crowdsec helm release

crowdsec helm

No introduction found. Create it?

More popular helm chart found

crowdsec from crowdsecurity is more popular with 9 repositories.

Install

Install with:

helm repo add crowdsec oci://ghcr.io/crowdsecurity/helm-charts/crowdsec
helm install crowdsec crowdsec/crowdsec -f values.yaml

Examples

See examples from other people.

Major version:

Filter repos who also have:

Top Repositories (3 out of 8)

Name	Repo	Stars	Version	Timestamp
crowdsec	pascaliske/infrastructure	73	0.24.2	a month ago
crowdsec	ToaHartor/maisonneux	43	0.20.1	3 months ago
crowdsec	m00nwtchr/homelab-cluster	39	0.20.1	9 months ago

Name

Repo

Stars

Version

Timestamp

crowdsec

pascaliske/infrastructure

0.24.2

a month ago

crowdsec

ToaHartor/maisonneux

0.20.1

3 months ago

crowdsec

m00nwtchr/homelab-cluster

0.20.1

9 months ago

Values

See the most popular values for this chart:

Key	Types
container_runtime (8) `containerd`	string
lapi.metrics.serviceMonitor.enabled (7) `true`	boolean
lapi.metrics.enabled (3) `true`	boolean
lapi.env[].name (6) `TZ AGENTS_ALLOWED_OU ENROLL_INSTANCE_NAME`	string
lapi.env[].value (5) `${TIMEZONE} agent-ou,appsec-ou cluster`	string
lapi.env[].valueFrom.secretKeyRef.key (2) `csLapiSecret password`	string
lapi.env[].valueFrom.secretKeyRef.name (2) `crowdsec-lapi-secrets ${PSQL_DB_USER}-db-creds`	string
lapi.env[].valueFrom.configMapKeyRef.key (1) `host port username dbname`	string
lapi.env[].valueFrom.configMapKeyRef.name (1) `crowdsec-postgres crowdsec-postgres crowdsec-postgres crowdsec-postgres`	string
lapi.persistentVolume.config.enabled (5) `false`	boolean
lapi.persistentVolume.config.accessModes[] (1) `- ReadWriteOnce`	string
lapi.persistentVolume.config.existingClaim (1) `crowdsec`	string
lapi.persistentVolume.config.size (1) `100Mi`	string
lapi.persistentVolume.config.subPath (1) `config`	string
lapi.persistentVolume.data.enabled (5) `false`	boolean
lapi.persistentVolume.data.accessModes[] (1) `- ReadWriteOnce`	string
lapi.persistentVolume.data.existingClaim (1) `crowdsec-data`	string
lapi.persistentVolume.data.size (1) `1Gi`	string
lapi.resources.limits.memory (5) `512Mi`	string
lapi.resources.requests.cpu (5) `100m`	string
lapi.resources.requests.memory (5) `128Mi`	string
lapi.envFrom[].secretRef.name (4) `crowdsec-secret`	string
lapi.strategy.type (3) `RollingUpdate`	string
lapi.deployAnnotations."reloader.stakater.com/auto" (2) `true`	string
lapi.deployAnnotations."configmap.reloader.stakater.com/auto" (1) `true`	string
lapi.deployAnnotations."secret.reloader.stakater.com/reload" (1) `${SECRET_KEY_NAME},${PSQL_DB_USER}-db-creds`	string
lapi.podSecurityContext.seccompProfile.type (2) `RuntimeDefault`	string
lapi.replicas (2) `2`	number
lapi.securityContext.allowPrivilegeEscalation (2) `false`	boolean
lapi.securityContext.capabilities.drop[] (2) `- ALL`	string
lapi.securityContext.privileged (2) `false`	boolean
lapi.securityContext.seccompProfile.type (1) `RuntimeDefault`	string
lapi.service.annotations."lbipam.cilium.io/ips" (2) `${CROWDSEC_LB_IP}`	string
lapi.service.type (2) `LoadBalancer`	string
lapi.service.externalTrafficPolicy (1) `Local`	string
lapi.storeCAPICredentialsInSecret (2) `false`	boolean
lapi.storeLAPICscliCredentialsInSecret (2) `true`	boolean
lapi.dashboard.enabled (1) `false`	boolean
lapi.extraInitContainers[].envFrom[].secretRef.name (1) `crowdsec-init-db-secret`	string
lapi.extraInitContainers[].image (1) `ghcr.io/home-operations/postgres-init:18@sha256:b6d3af974df781c673d37e49bdddfa14a6f5be28b18d2cb7713f0449bea4057b`	string
lapi.extraInitContainers[].name (1) `init-db`	string
lapi.extraVolumeMounts[].mountPath (1) `/var/run/secrets/postgresql`	string
lapi.extraVolumeMounts[].name (1) `postgres-cert`	string
lapi.extraVolumeMounts[].readOnly (1) `true`	boolean
lapi.extraVolumes[].name (1) `postgres-cert`	string
lapi.extraVolumes[].secret.defaultMode (1) `440`	number
lapi.extraVolumes[].secret.secretName (1) `crowdsec-postgres-cert`	string
lapi.podLabels."app.kubernetes.io/name" (1) `crowdsec-lapi`	string
lapi.priorityClassName (1) `services-important`	string
agent.env[].name (6) `COLLECTIONS PARSERS`	string
agent.env[].value (6) `yanis-kouidri/envoy crowdsecurity/base-http-scenarios crowdsecurity/cri-logs crowdsecurity/whitelists`	string
