crowdsec helm release

crowdsec helm

No introduction found. Create it?

More popular helm chart found

crowdsec from crowdsecurity/helm-charts/crowdsec is more popular with 12 repositories.

Install

Install with:

helm repo add crowdsec https://crowdsecurity.github.io/helm-charts/
helm install crowdsec crowdsec/crowdsec -f values.yaml

Examples

See examples from other people.

Major version:

Filter repos who also have:

Top Repositories (1 out of 9)

Name	Repo	Stars	Version	Timestamp
crowdsec	xunholy/k8s-gitops	640	0.24.2	a month ago

Name

Repo

Stars

Version

Timestamp

crowdsec

xunholy/k8s-gitops

640

0.24.2

a month ago

Values

See the most popular values for this chart:

Key	Types
container_runtime (7) `containerd`	string
lapi.env[].name (7) `DISABLE_ONLINE_API ENROLL_KEY ENROLL_INSTANCE_NAME`	string
lapi.env[].value (6) `false ${CSKEY} cluster`	string
lapi.env[].valueFrom.secretKeyRef.key (4) `enroll-key INIT_POSTGRES_HOST INIT_POSTGRES_PASS envoy-bouncer-key opnsense-bouncer-key`	string
lapi.env[].valueFrom.secretKeyRef.name (4) `crowdsec-secret crowdsec-initdb-secret crowdsec-initdb-secret crowdsec-secret crowdsec-secret`	string
lapi.metrics.enabled (7) `true`	boolean
lapi.metrics.serviceMonitor.enabled (7) `true`	boolean
lapi.dashboard.enabled (5) `false`	boolean
lapi.dashboard.ingress.enabled (3) `false`	boolean
lapi.dashboard.ingress.host (3) `crowdsec.${DOMAIN_0}`	string
lapi.dashboard.ingress.annotations."cert-manager.io/cluster-issuer" (2) `le-prod`	string
lapi.dashboard.ingress.annotations."cert-manager.io/private-key-rotation-policy" (2) `Always`	string
lapi.dashboard.ingress.annotations."meta.helm.sh/release-name" (2) `traefik`	string
lapi.dashboard.ingress.annotations."meta.helm.sh/release-namespace" (2) `traefik`	string
lapi.dashboard.ingress.annotations."traefik.ingress.kubernetes.io/router.entrypoints" (2) `websecure`	string
lapi.dashboard.ingress.annotations."traefik.ingress.kubernetes.io/router.middlewares" (2) `traefik-chain-basic@kubernetescrd,traefik-bouncer@kubernetescrd,traefik-local@kubernetescrd`	string
lapi.dashboard.ingress.annotations."traefik.ingress.kubernetes.io/router.tls" (2) `true`	string
lapi.dashboard.ingress.ingressClassName (1) `internal`	string
lapi.dashboard.ingress.tls[].hosts[] (1) `- crowdsec-dashboard.internal.${SECRET_DOMAIN}`	string
lapi.persistentVolume.config.enabled (5) `true`	boolean
lapi.persistentVolume.config.accessModes[] (1) `- ReadWriteOnce`	string
lapi.persistentVolume.config.existingClaim (1) `crowdsec-config-pvc`	string
lapi.persistentVolume.config.size (1) `100Mi`	string
lapi.persistentVolume.data.enabled (5) `false`	boolean
lapi.persistentVolume.data.accessModes[] (1) `- ReadWriteOnce`	string
lapi.persistentVolume.data.existingClaim (1) `crowdsec-db-pvc`	string
lapi.persistentVolume.data.size (1) `1Gi`	string
lapi.resources.limits.memory (3) `512M`	string
lapi.resources.requests.cpu (3) `15m`	string
lapi.resources.requests.memory (3) `184M`	string
lapi.deployAnnotations."reloader.stakater.com/auto" (2) `true`	string
lapi.enabled (2) `true`	boolean
lapi.extraVolumeMounts[].mountPath (2) `/var/lib/crowdsec/data`	string
lapi.extraVolumeMounts[].name (2) `crowdsec-data`	string
lapi.extraVolumeMounts[].readOnly (1) `true`	boolean
lapi.extraVolumes[].name (2) `crowdsec-data`	string
lapi.extraVolumes[].hostPath.path (1) `/home/elraro/home-ops/volumes/crowdsec/http.yaml`	string
lapi.ingress.enabled (2) `false`	boolean
lapi.ingress.host (1) `crowdsec.internal.${SECRET_DOMAIN}`	string
lapi.ingress.ingressClassName (1) `internal`	string
lapi.ingress.tls[].hosts[] (1) `- crowdsec.internal.${SECRET_DOMAIN}`	string
lapi.replicas (2) `2`	number
lapi.service.type (2) `LoadBalancer`	string
lapi.service.annotations."lbipam.cilium.io/ips" (1) `10.0.30.33`	string
lapi.service.labels."app.kubernetes.io/name" (1) `crowdsec`	string
lapi.storeCAPICredentialsInSecret (2) `true`	boolean
lapi.storeLAPICscliCredentialsInSecret (2) `true`	boolean
