Sysdig Deploy

Use the sysdig-deploy Helm chart to install Sysdig Secure and Sysdig Monitor in a Kubernetes environment.

Prerequisites

Helm v3.6 or above

Overview

This chart deploys the following Sysdig components into your Kubernetes cluster:

• Sysdig Admission Controller
• Sysdig Agent
• Sysdig Benchmark Runner (on-premises only)
• Sysdig Host Analyzer (on-premises only)
• Sysdig Host Scanner
• Sysdig KSPM Analyzer
• Sysdig KSPM Collector
• Sysdig Image Analyzer (on-premises only)
• Sysdig Rapid Response
• Sysdig Runtime Scanner

To deploy sysdig-deploy, follow the installation instructions given on the Sysdig Documentation website:

Sysdig Monitor

• Installation Requirements
• Installation Instructions

Sysdig Secure | Sysdig Secure + Sysdig Monitor

• Component Overview
• Installation Requirements
• Installation Instructions

On-Premises

• Install Sysdig Agent for a Sysdig On-Premises Deployment
• Install Sysdig Agent in an Airgapped Environment

Configuration

For the configuration values of the each sub-component, see the respective chart readme. To apply a specific configuration of a sub-component, prefix the configuration parameter with the name of the sub-chart.

You can update the configurations by using either of the following:

• Using the key-value pair: --set sysdig.settings.key = value
• values.yaml file

Example: Admission Controller

See the admission-controller README for the configuration values of the admission-controller. To override the Sysdig URL variable for the Admission Controller chart:

Using the Key-Value Pair

Specify each parameter using the --set key=value[,key=value] argument to the helm installcommand.

helm install sysdig sysdig/sysdig-deploy \
    --set global.sysdig.accessKey=ACCESS_KEY \
    --set global.sysdig.secureAPIToken=SECURE_API_TOKEN \
    --set global.clusterConfig.name=CLUSTER_NAME \
    --set admissionController.enabled=true

Using values.yaml

The values.yaml file specifies the values for the configuration parameters. You can add the configuration to the values.yaml file, then use it in the helm install command.

1. Add the following to the values.yaml file:

   global:
     clusterConfig:
       name: CLUSTER_NAME
     sysdig:
       accessKey: ACCESS_KEY
       secureAPIToken: SECURE_API_TOKEN
   admissionController:
     enabled: true
     sysdig:
       url: URL
   

2. Run the following:

   helm install --namespace sysdig-agent sysdig-agent -f values.yaml sysdig/sysdig-deploy
   

Example: NodeAnalyzer

See the node-analyzer subchart README for the configuration values of the nodeAnalyzer. To override the API endpoint variable:

Using the Key-Value Pair

Specify each parameter using the --set key=value[,key=value] argument to the helm installcommand

helm install sysdig sysdig/sysdig-deploy \
    --set global.sysdig.accessKey=ACCESS_KEY \
    --set agent.collectorSettings.collectorHost=COLLECTOR_ENDPOINT \
    --set nodeAnalyzer.nodeAnalyzer.apiEndpoint=API_ENDPOINT

Using values.yaml

The values.yaml file specifies the values for the configuration parameters. You can add the configuration to the values.yaml file, then use it in the helm install command.

1. Add the following to the values.yaml file:

   global:
     sysdig:
        accessKey: <ACCESS_KEY>
        region: <SAAS_REGION>
   
   nodeAnalyzer:
      secure:
        vulnerabilityManagement:
          newEngineOnly: true
      nodeAnalyzer:
        benchmarkRunner:
          deploy: false
        hostScanner:
          deploy: true
   

2. Run the following:

   helm install --namespace sysdig-agent sysdig-agent -f values.yaml sysdig/sysdig-deploy
   

Configuration Parameters

The following table lists the configurable parameters of the sysdig-deploy chart and their default values. The sysdig-deploy chart itself only has select parameters that are used by multiple subcharts, and those are used to enable or disable selected subcharts. For additional configuration values see the READMEs of the individual subcharts.

Upgrading

1. Refresh the sysdig helm repo to get the latest chart.

   helm repo update
   

2. Get the currently deployed values and save them to values.sysdig.yaml.

   helm get values -n sysdig-agent sysdig-agent -o yaml > values.sysdig.yaml
   

3. Upgrade to the latest version of the chart:

   helm upgrade -n sysdig-agent sysdig-agent sysdig/sysdig-deploy -f values.sysdig.yaml
   

Pod Security Policy & Pod Security Admission

• Some Sysdig components pods require privileged access in order to run. For example, agent, admission-controller(scanner), node-analyzer. Sysdig ships a Pod Security Policy by default on every installation. However, Pod Security Policy has been deprecated since Kubernetes v1.21 and removed since Kubernetes v1.25. Therefore, Sysdig introduced a check in order to deploy the policy for the Kubernetes version detected by helm is < 1.25.

• As a replacement for Pod Security Policy, Kubernetes provides a new mechanism, Pod Security Admission. In a cluster using the Pod Security Admission controller, enforcing a lower than priviliged level will prevent the pods from working as intended, in order to avoid such issue the correct labels must be set in the namespace where the pods run.

For example, adding the following labels to the namespace that is running the Agent pods:

apiVersion: v1
kind: Namespace
metadata:
  name: sysdig-agent
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/warn: privileged
    pod-security.kubernetes.io/warn-version: latest

This procedure cannot be done by the helm chart itself during the installation due to helm limitations

Verify the Integrity and Origin

Sysdig Helm Charts are signed so you can verify the integrity and origin of each chart. To verify the chart:

Import the Public Key

$ curl -o "/tmp/sysdig_public.gpg" "https://charts.sysdig.com/public.gpg"
$ gpg --import /tmp/sysdig_public.gpg

Verify the Chart

To check the integrity and the origin of the charts you can now append the --verify flag to the install, upgrade, and pull helm commands.