agent.metrics.serviceMonitor.enabled (6) `true`	boolean
agent.metrics.enabled (2) `true`	boolean
agent.acquisition[].namespace (5) `network`	string
agent.acquisition[].podName (5) `edge-gateway-*`	string
agent.acquisition[].program (5) `envoy`	string
agent.acquisition[].poll_without_inotify (2) `true`	boolean
agent.resources.requests.cpu (4) `100m`	string
agent.resources.requests.memory (3) `128Mi`	string
agent.resources.limits.memory (3) `256Mi`	string
agent.additionalAcquisition[].labels.type (2) `syslog`	string
agent.additionalAcquisition[].source (2) `syslog`	string
agent.additionalAcquisition[].listen_addr (1) `0.0.0.0`	string
agent.additionalAcquisition[].listen_port (1) `514`	number
agent.additionalAcquisition[].namespace (1) `network`	string
agent.additionalAcquisition[].selector (1) `gateway.envoyproxy.io/owning-gateway-name in (envoy-cloudflare,envoy-external)`	string
agent.enabled (2) `true`	boolean
agent.hostVarLog (2) `false`	boolean
agent.isDeployment (2) `true`	boolean
agent.podSecurityContext.seccompProfile.type (2) `RuntimeDefault`	string
agent.securityContext.allowPrivilegeEscalation (2) `false`	boolean
agent.securityContext.capabilities.drop[] (2) `- ALL`	string
agent.securityContext.privileged (2) `false`	boolean
agent.securityContext.seccompProfile.type (1) `RuntimeDefault`	string
agent.strategy.type (2) `RollingUpdate`	string
agent.daemonsetAnnotations."reloader.stakater.com/auto" (1) `true`	string
agent.persistentVolume.config.enabled (1) `false`	boolean
agent.priorityClassName (1) `services-important`	string
agent.replicas (1) `2`	number
agent.service.annotations."lbipam.cilium.io/ips" (1) `${CROWDSEC_AGENT_LB_IP}`	string
agent.service.ports[].name (1) `syslog`	string
agent.service.ports[].port (1) `514`	number
agent.service.ports[].protocol (1) `UDP`	string
agent.service.ports[].targetPort (1) `514`	number
agent.service.type (1) `LoadBalancer`	string
agent.serviceAccountName (1) `crowdsec-agent`	string
agent.startupProbe.failureThreshold (1) `60`	number
agent.startupProbe.initialDelaySeconds (1) `30`	number
agent.tolerations[].effect (1) `NoSchedule`	string
agent.tolerations[].key (1) `node-role.kubernetes.io/control-plane`	string
agent.tolerations[].operator (1) `Exists`	string
agent.wait_for_lapi.securityContext.allowPrivilegeEscalation (1) `false`	boolean
agent.wait_for_lapi.securityContext.capabilities.drop[] (1) `- ALL`	string
agent.wait_for_lapi.securityContext.privileged (1) `false`	boolean
config."config.yaml.local" (6) `api: server: auto_registration: enabled: true token: "${REGISTRATION_TOKEN}" allowed_ranges: - "127.0.0.1/32" - "10.0.0.0/8" db_config: use_wal: true flush: max_age: 7d agents_autodelete: login_password: 1d`	string
config."console.yaml" (3) `share_manual_decisions: false share_custom: true share_tainted: true share_context: true`	string
config."profiles.yaml" (3) `name: default_ip_remediation debug: false filters: - Alert.Remediation == true && Alert.GetScope() == "Ip" decisions: - type: ban duration: 24h # Only locally-generated alerts reach profiles; CAPI blocklist pulls (every 2h) do not notifications: - alertmanager on_success: break`	string
config.parsers.s02-enrich."envoy-418-whitelist.yaml" (2) `name: hydaz/envoy-418-whitelist description: "Whitelist 418 responses from the envoy bouncer to prevent processing already banned IPs" filter: "evt.Meta.service == 'http' && evt.Meta.log_type == 'http_access-log'" whitelist: reason: "envoy bouncer response to already banned ips" expression: - "evt.Meta.http_status == '418'"`	string
config.parsers.s02-enrich."edge-whitelist.yaml" (1) `name: artemis/edge-whitelist description: Frostlink's own public IP, which probes edge-gateway through towonel whitelist: reason: frostlink relay and probes ip: - 40.233.88.33`	string
config.parsers.s02-enrich."spa-api-requests.yaml" (1) `name: hydaz/spa-api-requests description: "One Jellyfin home screen is 46 distinct extensionless API calls in 10s; http-crawl-non_statics caps at 40 per 20s and bans the client" # 2xx only: these endpoints 401 without a token, and enumeration shows up as 4xx for http-probing filter: "evt.Meta.target_fqdn in ['jellyfin.${SECRET_DOMAIN}', 'jellyseerr.${SECRET_DOMAIN}'] && evt.Meta.http_verb in ['GET', 'HEAD'] && evt.Meta.http_status startsWith '2'" statics: - parsed: static_ressource value: "true"`	string