lapi.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key (1) `kubernetes.io/arch`	string
lapi.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator (1) `In`	string
lapi.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].values[] (1) `- amd64`	string
lapi.envFrom[].secretRef.name (1) `crowdsec`	string
lapi.extraInitContainers[].command[] (1) `- sh - -c - cp -a /staging/var/lib/crowdsec/data/. /data/`	string
lapi.extraInitContainers[].envFrom[].secretRef.name (1) `crowdsec-initdb-secret`	string
lapi.extraInitContainers[].image (1) `ghcr.io/home-operations/postgres-init:18.6.0@sha256:b6d3af974df781c673d37e49bdddfa14a6f5be28b18d2cb7713f0449bea4057b crowdsecurity/crowdsec:v1.8.1`	string
lapi.extraInitContainers[].name (1) `init-db stage-data`	string
lapi.extraInitContainers[].volumeMounts[].mountPath (1) `/data`	string
lapi.extraInitContainers[].volumeMounts[].name (1) `crowdsec-data`	string
lapi.podLabels."db.home.arpa/postgres" (1) `true`	string
lapi.podSecurityContext.seccompProfile.type (1) `RuntimeDefault`	string
lapi.securityContext.allowPrivilegeEscalation (1) `false`	boolean
lapi.securityContext.privileged (1) `false`	boolean
lapi.strategy.type (1) `Recreate`	string
agent.acquisition[].namespace (6) `traefik`	string
agent.acquisition[].podName (6) `traefik-*`	string
agent.acquisition[].program (6) `traefik`	string
agent.metrics.enabled (6) `true`	boolean
agent.metrics.serviceMonitor.enabled (5) `true`	boolean
agent.env[].name (5) `PARSERS COLLECTIONS DISABLE_PARSERS`	string
agent.env[].value (5) `crowdsecurity/cri-logs crowdsecurity/traefik crowdsecurity/whitelists`	string
agent.enabled (4) `true`	boolean
agent.additionalAcquisition[].source (3) `file`	string
agent.additionalAcquisition[].filenames[] (2) `- /nextcloud.log`	string
agent.additionalAcquisition[].labels.type (2) `syslog`	string
agent.additionalAcquisition[].labels.program (1) `k8s-audit`	string
agent.additionalAcquisition[].force_inotify (1) `true`	boolean
agent.additionalAcquisition[].listen_addr (1) `0.0.0.0`	string
agent.additionalAcquisition[].listen_port (1) `1514`	number
agent.extraVolumeMounts[].mountPath (2) `/nextcloud.log /var/log/containers /var/log/pods`	string
agent.extraVolumeMounts[].name (2) `nextcloud-log var-log-containers var-log-pods`	string
agent.extraVolumeMounts[].readOnly (1) `true true true`	boolean
agent.extraVolumes[].name (2) `nextcloud-log var-log-containers var-log-pods`	string
agent.extraVolumes[].hostPath.path (1) `/mnt/sdc1/nextcloud/data/nextcloud.log /var/log/containers /var/log/pods`	string
agent.hostVarLog (2) `true`	boolean
agent.resources.limits.memory (2) `384Mi`	string
agent.resources.requests.cpu (2) `50m`	string
agent.resources.requests.memory (2) `128Mi`	string
agent.config.common.poll_without_inotify (1) `true`	boolean
agent.persistentVolume.config.enabled (1) `true`	boolean
agent.persistentVolume.config.existingClaim (1) `crowdsec-agent-config-pvc`	string
agent.podSecurityContext.runAsGroup (1) `0`	number
agent.podSecurityContext.runAsNonRoot (1) `false`	boolean
agent.podSecurityContext.runAsUser (1) `0`	number
agent.ports[].containerPort (1) `1514`	number
agent.ports[].name (1) `syslog`	string
agent.ports[].protocol (1) `UDP`	string
agent.securityContext.allowPrivilegeEscalation (1) `false`	boolean
agent.securityContext.capabilities.drop[] (1) `- ALL`	string
agent.securityContext.privileged (1) `false`	boolean
agent.service.externalTrafficPolicy (1) `Local`	string
agent.service.labels."app.kubernetes.io/name" (1) `crowdsec`	string
agent.service.loadBalancerClass (1) `io.cilium/l2-announcer`	string
agent.service.loadBalancerIP (1) `${crowdsec_syslog_ip}`	string
agent.service.ports[].name (1) `syslog`	string
agent.service.ports[].port (1) `514`	number
agent.service.ports[].protocol (1) `UDP`	string
agent.service.ports[].targetPort (1) `1514`	number
agent.service.type (1) `LoadBalancer`	string
agent.tolerations[].operator (1) `Exists`	string
agent.wait_for_lapi.securityContext.allowPrivilegeEscalation (1) `false`	boolean
