99 lines
2.6 KiB
YAML
99 lines
2.6 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: crowdsec
|
|
namespace: common-services
|
|
spec:
|
|
interval: 5m
|
|
chart:
|
|
spec:
|
|
chart: crowdsec
|
|
version: 0.24.0
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: crowdsec
|
|
namespace: common-services
|
|
values:
|
|
container_runtime: containerd
|
|
|
|
image:
|
|
tag: v1.7.8
|
|
|
|
agent:
|
|
acquisition:
|
|
- namespace: common-services
|
|
podName: traefik-*
|
|
program: traefik
|
|
env:
|
|
- name: COLLECTIONS
|
|
value: "crowdsecurity/traefik"
|
|
|
|
secrets:
|
|
externalSecret:
|
|
name: crowdsec-lapi-secret
|
|
csLapiSecretKey: "CS_LAPI_SECRET"
|
|
registrationTokenKey: "REGISTRATION_TOKEN"
|
|
|
|
lapi:
|
|
replicas: 2
|
|
storeCAPICredentialsInSecret: true
|
|
storeLAPICscliCredentialsInSecret: true
|
|
persistentVolume:
|
|
data:
|
|
enabled: false
|
|
config:
|
|
enabled: false
|
|
envFrom:
|
|
- secretRef:
|
|
name: crowdsec-lapi-secret
|
|
|
|
config:
|
|
config.yaml.local: |
|
|
api:
|
|
client:
|
|
# the log processor will remove delete itself from LAPI when stopping.
|
|
unregister_on_exit: true
|
|
server:
|
|
auto_registration: # Activate if not using TLS for authentication
|
|
enabled: true
|
|
token: "${CROWDSEC_REGISTRATION_TOKEN}" # /!\ Do not modify this variable (Cluster K8S gitlab var)
|
|
allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
|
|
- "127.0.0.1/32"
|
|
- "192.168.0.0/16"
|
|
- "10.0.0.0/8"
|
|
- "172.16.0.0/12"
|
|
db_config:
|
|
type: mysql
|
|
user: ${CROWDSEC_DB_USER}
|
|
password: ${CROWDSEC_DB_PWD}
|
|
db_name: ${CROWDSEC_DB_NAME}
|
|
host: ${DB_HOST}
|
|
port: ${DB_PORT}
|
|
flush:
|
|
bouncers_autodelete:
|
|
api_key: 1h
|
|
agents_autodelete:
|
|
login_password: 6h
|
|
cert: 6h
|
|
|
|
appsec:
|
|
enabled: true
|
|
acquisitions:
|
|
- source: appsec
|
|
listen_addr: "0.0.0.0:7422"
|
|
path: /
|
|
appsec_configs:
|
|
- crowdsecurity/appsec-default
|
|
- crowdsecurity/crs
|
|
labels:
|
|
type: appsec
|
|
env:
|
|
- name: COLLECTIONS
|
|
value: >-
|
|
crowdsecurity/appsec-virtual-patching
|
|
crowdsecurity/appsec-crs
|
|
crowdsecurity/appsec-generic-rules
|
|
crowdsecurity/wordpress
|
|
crowdsecurity/appsec-crs-exclusion-plugin-wordpress
|
|
crowdsecurity/appsec-wordpress
|
|
|