config.parsers.s02-enrich."wordpress-api-whitelist.yaml" (1) `name: hydaz/wordpress-api-whitelist description: "Whitelist legitimate WordPress API calls" filter: "evt.Meta.service == 'http' && evt.Meta.log_type == 'http_access-log'" whitelist: reason: "legitimate wordpress api call" expression: - "evt.Meta.http_path contains '/wp-json/wp/v2/posts' && evt.Meta.http_path contains 'context=edit' && evt.Meta.http_status == '200'"`	string
config.parsers.s01-parse."envoy-logs.yaml" (1) filter: "evt.Parsed.program startsWith 'envoy' && evt.Parsed.message contains ':authority'" onsuccess: next_stage name: hydaz/envoy-logs description: "Parse Envoy access logs to match nginx parser outputs" statics: - parsed: json expression: UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "envoy") - parsed: time_local expression: evt.Unmarshaled.envoy["start_time"] - parsed: remote_addr expression: Split(evt.Unmarshaled.envoy["x-forwarded-for"], ",")[0] - parsed: verb expression: evt.Unmarshaled.envoy["method"] - parsed: request expression: evt.Unmarshaled.envoy["x-envoy-origin-path"] - parsed: http_version expression: TrimPrefix(evt.Unmarshaled.envoy["protocol"], "HTTP/") # %v not %.0f: the envoy access-log schema is Envoy Gateway's implicit default, # so a future release emitting these as strings would silently corrupt status - parsed: status expression: Sprintf('%v', evt.Unmarshaled.envoy["response_code"]) - parsed: body_bytes_sent expression: Sprintf('%v', evt.Unmarshaled.envoy["bytes_sent"]) - parsed: http_user_agent expression: evt.Unmarshaled.envoy["user-agent"] - parsed: target_fqdn expression: evt.Unmarshaled.envoy[":authority"] - meta: service value: http - meta: log_type value: http_access-log - meta: source_ip expression: evt.Parsed.remote_addr - meta: http_status expression: evt.Parsed.status - meta: http_path expression: evt.Parsed.request - meta: http_verb expression: evt.Parsed.verb - meta: http_user_agent expression: evt.Parsed.http_user_agent - meta: target_fqdn expression: evt.Parsed.target_fqdn	string
config."agent_config.yaml.local" (1) `cscli: hub_branch: master`	string
config."appsec_config.yaml.local" (1) `cscli: hub_branch: master`	string
config.notifications."alertmanager.yaml" (1) type: http name: alertmanager # Alertmanager already groups before anything reaches discord, so no plugin-side # batching; max_retry stays because a dropped ban notification is a lost signal max_retry: 3 # Every value goes through toJson: the URL and user-agent are attacker-controlled format: \| [{{range $i, $a := .}}{{if $i}},{{end}}{ "labels": { "alertname": "CrowdsecDecision", "severity": "warning", "scenario": {{$a.GetScenario \| toJson}}, "source_ip": {{$a.Source.IP \| toJson}} }, "annotations": { "summary": {{$a.GetScenario \| toJson}}, "description": "crowdsec issued a ban; client and request per alert below", "origin": {{if and $a.Source.Cn $a.Source.AsName}}{{printf "%s / %s" $a.Source.Cn $a.Source.AsName \| toJson}}{{else}}{{printf "%s%s" $a.Source.Cn $a.Source.AsName \| toJson}}{{end}}, "request": {{if $a.Events}}{{$e := index $a.Events 0}}{{printf "%s %s%s %s (%s)" ($e.GetMeta "http_verb") ($e.GetMeta "target_fqdn") ($e.GetMeta "http_path") ($e.GetMeta "http_status") ($e.GetMeta "http_user_agent") \| toJson}}{{else}}"none"{{end}} }, "startsAt": {{$a.StartAt \| toJson}} }{{end}}] url: http://vmalertmanager-victoria-metrics.observability.svc.cluster.local:9093/api/v2/alerts method: POST headers: Content-Type: application/json	string
config.notifications."http.yaml" (1) type: http name: http_victorialogs log_level: info # JSON Lines 格式要求每条记录必须是单行 # 字段说明: # _msg: 消息内容, _time: 时间戳(毫秒), instance: 实例名 # country: 国家, asname: AS名称, asnumber: AS号 # latitude/longitude: 经纬度, iprange: IP范围 # scenario: 场景, type: 类型, duration: 时长, scope: 范围, ip: IP地址 format: \| {{- range $Alert := . -}} {{- range .Decisions }} {"_msg":"CrowdSec Decision: {{.Scenario}}","_time":"{{now \| unixEpoch}}000","instance":"k8s","country":{{$Alert.Source.Cn \| toJson}},"asname":{{$Alert.Source.AsName \| toJson}},"asnumber":"{{$Alert.Source.AsNumber}}","latitude":"{{$Alert.Source.Latitude}}","longitude":"{{$Alert.Source.Longitude}}","iprange":{{$Alert.Source.Range \| toJson}},"scenario":{{.Scenario \| toJson}},"type":{{.Type \| toJson}},"duration":{{.Duration \| toJson}},"scope":{{.Scope \| toJson}},"ip":{{.Value \| toJson}}} {{- end }} {{- end -}} url: http://victoria-logs-server.observability.svc.cluster.local:9428/insert/jsonline?_stream_fields=instance,scenario method: POST headers: Content-Type: application/stream+json	string