agent.wait_for_lapi.securityContext.privileged (1) `false`	boolean
agent.wait_for_lapi.securityContext.runAsGroup (1) `0`	number
agent.wait_for_lapi.securityContext.runAsNonRoot (1) `false`	boolean
agent.wait_for_lapi.securityContext.runAsUser (1) `0`	number
config."config.yaml.local" (4) `api: server: auto_registration: enabled: true token: "${REGISTRATION_TOKEN}" allowed_ranges: - "127.0.0.1/32" - "192.168.0.0/16" - "10.0.0.0/8" - "172.16.0.0/12" db_config: type: postgresql user: crowdsec password: "${DB_PASSWORD}" db_name: crowdsec host: "${DB_HOST}" port: 5432 sslmode: require`	string
config."profiles.yaml" (4) # Test-only profile: fires on the hub's http-generic-test scenario so # we can validate the notification pipeline without triggering a real # ban. `on_success: continue` keeps the remediation profiles below in # play. Safe to leave (test scenario only matches a magic path) but # can be removed once the Discord wiring is confirmed. name: notify_test filters: - Alert.Scenario == "crowdsecurity/http-generic-test" notifications: - discord on_success: continue --- name: default_ip_remediation filters: - Alert.Remediation == true && Alert.GetScope() == "Ip" decisions: - type: ban duration: 4h notifications: - http_alertmanager - discord on_success: break --- name: default_range_remediation filters: - Alert.Remediation == true && Alert.GetScope() == "Range" decisions: - type: ban duration: 4h notifications: - http_alertmanager - discord on_success: break	string
config.notifications."http.yaml" (2) type: http name: http_alertmanager log_level: info format: \| [ {{ range . -}} { "labels": { "alertname": "CrowdSecDecision", "source": "crowdsec", "scenario": "{{ (index .Decisions 0).Scenario }}", "ip": "{{ (index .Decisions 0).Value }}", "scope": "{{ (index .Decisions 0).Scope }}", "type": "{{ (index .Decisions 0).Type }}", "severity": "warning" }, "annotations": { "summary": "{{ .Scenario }} triggered for {{ (index .Decisions 0).Value }}", "duration": "{{ (index .Decisions 0).Duration }}" } }{{ if not (last) }},{{ end }} {{ end }} ] url: http://kube-prometheus-stack-alertmanager.monitoring.svc.cluster.local:9093/api/v2/alerts method: POST headers: Content-Type: application/json	string
config.notifications."discord.yaml" (1) type: http name: discord log_level: info group_wait: 5s group_threshold: 1 # Taunts only fire when .Decisions is non-empty (actual remediation, # not informational alerts like crowdsecurity/http-generic-test). # Index is seconds-of-minute mod list length: cheap rotation without # needing a stable random seed across alerts. format: \| {{- $taunts := list "L Bozo." "I can't let you do that Dave." "Skill issue." "Press S to Spit" "WASTED" "L + ratio + IP banned." "360 noscoped." "Get rekt." "Scrape these." "Get bezongled" "Hasta La Vista, Baby" "Yeeted into the void." "Thanks for playing. Try again in 4 hours." "Sorry, your vulnerable box is in another castle" "lmao no" -}} {{- $idx := mod (now \| date "05" \| atoi) (len $taunts) -}} {{ range . -}} { "username": "CrowdSec", "embeds": [ { "title": "{{ if .Decisions }}Intruder Locked Out{{ else }}CrowdSec alert{{ end }}", {{- if .Decisions }} "description": "{{ index $taunts $idx }}", {{- end }} "color": 15158332, "fields": [ {"name": "Scenario", "value": "`{{ .Scenario }}`", "inline": false}, {"name": "Source", "value": "`{{ .Source.Value }}`", "inline": true}, {"name": "Scope", "value": "`{{ .Source.Scope }}`", "inline": true}, {{- if .Decisions }} {"name": "Action", "value": "`{{ (index .Decisions 0).Type }}` for `{{ (index .Decisions 0).Duration }}`", "inline": false}, {"name": "Origin", "value": "`{{ (index .Decisions 0).Origin }}`", "inline": true}, {{- end }} {"name": "Events", "value": "{{ .EventsCount }}", "inline": true} ] } ] } {{ end }} url: ${DISCORD_WEBHOOK_URL} method: POST headers: Content-Type: application/json	string
config."console.yaml" (1) `share_manual_decisions: true share_custom: true share_tainted: true share_context: true`	string
