From 195412751bee0c8eca75aa3cfcbc1fd0cb0ba559 Mon Sep 17 00:00:00 2001
From: Jorge Salamero Sanz <bencer@users.noreply.github.com>
Date: Thu, 9 Nov 2017 06:25:01 +0100
Subject: [PATCH] [stable/sysdig] Add Sysdig Secure support (#2459)

* Implement Sysdig Secure flag and additional env var handling

* Fix template

* Add trailing \n on SecureConf

* Fix linter errors

* Fix linter errors with feeling
---
 stable/sysdig/Chart.yaml               |  6 ++--
 stable/sysdig/templates/daemonset.yaml | 14 ++++++++++
 stable/sysdig/values.yaml              | 38 ++++++++++++++++++--------
 3 files changed, 45 insertions(+), 13 deletions(-)

diff --git a/stable/sysdig/Chart.yaml b/stable/sysdig/Chart.yaml
index e070a11640..6dfd336fbd 100755
--- a/stable/sysdig/Chart.yaml
+++ b/stable/sysdig/Chart.yaml
@@ -1,11 +1,13 @@
 name: sysdig
-version: 0.3.0
-description: Sysdig Monitor Agent.
+version: 0.4.0
+description: Sysdig Monitor and Secure agent
 keywords:
   - monitoring
+  - security
   - alerting
   - metric
   - troubleshooting
+  - run-time
 home: https://www.sysdig.com/
 icon: https://app.sysdigcloud.com/images/changelogs/sysdig_monitor.png
 sources:
diff --git a/stable/sysdig/templates/daemonset.yaml b/stable/sysdig/templates/daemonset.yaml
index a8d804c401..af18395edd 100644
--- a/stable/sysdig/templates/daemonset.yaml
+++ b/stable/sysdig/templates/daemonset.yaml
@@ -17,6 +17,9 @@ spec:
         app: {{ template "fullname" . }}
     spec:
       volumes:
+      - name: dshm
+        emptyDir:
+          medium: Memory
       - name: docker-sock
         hostPath:
          path: /var/run/docker.sock
@@ -61,6 +64,15 @@ spec:
               secretKeyRef:
                 name: {{ template "fullname" . }}
                 key: tags
+{{- $additionalconf := .Values.sysdig.AdditionalConf -}}
+{{- if .Values.secure.enable }}
+{{- $additionalconf := printf "%s%s" .Values.secure.SecureConf .Values.sysdig.AdditionalConf -}}
+{{- end }}
+          - name: ADDITIONAL_CONF
+            value: {{ $additionalconf | quote }}
+{{- if .Values.sysdig.env }}
+{{ toYaml .Values.sysdig.env | indent 10 }}
+{{- end }}
         volumeMounts:
         - mountPath: /host/var/run/docker.sock
           name: docker-sock
@@ -80,4 +92,6 @@ spec:
         - mountPath: /host/usr
           name: usr-vol
           readOnly: true
+        - mountPath: /dev/shm
+          name: dshm
 {{- end }}
diff --git a/stable/sysdig/values.yaml b/stable/sysdig/values.yaml
index 74c453c161..5fe1c0accf 100644
--- a/stable/sysdig/values.yaml
+++ b/stable/sysdig/values.yaml
@@ -1,11 +1,11 @@
-# Default values for Sysdig Monitor Helm package.
+# Default values for Sysdig Monitor and Secure Helm package.
 
 rbac:
     # true here enables creation of rbac resources
     install: false
     # rbac version
     apiVersion: v1beta1
-    
+
 image:
     repository: "sysdig/agent"
     tag: "latest"
@@ -13,22 +13,38 @@ image:
 
 sysdig:
     # Required: You need your Sysdig Monitor access key before running agents.
-    #AccessKey: ""
+    # AccessKey: ""
 
     # Optional: Key-value agent tags following the format "key:val,key2:val2".
     AgentTags: ""
 
+    # Optional: additional configuration parameters.
+    # This will be moved into a ConfigMap shortly.
+    AdditionalConf: ""
+
     serviceAccountName: "sysdig-account"
 
+    # Optional: array of additional env variables used for custom config.
+    # env:
+    #   - name:
+    #     value:
+
+secure:
+    # true here enables Sysdig Secure: container run-time security & forensics
+    enable: false
+
+    # Default Sysdig Secure configuration (please add trailing \n)
+    SecureConf: "security: {enabled: true}\ncommandlines_capture: {enabled: true}\nmemdump: {enabled: true}\n"
+
 resources:
-  requests:
-    cpu: 100m
-    memory: 512Mi
-  limits:
-    cpu: 500m
-    memory: 768Mi
+    requests:
+        cpu: 100m
+        memory: 512Mi
+    limits:
+        cpu: 500m
+        memory: 768Mi
 
 # Allow sysdig to run on Kubernetes 1.6 masters.
 tolerations:
-  - effect: NoSchedule
-    key: node-role.kubernetes.io/master
+    - effect: NoSchedule
+      key: node-role.kubernetes.io/master