[stable/sysdig] Add Sysdig Secure support (#2459)

* Implement Sysdig Secure flag and additional env var handling

* Fix template

* Add trailing \n on SecureConf

* Fix linter errors

* Fix linter errors with feeling

stable/sysdig/Chart.yaml

@@ -1,11 +1,13 @@
 name: sysdig
-version: 0.3.0
-description: Sysdig Monitor Agent.
+version: 0.4.0
+description: Sysdig Monitor and Secure agent
 keywords:
   - monitoring
+  - security
   - alerting
   - metric
   - troubleshooting
+  - run-time
 home: https://www.sysdig.com/
 icon: https://app.sysdigcloud.com/images/changelogs/sysdig_monitor.png
 sources:

stable/sysdig/templates/daemonset.yaml

@@ -17,6 +17,9 @@ spec:
         app: {{ template "fullname" . }}
     spec:
       volumes:
+      - name: dshm
+        emptyDir:
+          medium: Memory
       - name: docker-sock
         hostPath:
          path: /var/run/docker.sock
@@ -61,6 +64,15 @@ spec:
               secretKeyRef:
                 name: {{ template "fullname" . }}
                 key: tags
+{{- $additionalconf := .Values.sysdig.AdditionalConf -}}
+{{- if .Values.secure.enable }}
+{{- $additionalconf := printf "%s%s" .Values.secure.SecureConf .Values.sysdig.AdditionalConf -}}
+{{- end }}
+          - name: ADDITIONAL_CONF
+            value: {{ $additionalconf | quote }}
+{{- if .Values.sysdig.env }}
+{{ toYaml .Values.sysdig.env | indent 10 }}
+{{- end }}
         volumeMounts:
         - mountPath: /host/var/run/docker.sock
           name: docker-sock
@@ -80,4 +92,6 @@ spec:
         - mountPath: /host/usr
           name: usr-vol
           readOnly: true
+        - mountPath: /dev/shm
+          name: dshm
 {{- end }}

stable/sysdig/values.yaml

@@ -1,11 +1,11 @@
-# Default values for Sysdig Monitor Helm package.
+# Default values for Sysdig Monitor and Secure Helm package.
 
 rbac:
     # true here enables creation of rbac resources
     install: false
     # rbac version
     apiVersion: v1beta1
-    
+
 image:
     repository: "sysdig/agent"
     tag: "latest"
@@ -13,22 +13,38 @@ image:
 
 sysdig:
     # Required: You need your Sysdig Monitor access key before running agents.
-    #AccessKey: ""
+    # AccessKey: ""
 
     # Optional: Key-value agent tags following the format "key:val,key2:val2".
     AgentTags: ""
 
+    # Optional: additional configuration parameters.
+    # This will be moved into a ConfigMap shortly.
+    AdditionalConf: ""
+
     serviceAccountName: "sysdig-account"
 
+    # Optional: array of additional env variables used for custom config.
+    # env:
+    #   - name:
+    #     value:
+
+secure:
+    # true here enables Sysdig Secure: container run-time security & forensics
+    enable: false
+
+    # Default Sysdig Secure configuration (please add trailing \n)
+    SecureConf: "security: {enabled: true}\ncommandlines_capture: {enabled: true}\nmemdump: {enabled: true}\n"
+
 resources:
-  requests:
-    cpu: 100m
-    memory: 512Mi
-  limits:
-    cpu: 500m
-    memory: 768Mi
+    requests:
+        cpu: 100m
+        memory: 512Mi
+    limits:
+        cpu: 500m
+        memory: 768Mi
 
 # Allow sysdig to run on Kubernetes 1.6 masters.
 tolerations:
-  - effect: NoSchedule
-    key: node-role.kubernetes.io/master
+    - effect: NoSchedule
+      key: node-role.kubernetes.io/master