config.parsers.s01-parse."client-ip.yaml" (1) # Prefer the Cloudflare-injected edge client IP over the node-local # downstream_remote_address the hub envoy parser derives. Runs after # the hub s01 envoy parser (only it has unmarshaled the JSON); when # the key is absent nothing here matches and the hub fallback wins. filter: evt.Unmarshaled.envoy != nil && evt.Unmarshaled.envoy["cf_connecting_ip"] != nil && evt.Unmarshaled.envoy["cf_connecting_ip"] != "" statics: - meta: source_ip expression: evt.Unmarshaled.envoy["cf_connecting_ip"] onsuccess: break	string
config.parsers.s01-parse."istio-envoy.yaml" (1) filter: "evt.Parsed.program == 'istio-ingress' && evt.Parsed.message startsWith '{'" onsuccess: next_stage name: custom/istio-envoy description: "Parse Istio ingressgateway JSON access logs" # evt.Parsed.message is the raw JSON envoy access log line; we can # JsonExtract directly from it without a grok step. A grok like # %{DATA:json_log} would not work here: DATA is lazy and matches # zero chars at position 0, leaving json_log empty. # # Fields required downstream: # meta.service=http and meta.log_type -> http-logs s02 filter # parsed.request (path with query) -> http-logs grok -> file_name/static_ressource/http_args # parsed.verb, parsed.target_fqdn -> http-* scenario filters and groupby statics: - meta: log_type value: http_access-log - meta: service value: http - parsed: program value: istio - meta: source_ip expression: 'JsonExtract(evt.Parsed.message, "downstream_remote_address")' - meta: http_status expression: 'JsonExtract(evt.Parsed.message, "response_code")' - meta: http_path expression: 'JsonExtract(evt.Parsed.message, "path")' - meta: http_verb expression: 'JsonExtract(evt.Parsed.message, "method")' - meta: http_user_agent expression: 'JsonExtract(evt.Parsed.message, "user_agent")' - parsed: verb expression: 'JsonExtract(evt.Parsed.message, "method")' - parsed: request expression: 'JsonExtract(evt.Parsed.message, "path")' - parsed: target_fqdn expression: 'JsonExtract(evt.Parsed.message, "authority")' - parsed: http_user_agent expression: 'JsonExtract(evt.Parsed.message, "user_agent")'	string
config.scenarios."http-istio-test.yaml" (1) `type: trigger name: custom/http-istio-test description: "Custom HTTP test trigger for the Istio acquisition chain" filter: \| evt.Meta.log_type in ["http_access-log", "http_error-log"] and evt.Meta.http_path == "/crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl" blackhole: 5m groupby: "evt.Meta.source_ip" labels: confidence: 0 spoofable: 3 behavior: "http:test" label: "CrowdSec Generic Test Scenario" service: http remediation: false`	string
tls.enabled (4) `true`	boolean
tls.bouncer.reflector.namespaces[] (2) `- traefik`	string
tls.agent.tlsClientAuth (1) `true`	boolean
tls.certManager.enabled (1) `true`	boolean
appsec.enabled (3) `true`	boolean
appsec.acquisitions[].labels.type (2) `appsec`	string
appsec.acquisitions[].listen_addr (2) `0.0.0.0:7422`	string
appsec.acquisitions[].path (2) `/`	string
appsec.acquisitions[].source (2) `appsec`	string
appsec.acquisitions[].appsec_config (1) `crowdsecurity/appsec-default`	string
appsec.acquisitions[].appsec_configs[] (1) `- crowdsecurity/appsec-default`	string
appsec.env[].name (2) `COLLECTIONS`	string
appsec.env[].value (2) `crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules`	string
appsec.replicas (1) `1`	number
appsec.resources.limits.memory (1) `1Gi`	string
appsec.resources.requests.cpu (1) `100m`	string
appsec.resources.requests.memory (1) `512Mi`	string
image.repository (3) `ghcr.io/crowdsecurity/crowdsec`	string
image.tag (3) `v1.7.8`	string
image.pullPolicy (1) `IfNotPresent`	string
secrets.externalSecret.csLapiSecretKey (2) `csLapiSecret`	string
secrets.externalSecret.name (2) `crowdsec-lapi-shared`	string
secrets.externalSecret.registrationTokenKey (2) `registrationToken`	string
podLabels."app.kubernetes.io/name" (1) `crowdsec`	string