config.notifications."wecom.yaml" (1) type: http name: http_wecom log_level: info format: \| {{- range $Alert := . -}} {{- range .Decisions }} { "msgtype": "markdown", "markdown": { "content": "🚨 CrowdSec 安全告警\n> 场景: {{ .Scenario }}\n> IP: {{ .Value }}\n> 国家: {{ $Alert.Source.Cn }}\n> ASN: {{ $Alert.Source.AsName }} ({{ $Alert.Source.AsNumber }})\n> 封禁时长: {{ .Duration }}\n> 类型: {{ .Type }}" } } {{- end }} {{- end -}} url: https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=${WECOM_BOT_TOKEN} method: POST headers: Content-Type: application/json	string
config.postoverflows.s01-whitelist."01-whitelist-home.yaml" (1) `name: crowdsec/whitelist-home description: "Whitelist own infrastructure IP ranges" whitelist: reason: "Own infrastructure" cidr: - "10.0.0.0/16" - "${CLUSTER_POD_CIDR}" - "${CLOUD_NODE_V4_CIDR}" - "${CLOUD_NODE_V6_CIDR}"`	string
config."simulation.yaml" (1) `simulation: true`	string
appsec.acquisitions[].labels.type (4) `appsec`	string
appsec.acquisitions[].listen_addr (4) `0.0.0.0:7422`	string
appsec.acquisitions[].path (4) `/`	string
appsec.acquisitions[].source (4) `appsec`	string
appsec.acquisitions[].appsec_config (3) `crowdsecurity/appsec-default`	string
appsec.acquisitions[].appsec_configs[] (1) `- crowdsecurity/appsec-default - crowdsecurity/crs - local/jellyfin-exclusions`	string
appsec.enabled (4) `true`	boolean
appsec.env[].name (4) `COLLECTIONS`	string
appsec.env[].value (4) `crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules`	string
appsec.resources.limits.memory (4) `256Mi`	string
appsec.resources.limits.cpu (1) `500m`	string
appsec.resources.requests.cpu (4) `100m`	string
appsec.resources.requests.memory (4) `128Mi`	string
appsec.metrics.serviceMonitor.enabled (2) `true`	boolean
appsec.replicas (2) `2`	number
appsec.strategy.type (2) `RollingUpdate`	string
appsec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchLabels.k8s-app (1) `crowdsec`	string
appsec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchLabels.type (1) `appsec`	string
appsec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.topologyKey (1) `kubernetes.io/hostname`	string
appsec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight (1) `100`	number
appsec.configs."jellyfin-exclusions.yaml" (1) `name: local/jellyfin-exclusions pre_eval: - filter: IsOutBand == true && req.URL.Path == "/Sessions/Playing/Progress" apply: - RemoveOutBandRuleByID(932370)`	string
appsec.deployAnnotations."reloader.stakater.com/auto" (1) `true`	string
appsec.podSecurityContext.seccompProfile.type (1) `RuntimeDefault`	string
appsec.securityContext.allowPrivilegeEscalation (1) `false`	boolean
appsec.securityContext.capabilities.drop[] (1) `- ALL`	string
appsec.securityContext.privileged (1) `false`	boolean
appsec.service.type (1) `ClusterIP`	string
appsec.wait_for_lapi.securityContext.allowPrivilegeEscalation (1) `false`	boolean
appsec.wait_for_lapi.securityContext.capabilities.drop[] (1) `- ALL`	string
appsec.wait_for_lapi.securityContext.privileged (1) `false`	boolean
image.repository (3) `ghcr.io/crowdsecurity/crowdsec`	string
image.pullPolicy (2) `IfNotPresent`	string
image.tag (2) `v1.8.1@sha256:0f2523fa61ef507f15d953045cface490cc880670c62f2755ced17524107f71a`	string
tls.enabled (2) `true`	boolean
tls.certManager.secretTemplate.annotations."app.kubernetes.io/managed-by" (1) `crowdsec`	string
deploymentAnnotations."configmap.reloader.stakater.com/auto" (1) `true`	string
deploymentAnnotations."secret.reloader.stakater.com/reload" (1) `${SECRET_KEY_NAME},${PSQL_DB_USER}-db-creds`	string
secrets.externalSecret.csLapiSecretKey (1) `CROWDSEC_LAPI_SECRET`	string
secrets.externalSecret.name (1) `crowdsec-secret`	string
secrets.externalSecret.registrationTokenKey (1) `REGISTRATION_TOKEN`	string

