Admission Controller

Sysdig Admission Controller - This chart deploys the Sysdig Admission Controller in your Kubernetes cluster.

TL;DR;

$ helm repo add sysdig https://charts.sysdig.com
$ helm repo update
$ helm install admission-controller sysdig/admission-controller --create-namespace -n admission-controller

Introduction

This chart deploys the Sysdig Admission Controller on a Kubernetes cluster using the Helm package manager.

Prerequisites

• Kubernetes v1.16+
• Sysdig Secure API Token

Installing the Chart

To install the chart with the release name admission-controller:

$ helm install admission-controller sysdig/admission-controller -n admission-controller

The command deploys the Sysdig Admission Controller on the Kubernetes cluster in the default configuration. The configuration section lists the parameters that can be configured during installation.

Tip: List all releases using helm list

Uninstalling the Chart

To uninstall/delete the admission-controller:

$ helm delete admission-controller -n admission-controller

The command removes all the Kubernetes components associated with the chart and deletes the release.

Configuration

The following table lists the configurable parameters of the admission-controller chart and their default values.

Specify each parameter using the --set key=value[,key=value] argument to helm install. For example:

$ helm install admission-controller sysdig/admission-controller --create-namespace -n admission-controller  --set sysdig.secureAPIToken=YOUR-KEY-HERE,clusterName=YOUR-CLUSTER-NAME

Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example:

$ helm install admission-controller sysdig/admission-controller --create-namespace -n admission-controller --values values.yaml

Custom Admission Controller Rules to be detected

In case you don’t want to detect some resources you can create your custom rules. To achieve this, you can change the k8sAuditDetectionsRules variable in the values.yaml file. For example, if you want to filter out secrets from the AC you can try with these rules:]

- apiGroups:
  - ""
  apiVersions: [ "*" ]
  operations: [ "*" ]
  resources:
  - bindings
  - componentstatuses
  - configmaps
  - endpoints
  - events
  - limitranges
  - namespaces
  - nodes
  - persistentvolumeclaims
  - persistentvolumes
  - pods/*
  - podtemplates
  - replicationcontrollers
  - resourcequotas
  - serviceaccounts
  - services
  scope: "*"
- apiGroups:
  - apps
  - autoscaling
  - batch
  - networking.k8s.io
  - rbac.authorization.k8s.io
  - extensions
  apiVersions: [ "*" ]
  operations: [ "*" ]
  resources: [ "*/*" ]
  scope: "*"

On Prem deployment

Use the following command to deploy in an on-prem:

$ helm install  --create-namespace -n admission-controller admission-controller \
                --set sysdig.url=SECURE_URL \
                --set sysdig.secureAPIToken=SECURE_API_TOKEN \
                --set clusterName=CLUSTER_NAME \
                --set verifySSL=false \
                sysdig/admission-controller

Use verifySSL=false if you are using self signed certificates.