Key

Types

container_runtime (7)

containerd

string

lapi.env[].name (7)

DISABLE_ONLINE_API
ENROLL_KEY
ENROLL_INSTANCE_NAME

string

lapi.env[].value (6)

false
${CSKEY}
cluster

string

lapi.env[].valueFrom.secretKeyRef.key (4)

enroll-key
INIT_POSTGRES_HOST
INIT_POSTGRES_PASS
envoy-bouncer-key
opnsense-bouncer-key

string

lapi.env[].valueFrom.secretKeyRef.name (4)

crowdsec-secret
crowdsec-initdb-secret
crowdsec-initdb-secret
crowdsec-secret
crowdsec-secret

string

lapi.metrics.enabled (7)

true

boolean

lapi.metrics.serviceMonitor.enabled (7)

true

boolean

lapi.dashboard.enabled (5)

false

boolean

lapi.dashboard.ingress.enabled (3)

false

boolean

lapi.dashboard.ingress.host (3)

crowdsec.${DOMAIN_0}

string

lapi.dashboard.ingress.annotations."cert-manager.io/cluster-issuer" (2)

le-prod

string

lapi.dashboard.ingress.annotations."cert-manager.io/private-key-rotation-policy" (2)

Always

string

lapi.dashboard.ingress.annotations."meta.helm.sh/release-name" (2)

traefik

string

lapi.dashboard.ingress.annotations."meta.helm.sh/release-namespace" (2)

traefik

string

lapi.dashboard.ingress.annotations."traefik.ingress.kubernetes.io/router.entrypoints" (2)

websecure

string

lapi.dashboard.ingress.annotations."traefik.ingress.kubernetes.io/router.middlewares" (2)

traefik-chain-basic@kubernetescrd,traefik-bouncer@kubernetescrd,traefik-local@kubernetescrd

string

lapi.dashboard.ingress.annotations."traefik.ingress.kubernetes.io/router.tls" (2)

true

string

lapi.dashboard.ingress.ingressClassName (1)

internal

string

lapi.dashboard.ingress.tls[].hosts[] (1)

- crowdsec-dashboard.internal.${SECRET_DOMAIN}

string

lapi.persistentVolume.config.enabled (5)

true

boolean

lapi.persistentVolume.config.accessModes[] (1)

- ReadWriteOnce

string

lapi.persistentVolume.config.existingClaim (1)

crowdsec-config-pvc

string

lapi.persistentVolume.config.size (1)

100Mi

string

lapi.persistentVolume.data.enabled (5)

false

boolean

lapi.persistentVolume.data.accessModes[] (1)

- ReadWriteOnce

string

lapi.persistentVolume.data.existingClaim (1)

crowdsec-db-pvc

string

lapi.persistentVolume.data.size (1)

1Gi

string

lapi.resources.limits.memory (3)

512M

string

lapi.resources.requests.cpu (3)

15m

string

lapi.resources.requests.memory (3)

184M

string

lapi.deployAnnotations."reloader.stakater.com/auto" (2)

true

string

lapi.enabled (2)

true

boolean

lapi.extraVolumeMounts[].mountPath (2)

/var/lib/crowdsec/data

string

lapi.extraVolumeMounts[].name (2)

crowdsec-data

string

lapi.extraVolumeMounts[].readOnly (1)

true

boolean

lapi.extraVolumes[].name (2)

crowdsec-data

string

lapi.extraVolumes[].hostPath.path (1)

/home/elraro/home-ops/volumes/crowdsec/http.yaml

string

lapi.ingress.enabled (2)

false

boolean

lapi.ingress.host (1)

crowdsec.internal.${SECRET_DOMAIN}

string

lapi.ingress.ingressClassName (1)

internal

string

lapi.ingress.tls[].hosts[] (1)

- crowdsec.internal.${SECRET_DOMAIN}

string

lapi.replicas (2)

number

lapi.service.type (2)

LoadBalancer

string

lapi.service.annotations."lbipam.cilium.io/ips" (1)

10.0.30.33

string

lapi.service.labels."app.kubernetes.io/name" (1)

crowdsec

string

lapi.storeCAPICredentialsInSecret (2)

true

boolean

lapi.storeLAPICscliCredentialsInSecret (2)

true

boolean

lapi.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key (1)

kubernetes.io/arch

string

lapi.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator (1)

In

string

lapi.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].values[] (1)