Key

Types

container_runtime (8)

containerd

string

lapi.metrics.serviceMonitor.enabled (7)

true

boolean

lapi.metrics.enabled (3)

true

boolean

lapi.env[].name (6)

TZ
AGENTS_ALLOWED_OU
ENROLL_INSTANCE_NAME

string

lapi.env[].value (5)

${TIMEZONE}
agent-ou,appsec-ou
cluster

string

lapi.env[].valueFrom.secretKeyRef.key (2)

csLapiSecret
password

string

lapi.env[].valueFrom.secretKeyRef.name (2)

crowdsec-lapi-secrets
${PSQL_DB_USER}-db-creds

string

lapi.env[].valueFrom.configMapKeyRef.key (1)

host
port
username
dbname

string

lapi.env[].valueFrom.configMapKeyRef.name (1)

crowdsec-postgres
crowdsec-postgres
crowdsec-postgres
crowdsec-postgres

string

lapi.persistentVolume.config.enabled (5)

false

boolean

lapi.persistentVolume.config.accessModes[] (1)

- ReadWriteOnce

string

lapi.persistentVolume.config.existingClaim (1)

crowdsec

string

lapi.persistentVolume.config.size (1)

100Mi

string

lapi.persistentVolume.config.subPath (1)

config

string

lapi.persistentVolume.data.enabled (5)

false

boolean

lapi.persistentVolume.data.accessModes[] (1)

- ReadWriteOnce

string

lapi.persistentVolume.data.existingClaim (1)

crowdsec-data

string

lapi.persistentVolume.data.size (1)

1Gi

string

lapi.resources.limits.memory (5)

512Mi

string

lapi.resources.requests.cpu (5)

100m

string

lapi.resources.requests.memory (5)

128Mi

string

lapi.envFrom[].secretRef.name (4)

crowdsec-secret

string

lapi.strategy.type (3)

RollingUpdate

string

lapi.deployAnnotations."reloader.stakater.com/auto" (2)

true

string

lapi.deployAnnotations."configmap.reloader.stakater.com/auto" (1)

true

string

lapi.deployAnnotations."secret.reloader.stakater.com/reload" (1)

${SECRET_KEY_NAME},${PSQL_DB_USER}-db-creds

string

lapi.podSecurityContext.seccompProfile.type (2)

RuntimeDefault

string

lapi.replicas (2)

number

lapi.securityContext.allowPrivilegeEscalation (2)

false

boolean

lapi.securityContext.capabilities.drop[] (2)

- ALL

string

lapi.securityContext.privileged (2)

false

boolean

lapi.securityContext.seccompProfile.type (1)

RuntimeDefault

string

lapi.service.annotations."lbipam.cilium.io/ips" (2)

${CROWDSEC_LB_IP}

string

lapi.service.type (2)

LoadBalancer

string

lapi.service.externalTrafficPolicy (1)

Local

string

lapi.storeCAPICredentialsInSecret (2)

false

boolean

lapi.storeLAPICscliCredentialsInSecret (2)

true

boolean

lapi.dashboard.enabled (1)

false

boolean

lapi.extraInitContainers[].envFrom[].secretRef.name (1)

crowdsec-init-db-secret

string

lapi.extraInitContainers[].image (1)

ghcr.io/home-operations/postgres-init:18@sha256:b6d3af974df781c673d37e49bdddfa14a6f5be28b18d2cb7713f0449bea4057b

string

lapi.extraInitContainers[].name (1)

init-db

string

lapi.extraVolumeMounts[].mountPath (1)

/var/run/secrets/postgresql

string

lapi.extraVolumeMounts[].name (1)

postgres-cert

string

lapi.extraVolumeMounts[].readOnly (1)

true

boolean

lapi.extraVolumes[].name (1)

postgres-cert

string

lapi.extraVolumes[].secret.defaultMode (1)

number

lapi.extraVolumes[].secret.secretName (1)

crowdsec-postgres-cert

string

lapi.podLabels."app.kubernetes.io/name" (1)

crowdsec-lapi

string

lapi.priorityClassName (1)

services-important

string

agent.env[].name (6)

COLLECTIONS
PARSERS

string

agent.env[].value (6)

yanis-kouidri/envoy crowdsecurity/base-http-scenarios
crowdsecurity/cri-logs crowdsecurity/whitelists

string

agent.metrics.serviceMonitor.enabled (6)

true

boolean

agent.metrics.enabled (2)

true

boolean

agent.acquisition[].namespace (5)

network

string

agent.acquisition[].podName (5)

edge-gateway-*

string

agent.acquisition[].program (5)

envoy

string

agent.acquisition[].poll_without_inotify (2)

true

boolean

agent.resources.requests.cpu (4)

