diff --git a/stable/falco/CHANGELOG.md b/stable/falco/CHANGELOG.md index 849dc0a4b4..e97294cf2c 100644 --- a/stable/falco/CHANGELOG.md +++ b/stable/falco/CHANGELOG.md @@ -3,6 +3,15 @@ This file documents all notable changes to Sysdig Falco Helm Chart. The release numbering uses [semantic versioning](http://semver.org). +## v0.7.6 + +### Major Changes + +* Allow to enable/disable usage of the docker socket +* Configurable docker socket path +* CRI support, configurable CRI socket +* Allow to enable/disable usage of the CRI socket + ## v0.7.5 ### Minor Changes diff --git a/stable/falco/Chart.yaml b/stable/falco/Chart.yaml index 7a620d133b..33ea37c5b6 100644 --- a/stable/falco/Chart.yaml +++ b/stable/falco/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: falco -version: 0.7.5 +version: 0.7.6 appVersion: 0.15.0 description: Sysdig Falco keywords: diff --git a/stable/falco/README.md b/stable/falco/README.md index 68d1a6c41b..92a99fa804 100644 --- a/stable/falco/README.md +++ b/stable/falco/README.md @@ -49,6 +49,8 @@ The following table lists the configurable parameters of the Falco chart and the | `image.repository` | The image repository to pull from | `falcosecurity/falco` | | `image.tag` | The image tag to pull | `0.15.0` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `cri.socket` | The path of the CRI socket | `/run/containerd/containerd.sock` | +| `docker.socket` | The path of the Docker daemon socket | `/var/run/docker.sock` | | `resources.requests.cpu` | CPU requested for being run in a node | `100m` | | `resources.requests.memory` | Memory requested for being run in a node | `512Mi` | | `resources.limits.cpu` | CPU limit | `200m` | diff --git a/stable/falco/templates/daemonset.yaml b/stable/falco/templates/daemonset.yaml index eaa777e11d..5f93024a5c 100644 --- a/stable/falco/templates/daemonset.yaml +++ b/stable/falco/templates/daemonset.yaml @@ -32,6 +32,10 @@ spec: privileged: true args: - /usr/bin/falco + {{- if (and .Values.cri.enabled .Values.cri.socket) }} + - --cri + - /host/var/run/cri.sock + {{- end }} - -K - /var/run/secrets/kubernetes.io/serviceaccount/token - -k @@ -58,8 +62,14 @@ spec: value: {{ .Values.proxy.noProxy }} {{- end }} volumeMounts: + {{- if (and .Values.docker.enabled .Values.docker.socket) }} - mountPath: /host/var/run/docker.sock name: docker-socket + {{- end}} + {{- if (and .Values.cri.enabled .Values.cri.socket) }} + - mountPath: /host/var/run/cri.sock + name: cri-socket + {{- end}} - mountPath: /host/dev name: dev-fs - mountPath: /host/proc @@ -160,9 +170,16 @@ spec: - name: dshm emptyDir: medium: Memory + {{- if (and .Values.docker.enabled .Values.docker.socket) }} - name: docker-socket hostPath: - path: /var/run/docker.sock + path: {{ .Values.docker.socket }} + {{- end}} + {{- if (and .Values.cri.enabled .Values.cri.socket) }} + - name: cri-socket + hostPath: + path: {{ .Values.cri.socket }} + {{- end}} - name: dev-fs hostPath: path: /dev diff --git a/stable/falco/values.yaml b/stable/falco/values.yaml index 95422090fe..e7f13af62a 100644 --- a/stable/falco/values.yaml +++ b/stable/falco/values.yaml @@ -6,6 +6,14 @@ image: tag: 0.15.0 pullPolicy: IfNotPresent +docker: + enabled: true + socket: /var/run/docker.sock + +cri: + enabled: true + socket: /run/containerd/containerd.sock + resources: # Although resources needed are subjective on the actual workload we provide # a sane defaults ones. If you have more questions or concerns, please refer