- amd64

string

lapi.envFrom[].secretRef.name (1)

crowdsec

string

lapi.extraInitContainers[].command[] (1)

- sh
- -c
- cp -a /staging/var/lib/crowdsec/data/. /data/

string

lapi.extraInitContainers[].envFrom[].secretRef.name (1)

crowdsec-initdb-secret

string

lapi.extraInitContainers[].image (1)

ghcr.io/home-operations/postgres-init:18.6.0@sha256:b6d3af974df781c673d37e49bdddfa14a6f5be28b18d2cb7713f0449bea4057b
crowdsecurity/crowdsec:v1.8.1

string

lapi.extraInitContainers[].name (1)

init-db
stage-data

string

lapi.extraInitContainers[].volumeMounts[].mountPath (1)

/data

string

lapi.extraInitContainers[].volumeMounts[].name (1)

crowdsec-data

string

lapi.podLabels."db.home.arpa/postgres" (1)

true

string

lapi.podSecurityContext.seccompProfile.type (1)

RuntimeDefault

string

lapi.securityContext.allowPrivilegeEscalation (1)

false

boolean

lapi.securityContext.privileged (1)

false

boolean

lapi.strategy.type (1)

Recreate

string

agent.acquisition[].namespace (6)

traefik

string

agent.acquisition[].podName (6)

traefik-*

string

agent.acquisition[].program (6)

traefik

string

agent.metrics.enabled (6)

true

boolean

agent.metrics.serviceMonitor.enabled (5)

true

boolean

agent.env[].name (5)

PARSERS
COLLECTIONS
DISABLE_PARSERS

string

agent.env[].value (5)

crowdsecurity/cri-logs
crowdsecurity/traefik
crowdsecurity/whitelists

string

agent.enabled (4)

true

boolean

agent.additionalAcquisition[].source (3)

file

string

agent.additionalAcquisition[].filenames[] (2)

- /nextcloud.log

string

agent.additionalAcquisition[].labels.type (2)

syslog

string

agent.additionalAcquisition[].labels.program (1)

k8s-audit

string

agent.additionalAcquisition[].force_inotify (1)

true

boolean

agent.additionalAcquisition[].listen_addr (1)

0.0.0.0

string

agent.additionalAcquisition[].listen_port (1)

number

agent.extraVolumeMounts[].mountPath (2)

/nextcloud.log
/var/log/containers
/var/log/pods

string

agent.extraVolumeMounts[].name (2)

nextcloud-log
var-log-containers
var-log-pods

string

agent.extraVolumeMounts[].readOnly (1)

true
true
true

boolean

agent.extraVolumes[].name (2)

nextcloud-log
var-log-containers
var-log-pods

string

agent.extraVolumes[].hostPath.path (1)

/mnt/sdc1/nextcloud/data/nextcloud.log
/var/log/containers
/var/log/pods

string

agent.hostVarLog (2)

true

boolean

agent.resources.limits.memory (2)

384Mi

string

agent.resources.requests.cpu (2)

50m

string

agent.resources.requests.memory (2)

128Mi

string

agent.config.common.poll_without_inotify (1)

true

boolean

agent.persistentVolume.config.enabled (1)

true

boolean

agent.persistentVolume.config.existingClaim (1)

crowdsec-agent-config-pvc

string

agent.podSecurityContext.runAsGroup (1)

number

agent.podSecurityContext.runAsNonRoot (1)

false

boolean

agent.podSecurityContext.runAsUser (1)

number

agent.ports[].containerPort (1)

number

agent.ports[].name (1)

syslog

string

agent.ports[].protocol (1)

UDP

string

agent.securityContext.allowPrivilegeEscalation (1)

false

boolean

agent.securityContext.capabilities.drop[] (1)

- ALL

string

agent.securityContext.privileged (1)

false

boolean

agent.service.externalTrafficPolicy (1)

Local

string

agent.service.labels."app.kubernetes.io/name" (1)

crowdsec

string

agent.service.loadBalancerClass (1)

io.cilium/l2-announcer

string

agent.service.loadBalancerIP (1)

${crowdsec_syslog_ip}

string

agent.service.ports[].name (1)

syslog

string

agent.service.ports[].port (1)

number

agent.service.ports[].protocol (1)

UDP

string

agent.service.ports[].targetPort (1)

number

agent.service.type (1)

LoadBalancer

string

agent.tolerations[].operator (1)