100m

string

agent.resources.requests.memory (3)

128Mi

string

agent.resources.limits.memory (3)

256Mi

string

agent.additionalAcquisition[].labels.type (2)

syslog

string

agent.additionalAcquisition[].source (2)

syslog

string

agent.additionalAcquisition[].listen_addr (1)

0.0.0.0

string

agent.additionalAcquisition[].listen_port (1)

number

agent.additionalAcquisition[].namespace (1)

network

string

agent.additionalAcquisition[].selector (1)

gateway.envoyproxy.io/owning-gateway-name in (envoy-cloudflare,envoy-external)

string

agent.enabled (2)

true

boolean

agent.hostVarLog (2)

false

boolean

agent.isDeployment (2)

true

boolean

agent.podSecurityContext.seccompProfile.type (2)

RuntimeDefault

string

agent.securityContext.allowPrivilegeEscalation (2)

false

boolean

agent.securityContext.capabilities.drop[] (2)

- ALL

string

agent.securityContext.privileged (2)

false

boolean

agent.securityContext.seccompProfile.type (1)

RuntimeDefault

string

agent.strategy.type (2)

RollingUpdate

string

agent.daemonsetAnnotations."reloader.stakater.com/auto" (1)

true

string

agent.persistentVolume.config.enabled (1)

false

boolean

agent.priorityClassName (1)

services-important

string

agent.replicas (1)

number

agent.service.annotations."lbipam.cilium.io/ips" (1)

${CROWDSEC_AGENT_LB_IP}

string

agent.service.ports[].name (1)

syslog

string

agent.service.ports[].port (1)

number

agent.service.ports[].protocol (1)

UDP

string

agent.service.ports[].targetPort (1)

number

agent.service.type (1)

LoadBalancer

string

agent.serviceAccountName (1)

crowdsec-agent

string

agent.startupProbe.failureThreshold (1)

number

agent.startupProbe.initialDelaySeconds (1)

number

agent.tolerations[].effect (1)

NoSchedule

string

agent.tolerations[].key (1)

node-role.kubernetes.io/control-plane

string

agent.tolerations[].operator (1)

Exists

string

agent.wait_for_lapi.securityContext.allowPrivilegeEscalation (1)

false

boolean

agent.wait_for_lapi.securityContext.capabilities.drop[] (1)

- ALL

string

agent.wait_for_lapi.securityContext.privileged (1)

false

boolean

config."config.yaml.local" (6)

api:
  server:
    auto_registration:
      enabled: true
      token: "${REGISTRATION_TOKEN}"
      allowed_ranges:
        - "127.0.0.1/32"
        - "10.0.0.0/8"
db_config:
  use_wal: true
  flush:
    max_age: 7d
    agents_autodelete:
      login_password: 1d

string

config."console.yaml" (3)

share_manual_decisions: false
share_custom: true
share_tainted: true
share_context: true

string

config."profiles.yaml" (3)

name: default_ip_remediation
debug: false
filters:
  - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
  - type: ban
    duration: 24h
# Only locally-generated alerts reach profiles; CAPI blocklist pulls (every 2h) do not
notifications:
  - alertmanager
on_success: break

string

config.parsers.s02-enrich."envoy-418-whitelist.yaml" (2)

name: hydaz/envoy-418-whitelist
description: "Whitelist 418 responses from the envoy bouncer to prevent processing already banned IPs"
filter: "evt.Meta.service == 'http' && evt.Meta.log_type == 'http_access-log'"
whitelist:
  reason: "envoy bouncer response to already banned ips"
  expression:
    - "evt.Meta.http_status == '418'"

string

config.parsers.s02-enrich."edge-whitelist.yaml" (1)

name: artemis/edge-whitelist
description: Frostlink's own public IP, which probes edge-gateway through towonel
whitelist:
  reason: frostlink relay and probes
  ip:
    - 40.233.88.33

string

config.parsers.s02-enrich."spa-api-requests.yaml" (1)

name: hydaz/spa-api-requests
description: "One Jellyfin home screen is 46 distinct extensionless API calls in 10s; http-crawl-non_statics caps at 40 per 20s and bans the client"
# 2xx only: these endpoints 401 without a token, and enumeration shows up as 4xx for http-probing
filter: "evt.Meta.target_fqdn in ['jellyfin.${SECRET_DOMAIN}', 'jellyseerr.${SECRET_DOMAIN}'] && evt.Meta.http_verb in ['GET', 'HEAD'] && evt.Meta.http_status startsWith '2'"
statics:
  - parsed: static_ressource
    value: "true"

string

config.parsers.s02-enrich."wordpress-api-whitelist.yaml" (1)

