kdwils bouncer forwards requests to AppSec instead.
|
|
# Remediation/enforcement is done by the separate `crowdsec-envoy-bouncer`.
|
|
|
|
#=============================#
|
|
#= Local API (LAPI) =#
|
|
#=============================#
|
|
lapi:
|
|
# Pre-register the "envoy" bouncer. The CrowdSec image turns BOUNCER_KEY_<name>
|
|
# into a registered bouncer named <name> on first start. The kdwils bouncer
|
|
# authenticates with this same key.
|
|
env:
|
|
- name: BOUNCER_KEY_envoy
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: crowdsec-secrets
|
|
key: bouncer-key
|
|
# Chart default is requests == limits == 500m, which will not schedule: the
|
|
# node is at 95% of allocatable CPU in requests while actually using ~10%.
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
persistentVolume:
|
|
data:
|
|
enabled: true
|
|
storageClassName: longhorn
|
|
size: 2Gi
|
|
config:
|
|
enabled: true
|
|
storageClassName: longhorn
|
|
size: 100Mi
|
|
|
|
#=============================#
|
|
#= Log-processing agent =#
|
|
#=============================#
|
|
agent:
|
|
# Disabled: detection comes from AppSec + CAPI, not log tailing. Chart 0.24.0
|
|
# refuses to render the agent DaemonSet with an empty acquisition list anyway.
|
|
enabled: false
|
|
|
|
#=============================#
|
|
#= AppSec (WAF) component =#
|
|
#=============================#
|
|
appsec:
|
|
enabled: true
|
|
# Inline on every public request, so it keeps a generous limit but a small
|
|
# request (same reason as lapi above).
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 512Mi
|
|
# Hub collections installed into the AppSec pod at startup (the WAF rule sets).
|
|
env:
|
|
- name: COLLECTIONS
|
|
value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules"
|
|
acquisitions:
|
|
- source: appsec
|
|
listen_addr: "0.0.0.0:7422"
|
|
path: /
|
|
# Virtual-patching ruleset (CRS-based vpatch rules). Verify it loaded after
|
|
# first deploy with: cscli appsec-configs list / cscli appsec-rules list
|
|
appsec_config: crowdsecurity/virtual-patching
|
|
labels:
|
|
type: appsec
|