Chart: Node Analyzer

Overview

The Node Analyzer provides a method for deploying the components for the following Sysdig Secure features:

• Runtime Scanning
• Host Scanning
• KSPM Analyzer

This chart adds the Sysdig Node Analyzer to all nodes in your cluster via a DaemonSet. The Node Analyzer is deployed by default unless you set the value nodeAnalyzer.deploy to false.

Use the sysdig-deploy parent chart to deploy Node Analyzer. Do not deploy subcharts directly.

For installation instructions, see Install Agent Components on Kubernetes.

Prerequisites

• Kubernetes 1.9+ with beta APIs enabled

Configuration

You can use the Helm chart to update the default agent configurations by using either of the following:

• Using the key-value pair: --set sysdig.settings.key = value
• values.yaml file

Using the Key-Value Pair

Specify each parameter using the --set key=value[,key=value] argument to the helm installcommand.

For example:

helm install sysdig-agent --namespace sysdig-agent --create-namespace \
--set global.sysdig.accessKey=<ACCESS_KEY> \
--set global.sysdig.tags.role=webserver --set global.sysdig.tags.location=europe \
--set global.sysdig.region=<SAAS_REGION> \
--set nodeAnalyzer.secure.vulnerabilityManagement.newEngineOnly=true \
--set global.kspm.deploy=true \
--set nodeAnalyzer.nodeAnalyzer.benchmarkRunner.deploy=false \
--set nodeAnalyzer.nodeAnalyzer.hostScanner.deploy=true
--set global.clusterConfig.name=<CLUSTER_NAME> \
sysdig/sysdig-deploy

Using values.yaml

The values.yaml file specifies the values for the node-analyzer configuration parameters. You can add the configuration to the values.yaml file, then use it in the helm install command.

1. Add the following to the values.yaml file:

    global:
     sysdig:
       accessKey: <ACCESS_KEY>
       region: <SAAS_REGION>
     kspm:
       deploy: true
     clusterConfig:
       name: <CLUSTER_NAME>
   nodeAnalyzer:
     secure:
       vulnerabilityManagement:
         newEngineOnly: true
     nodeAnalyzer:
       benchmarkRunner:
         deploy: false
       hostScanner:
         deploy: true
   

   Tip: You can use the default values.yaml file.

2. Run the following:

   helm install -n sysdig-agent sysdig sysdig/sysdig-deploy -f values.sysdig.yaml
   

Verify the integrity and origin

Sysdig Helm Charts are signed so users can verify the integrity and origin of each chart, the steps are as follows:

Import the Public Key

$ curl -o "/tmp/sysdig_public.gpg" "https://charts.sysdig.com/public.gpg"
$ gpg --import /tmp/sysdig_public.gpg

Verify the Chart

To check the integrity and the origin of the charts, append the --verify flag to the install, upgrade and pull helm commands.

Configuration Parameters

The following table lists the configurable parameters of the Sysdig Node Analyzer chart and their default values.