name: hydaz/wordpress-api-whitelist
description: "Whitelist legitimate WordPress API calls"
filter: "evt.Meta.service == 'http' && evt.Meta.log_type == 'http_access-log'"
whitelist:
  reason: "legitimate wordpress api call"
  expression:
    - "evt.Meta.http_path contains '/wp-json/wp/v2/posts' && evt.Meta.http_path contains 'context=edit' && evt.Meta.http_status == '200'"

string

config.parsers.s01-parse."envoy-logs.yaml" (1)

filter: "evt.Parsed.program startsWith 'envoy' && evt.Parsed.message contains ':authority'"
onsuccess: next_stage
name: hydaz/envoy-logs
description: "Parse Envoy access logs to match nginx parser outputs"
statics:
  - parsed: json
    expression: UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "envoy")
  - parsed: time_local
    expression: evt.Unmarshaled.envoy["start_time"]
  - parsed: remote_addr
    expression: Split(evt.Unmarshaled.envoy["x-forwarded-for"], ",")[0]
  - parsed: verb
    expression: evt.Unmarshaled.envoy["method"]
  - parsed: request
    expression: evt.Unmarshaled.envoy["x-envoy-origin-path"]
  - parsed: http_version
    expression: TrimPrefix(evt.Unmarshaled.envoy["protocol"], "HTTP/")
  # %v not %.0f: the envoy access-log schema is Envoy Gateway's implicit default,
  # so a future release emitting these as strings would silently corrupt status
  - parsed: status
    expression: Sprintf('%v', evt.Unmarshaled.envoy["response_code"])
  - parsed: body_bytes_sent
    expression: Sprintf('%v', evt.Unmarshaled.envoy["bytes_sent"])
  - parsed: http_user_agent
    expression: evt.Unmarshaled.envoy["user-agent"]
  - parsed: target_fqdn
    expression: evt.Unmarshaled.envoy[":authority"]
  - meta: service
    value: http
  - meta: log_type
    value: http_access-log
  - meta: source_ip
    expression: evt.Parsed.remote_addr
  - meta: http_status
    expression: evt.Parsed.status
  - meta: http_path
    expression: evt.Parsed.request
  - meta: http_verb
    expression: evt.Parsed.verb
  - meta: http_user_agent
    expression: evt.Parsed.http_user_agent
  - meta: target_fqdn
    expression: evt.Parsed.target_fqdn

string

config."agent_config.yaml.local" (1)

cscli:
  hub_branch: master

string

config."appsec_config.yaml.local" (1)

cscli:
  hub_branch: master

string

config.notifications."alertmanager.yaml" (1)

type: http
name: alertmanager
# Alertmanager already groups before anything reaches discord, so no plugin-side
# batching; max_retry stays because a dropped ban notification is a lost signal
max_retry: 3
# Every value goes through toJson: the URL and user-agent are attacker-controlled
format: |
  [{{range $i, $a := .}}{{if $i}},{{end}}{
    "labels": {
      "alertname": "CrowdsecDecision",
      "severity": "warning",
      "scenario": {{$a.GetScenario | toJson}},
      "source_ip": {{$a.Source.IP | toJson}}
    },
    "annotations": {
      "summary": {{$a.GetScenario | toJson}},
      "description": "crowdsec issued a ban; client and request per alert below",
      "origin": {{if and $a.Source.Cn $a.Source.AsName}}{{printf "%s / %s" $a.Source.Cn $a.Source.AsName | toJson}}{{else}}{{printf "%s%s" $a.Source.Cn $a.Source.AsName | toJson}}{{end}},
      "request": {{if $a.Events}}{{$e := index $a.Events 0}}{{printf "%s %s%s %s (%s)" ($e.GetMeta "http_verb") ($e.GetMeta "target_fqdn") ($e.GetMeta "http_path") ($e.GetMeta "http_status") ($e.GetMeta "http_user_agent") | toJson}}{{else}}"none"{{end}}
    },
    "startsAt": {{$a.StartAt | toJson}}
  }{{end}}]
url: http://vmalertmanager-victoria-metrics.observability.svc.cluster.local:9093/api/v2/alerts
method: POST
headers:
  Content-Type: application/json

string

config.notifications."http.yaml" (1)

type: http
name: http_victorialogs
log_level: info
# JSON Lines 格式要求每条记录必须是单行
# 字段说明:
#   _msg: 消息内容, _time: 时间戳(毫秒), instance: 实例名
#   country: 国家, asname: AS名称, asnumber: AS号
#   latitude/longitude: 经纬度, iprange: IP范围
#   scenario: 场景, type: 类型, duration: 时长, scope: 范围, ip: IP地址
format: |
  {{- range $Alert := . -}}
  {{- range .Decisions }}
  {"_msg":"CrowdSec Decision: {{.Scenario}}","_time":"{{now | unixEpoch}}000","instance":"k8s","country":{{$Alert.Source.Cn | toJson}},"asname":{{$Alert.Source.AsName | toJson}},"asnumber":"{{$Alert.Source.AsNumber}}","latitude":"{{$Alert.Source.Latitude}}","longitude":"{{$Alert.Source.Longitude}}","iprange":{{$Alert.Source.Range | toJson}},"scenario":{{.Scenario | toJson}},"type":{{.Type | toJson}},"duration":{{.Duration | toJson}},"scope":{{.Scope | toJson}},"ip":{{.Value | toJson}}}
  {{- end }}
  {{- end -}}
url: http://victoria-logs-server.observability.svc.cluster.local:9428/insert/jsonline?_stream_fields=instance,scenario
method: POST
headers:
  Content-Type: application/stream+json