Exists

string

agent.wait_for_lapi.securityContext.allowPrivilegeEscalation (1)

false

boolean

agent.wait_for_lapi.securityContext.privileged (1)

false

boolean

agent.wait_for_lapi.securityContext.runAsGroup (1)

number

agent.wait_for_lapi.securityContext.runAsNonRoot (1)

false

boolean

agent.wait_for_lapi.securityContext.runAsUser (1)

number

config."config.yaml.local" (4)

api:
  server:
    auto_registration:
      enabled: true
      token: "${REGISTRATION_TOKEN}"
      allowed_ranges:
        - "127.0.0.1/32"
        - "192.168.0.0/16"
        - "10.0.0.0/8"
        - "172.16.0.0/12"
db_config:
  type: postgresql
  user: crowdsec
  password: "${DB_PASSWORD}"
  db_name: crowdsec
  host: "${DB_HOST}"
  port: 5432
  sslmode: require

string

config."profiles.yaml" (4)

# Test-only profile: fires on the hub's http-generic-test scenario so
# we can validate the notification pipeline without triggering a real
# ban. `on_success: continue` keeps the remediation profiles below in
# play. Safe to leave (test scenario only matches a magic path) but
# can be removed once the Discord wiring is confirmed.
name: notify_test
filters:
  - Alert.Scenario == "crowdsecurity/http-generic-test"
notifications:
  - discord
on_success: continue
---
name: default_ip_remediation
filters:
  - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
  - type: ban
    duration: 4h
notifications:
  - http_alertmanager
  - discord
on_success: break
---
name: default_range_remediation
filters:
  - Alert.Remediation == true && Alert.GetScope() == "Range"
decisions:
  - type: ban
    duration: 4h
notifications:
  - http_alertmanager
  - discord
on_success: break

string

config.notifications."http.yaml" (2)

type: http
name: http_alertmanager
log_level: info
format: |
  [
    {{ range . -}}
    {
      "labels": {
        "alertname": "CrowdSecDecision",
        "source": "crowdsec",
        "scenario": "{{ (index .Decisions 0).Scenario }}",
        "ip": "{{ (index .Decisions 0).Value }}",
        "scope": "{{ (index .Decisions 0).Scope }}",
        "type": "{{ (index .Decisions 0).Type }}",
        "severity": "warning"
      },
      "annotations": {
        "summary": "{{ .Scenario }} triggered for {{ (index .Decisions 0).Value }}",
        "duration": "{{ (index .Decisions 0).Duration }}"
      }
    }{{ if not (last) }},{{ end }}
    {{ end }}
  ]
url: http://kube-prometheus-stack-alertmanager.monitoring.svc.cluster.local:9093/api/v2/alerts
method: POST
headers:
  Content-Type: application/json

string

config.notifications."discord.yaml" (1)

type: http
name: discord
log_level: info
group_wait: 5s
group_threshold: 1
# Taunts only fire when .Decisions is non-empty (actual remediation,
# not informational alerts like crowdsecurity/http-generic-test).
# Index is seconds-of-minute mod list length: cheap rotation without
# needing a stable random seed across alerts.
format: |
  {{- $taunts := list
    "L Bozo."
    "I can't let you do that Dave."
    "Skill issue."
    "Press S to Spit"
    "WASTED"
    "L + ratio + IP banned."
    "360 noscoped."
    "Get rekt."
    "Scrape these."
    "Get bezongled"
    "Hasta La Vista, Baby"
    "Yeeted into the void."
    "Thanks for playing. Try again in 4 hours."
    "Sorry, your vulnerable box is in another castle"
    "lmao no"
  -}}
  {{- $idx := mod (now | date "05" | atoi) (len $taunts) -}}
  {{ range . -}}
  {
    "username": "CrowdSec",
    "embeds": [
      {
        "title": "{{ if .Decisions }}Intruder Locked Out{{ else }}CrowdSec alert{{ end }}",
        {{- if .Decisions }}
        "description": "{{ index $taunts $idx }}",
        {{- end }}
        "color": 15158332,
        "fields": [
          {"name": "Scenario", "value": "`{{ .Scenario }}`", "inline": false},
          {"name": "Source", "value": "`{{ .Source.Value }}`", "inline": true},
          {"name": "Scope", "value": "`{{ .Source.Scope }}`", "inline": true},
          {{- if .Decisions }}
          {"name": "Action", "value": "`{{ (index .Decisions 0).Type }}` for `{{ (index .Decisions 0).Duration }}`", "inline": false},
          {"name": "Origin", "value": "`{{ (index .Decisions 0).Origin }}`", "inline": true},
          {{- end }}
          {"name": "Events", "value": "{{ .EventsCount }}", "inline": true}
        ]
      }
    ]
  }
  {{ end }}
url: ${DISCORD_WEBHOOK_URL}
method: POST
headers:
  Content-Type: application/json

string

config."console.yaml" (1)

share_manual_decisions: true
share_custom: true
share_tainted: true
share_context: true

string

config.parsers.s01-parse."client-ip.yaml" (1)

