Chart: Rapid Response

Overview

Rapid Response allows security teams to connect to a remote shell within your environment to troubleshoot and investigate an event using the commands they are already accustomed to, with the flexibility they need to run the security tools at their disposal, directly from the event alert. For more information on this feature, see Rapid Response .

Use the sysdig-deploy parent chart to deploy the Rapid Response. Do not deploy subcharts directly.

For installation instructions, see Install Rapid Response.

Verify the integrity and origin

Sysdig Helm Charts are signed so users can verify the integrity and origin of each chart, the steps are as follows:

Import the Public Key

$ curl -o "/tmp/sysdig_public.gpg" "https://charts.sysdig.com/public.gpg"
$ gpg --import /tmp/sysdig_public.gpg

Verify the chart

To check the integrity and the origin of the charts, append the --verify flag to the install, upgrade, and pull helm commands.

Configuration

You can use the Helm chart to update the default Rapid Response configurations by using either of the following:

• Using the key-value pair: --set sysdig.settings.key = value
• values.yaml file

Using the Key-Value Pair

Specify each parameter using the --set key=value[,key=value] argument to the helm install command.

For example:

helm install --create-namespace -n rapid-response rapid-response \
    --set sysdig.accessKey=<YOUR-ACCESS-KEY>, \
    sysdig/rapid-response

Using values.yaml

The values.yaml file specifies the values for the Rapid Response configuration parameters. You can add the configuration to the values.yaml file, then use it in the helm install command.

helm install --create-namespace -n rapid-response rapid-response \
    -f values.yaml sysdig/rapid-response

Configuration Parameters

The following table lists the configurable parameters of the Sysdig Rapid Response chart and their default values:

Additional Configurations

Add Volumes to Rapid Response

Rapid response is an isolated container when used out of the box. In order to access other volumes this chart supports, specify them through rapidResponse.extraVolumes.volumes and rapidResponse.extraVolumes.mounts.

In this example, the host root is mounted under /host:

rapidResponse:
  extraVolumes:
    volumes:
      - name: host-root-vol
        hostPath:
          path: /

    mounts:
      - mountPath: /host
        name: host-root-vol

Customize Rapid Response Image

Each team can have different necessities and constraints when accessing critical workloads. To support different scenarios, the Rapid Response image is built with a small footprint, so that everyone can customize it based on their criteria.

See Custom Image Example to learn how to use kubectl for a basic customization.

Additionally, when you pull the image from a private repository, follow your registry guidelines and deploy the credentials on the cluster. Then, you will be able to use them by setting the rapidResponse.imagePullSecrets parameter value to the secret name to use.

Use a Custom ServiceAccount

To use a ServiceAccount that is different from the default one,

1. Ensure that the ServiceAccount is already created.

2. Install or upgrade the chart with the rapidResponse.existingServiceAccount parameter.

   For example:

   helm install --create-namespace -n rapid-response rapid-response \
       --set sysdig.accessKey=<YOUR-ACCESS-KEY>, rapidResponse.existingServiceAccount=<YOUSERVICEACCOUNT> \
       sysdig/rapid-response
   

   It takes the name of a ServiceAccount to be used in pods.

This configuration helps you perform specific operations on the Kubernetes control plane.