string

config.notifications."wecom.yaml" (1)

type: http
name: http_wecom
log_level: info
format: |
  {{- range $Alert := . -}}
  {{- range .Decisions }}
  {
    "msgtype": "markdown",
    "markdown": {
      "content": "🚨 **CrowdSec 安全告警**\n> **场景**: {{ .Scenario }}\n> **IP**: {{ .Value }}\n> **国家**: {{ $Alert.Source.Cn }}\n> **ASN**: {{ $Alert.Source.AsName }} ({{ $Alert.Source.AsNumber }})\n> **封禁时长**: {{ .Duration }}\n> **类型**: {{ .Type }}"
    }
  }
  {{- end }}
  {{- end -}}
url: https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=${WECOM_BOT_TOKEN}
method: POST
headers:
  Content-Type: application/json

string

config.postoverflows.s01-whitelist."01-whitelist-home.yaml" (1)

name: crowdsec/whitelist-home
description: "Whitelist own infrastructure IP ranges"
whitelist:
  reason: "Own infrastructure"
  cidr:
    - "10.0.0.0/16"
    - "${CLUSTER_POD_CIDR}"
    - "${CLOUD_NODE_V4_CIDR}"
    - "${CLOUD_NODE_V6_CIDR}"

string

config."simulation.yaml" (1)

simulation: true

string

appsec.acquisitions[].labels.type (4)

appsec

string

appsec.acquisitions[].listen_addr (4)

0.0.0.0:7422

string

appsec.acquisitions[].path (4)

string

appsec.acquisitions[].source (4)

appsec

string

appsec.acquisitions[].appsec_config (3)

crowdsecurity/appsec-default

string

appsec.acquisitions[].appsec_configs[] (1)

- crowdsecurity/appsec-default
- crowdsecurity/crs
- local/jellyfin-exclusions

string

appsec.enabled (4)

true

boolean

appsec.env[].name (4)

COLLECTIONS

string

appsec.env[].value (4)

crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules

string

appsec.resources.limits.memory (4)

256Mi

string

appsec.resources.limits.cpu (1)

500m

string

appsec.resources.requests.cpu (4)

100m

string

appsec.resources.requests.memory (4)

128Mi

string

appsec.metrics.serviceMonitor.enabled (2)

true

boolean

appsec.replicas (2)

number

appsec.strategy.type (2)

RollingUpdate

string

appsec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchLabels.k8s-app (1)

crowdsec

string

appsec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.labelSelector.matchLabels.type (1)

appsec

string

appsec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].podAffinityTerm.topologyKey (1)

kubernetes.io/hostname

string

appsec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight (1)

number

appsec.configs."jellyfin-exclusions.yaml" (1)

name: local/jellyfin-exclusions
pre_eval:
  - filter: IsOutBand == true && req.URL.Path == "/Sessions/Playing/Progress"
    apply:
      - RemoveOutBandRuleByID(932370)

string

appsec.deployAnnotations."reloader.stakater.com/auto" (1)

true

string

appsec.podSecurityContext.seccompProfile.type (1)

RuntimeDefault

string

appsec.securityContext.allowPrivilegeEscalation (1)

false

boolean

appsec.securityContext.capabilities.drop[] (1)

- ALL

string

appsec.securityContext.privileged (1)

false

boolean

appsec.service.type (1)

ClusterIP

string

appsec.wait_for_lapi.securityContext.allowPrivilegeEscalation (1)

false

boolean

appsec.wait_for_lapi.securityContext.capabilities.drop[] (1)

- ALL

string

appsec.wait_for_lapi.securityContext.privileged (1)

false

boolean

image.repository (3)

ghcr.io/crowdsecurity/crowdsec

string

image.pullPolicy (2)

IfNotPresent

string

image.tag (2)

v1.8.1@sha256:0f2523fa61ef507f15d953045cface490cc880670c62f2755ced17524107f71a

string

tls.enabled (2)

true

boolean

tls.certManager.secretTemplate.annotations."app.kubernetes.io/managed-by" (1)

crowdsec

string

deploymentAnnotations."configmap.reloader.stakater.com/auto" (1)

true

string

deploymentAnnotations."secret.reloader.stakater.com/reload" (1)

${SECRET_KEY_NAME},${PSQL_DB_USER}-db-creds

string

secrets.externalSecret.csLapiSecretKey (1)

CROWDSEC_LAPI_SECRET

string

secrets.externalSecret.name (1)

crowdsec-secret

string

secrets.externalSecret.registrationTokenKey (1)

REGISTRATION_TOKEN

string