forust
7cca330438
Read traefik logs from Loki instead of file tail. Static machine identity via pre-created secret stops 403 register races. Add janitor cronjob, dashboards, whitelists and metrics.
103 lines
2.7 KiB
YAML
103 lines
2.7 KiB
YAML
container_runtime: containerd
|
|
|
|
agent:
|
|
acquisition: []
|
|
additionalAcquisition:
|
|
- labels:
|
|
type: traefik
|
|
limit: 1000
|
|
query: |
|
|
{namespace="traefik"}
|
|
source: loki
|
|
url: http://loki.prometheus.svc.cluster.local:3100/
|
|
wait_for_ready: 30s
|
|
env:
|
|
- name: COLLECTIONS
|
|
value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
|
|
- name: DISABLE_COLLECTIONS
|
|
value: crowdsecurity/sshd
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
additionalLabels:
|
|
release: prometheus-stack
|
|
enabled: true
|
|
# Static machine identity: agent pods mount pre-created LAPI credentials
|
|
# (Secret crowdsec-agent-credentials, key local_api_credentials.yaml)
|
|
# at the exact path the agent entrypoint expects. Together with the
|
|
# patched register-init (enforced by janitor-cronjob.yaml) the agent
|
|
# never calls `cscli lapi register` in steady state, so pod names,
|
|
# restarts and reboots can no longer break it.
|
|
extraVolumes:
|
|
- name: static-creds
|
|
secret:
|
|
secretName: crowdsec-agent-credentials
|
|
items:
|
|
- key: local_api_credentials.yaml
|
|
path: local_api_credentials.yaml
|
|
extraVolumeMounts:
|
|
- name: static-creds
|
|
mountPath: /tmp_config/local_api_credentials.yaml
|
|
subPath: local_api_credentials.yaml
|
|
readOnly: true
|
|
resources:
|
|
limits:
|
|
cpu: 200m
|
|
memory: 500Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 100Mi
|
|
|
|
config:
|
|
parsers:
|
|
s02-enrich:
|
|
mobile-whitelist.yaml: |
|
|
name: forust/mobile-whitelist
|
|
description: "Whitelist SWAN/4ka mobile network"
|
|
whitelist:
|
|
reason: "Mobile IP whitelist"
|
|
cidr:
|
|
- "84.245.64.0/18"
|
|
|
|
postoverflows:
|
|
s01-whitelist:
|
|
home-dynamic-ip.yaml: |
|
|
name: forust/home-dynamic-ip
|
|
description: "Whitelist home dynamic IP"
|
|
whitelist:
|
|
reason: "Home dynamic IP"
|
|
expression:
|
|
- evt.Overflow.Alert.Source.IP in LookupHost("ddns.forust.xyz")
|
|
|
|
lapi:
|
|
env:
|
|
- name: COLLECTIONS
|
|
value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
|
|
- name: DISABLE_COLLECTIONS
|
|
value: crowdsecurity/linux crowdsecurity/sshd
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
additionalLabels:
|
|
release: prometheus-stack
|
|
enabled: true
|
|
persistentVolume:
|
|
config:
|
|
enabled: true
|
|
size: 100Mi
|
|
storageClassName: local-path-retain
|
|
data:
|
|
enabled: true
|
|
size: 1Gi
|
|
storageClassName: local-path-retain
|
|
resources:
|
|
limits:
|
|
cpu: 400m
|
|
memory: 500Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 150Mi
|
|
service:
|
|
type: ClusterIP
|
|
storeLAPICscliCredentialsInSecret: true
|