# Prefer the Cloudflare-injected edge client IP over the node-local
# downstream_remote_address the hub envoy parser derives. Runs after
# the hub s01 envoy parser (only it has unmarshaled the JSON); when
# the key is absent nothing here matches and the hub fallback wins.
filter: evt.Unmarshaled.envoy != nil && evt.Unmarshaled.envoy["cf_connecting_ip"] != nil && evt.Unmarshaled.envoy["cf_connecting_ip"] != ""
statics:
  - meta: source_ip
    expression: evt.Unmarshaled.envoy["cf_connecting_ip"]
onsuccess: break

string

config.parsers.s01-parse."istio-envoy.yaml" (1)

filter: "evt.Parsed.program == 'istio-ingress' && evt.Parsed.message startsWith '{'"
onsuccess: next_stage
name: custom/istio-envoy
description: "Parse Istio ingressgateway JSON access logs"
# evt.Parsed.message is the raw JSON envoy access log line; we can
# JsonExtract directly from it without a grok step. A grok like
# %{DATA:json_log} would *not* work here: DATA is lazy and matches
# zero chars at position 0, leaving json_log empty.
#
# Fields required downstream:
#   meta.service=http and meta.log_type      -> http-logs s02 filter
#   parsed.request (path with query)          -> http-logs grok -> file_name/static_ressource/http_args
#   parsed.verb, parsed.target_fqdn           -> http-* scenario filters and groupby
statics:
  - meta: log_type
    value: http_access-log
  - meta: service
    value: http
  - parsed: program
    value: istio
  - meta: source_ip
    expression: 'JsonExtract(evt.Parsed.message, "downstream_remote_address")'
  - meta: http_status
    expression: 'JsonExtract(evt.Parsed.message, "response_code")'
  - meta: http_path
    expression: 'JsonExtract(evt.Parsed.message, "path")'
  - meta: http_verb
    expression: 'JsonExtract(evt.Parsed.message, "method")'
  - meta: http_user_agent
    expression: 'JsonExtract(evt.Parsed.message, "user_agent")'
  - parsed: verb
    expression: 'JsonExtract(evt.Parsed.message, "method")'
  - parsed: request
    expression: 'JsonExtract(evt.Parsed.message, "path")'
  - parsed: target_fqdn
    expression: 'JsonExtract(evt.Parsed.message, "authority")'
  - parsed: http_user_agent
    expression: 'JsonExtract(evt.Parsed.message, "user_agent")'

string

config.scenarios."http-istio-test.yaml" (1)

type: trigger
name: custom/http-istio-test
description: "Custom HTTP test trigger for the Istio acquisition chain"
filter: |
  evt.Meta.log_type in ["http_access-log", "http_error-log"] and evt.Meta.http_path == "/crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl"
blackhole: 5m
groupby: "evt.Meta.source_ip"
labels:
  confidence: 0
  spoofable: 3
  behavior: "http:test"
  label: "CrowdSec Generic Test Scenario"
  service: http
  remediation: false

string

tls.enabled (4)

true

boolean

tls.bouncer.reflector.namespaces[] (2)

- traefik

string

tls.agent.tlsClientAuth (1)

true

boolean

tls.certManager.enabled (1)

true

boolean

appsec.enabled (3)

true

boolean

appsec.acquisitions[].labels.type (2)

appsec

string

appsec.acquisitions[].listen_addr (2)

0.0.0.0:7422

string

appsec.acquisitions[].path (2)

string

appsec.acquisitions[].source (2)

appsec

string

appsec.acquisitions[].appsec_config (1)

crowdsecurity/appsec-default

string

appsec.acquisitions[].appsec_configs[] (1)

- crowdsecurity/appsec-default

string

appsec.env[].name (2)

COLLECTIONS

string

appsec.env[].value (2)

crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules

string

appsec.replicas (1)

number

appsec.resources.limits.memory (1)

1Gi

string

appsec.resources.requests.cpu (1)

100m

string

appsec.resources.requests.memory (1)

512Mi

string

image.repository (3)

ghcr.io/crowdsecurity/crowdsec

string

image.tag (3)

v1.7.8

string

image.pullPolicy (1)

IfNotPresent

string

secrets.externalSecret.csLapiSecretKey (2)

csLapiSecret

string

secrets.externalSecret.name (2)

crowdsec-lapi-shared

string

secrets.externalSecret.registrationTokenKey (2)

registrationToken

string

podLabels."app.kubernetes.io/name" (1)

crowdsec

string