mirror of
https://github.com/helm/charts.git
synced 2026-08-20 04:47:32 +00:00
Carlos Tadeu Panato JuniorandKubernetes Prow Robot
bfea6d7661
and adding myself in the owners file Signed-off-by: Carlos Panato <ctadeu@gmail.com>
132 lines
4.3 KiB
YAML
132 lines
4.3 KiB
YAML
image:
|
|
repository: docker.elastic.co/beats/auditbeat
|
|
tag: 6.7.0
|
|
pullPolicy: IfNotPresent
|
|
|
|
config:
|
|
auditbeat.modules:
|
|
- module: auditd
|
|
# keep this 0 and be more selective in auditd rules to rate-limit without dropping audit events
|
|
rate_limit: 0
|
|
# maximum number of audit messages that will be buffered by the kernel
|
|
backlog_limit: 8196
|
|
# See https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-auditd.html for more info
|
|
audit_rules: |
|
|
# Things that affect identity.
|
|
-w /etc/group -p wa -k identity
|
|
-w /etc/passwd -p wa -k identity
|
|
-w /etc/gshadow -p wa -k identity
|
|
-w /etc/shadow -p wa -k identity
|
|
# Unauthorized access attempts to files (unsuccessful).
|
|
-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access
|
|
-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access
|
|
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access
|
|
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access
|
|
## for development
|
|
# failure_mode: log
|
|
# include_raw_message: true
|
|
# include_warnings: true
|
|
- module: file_integrity
|
|
paths:
|
|
- /bin
|
|
- /usr/bin
|
|
- /sbin
|
|
- /usr/sbin
|
|
- /etc
|
|
|
|
processors:
|
|
- add_cloud_metadata:
|
|
|
|
queue: {}
|
|
## Queue type by name (default 'mem')
|
|
## The memory queue will present all available events (up to the outputs
|
|
## bulk_max_size) to the output, the moment the output is ready to server
|
|
## another batch of events.
|
|
# mem:
|
|
## Max number of events the queue can buffer.
|
|
# events: 4096
|
|
|
|
## Hints the minimum number of events stored in the queue,
|
|
## before providing a batch of events to the outputs.
|
|
## A value of 0 (the default) ensures events are immediately available
|
|
## to be sent to the outputs.
|
|
# flush.min_events: 2048
|
|
|
|
## Maximum duration after which events are available to the outputs,
|
|
## if the number of events stored in the queue is < min_flush_events.
|
|
# flush.timeout: 1s
|
|
|
|
# When a key contains a period, use this format for setting values on the command line:
|
|
# --set config."output\.file".enabled=false
|
|
output.file:
|
|
path: "/usr/share/auditbeat/data"
|
|
filename: auditbeat
|
|
rotate_every_kb: 10000
|
|
number_of_files: 5
|
|
|
|
# output.elasticsearch:
|
|
# hosts: ["elasticsearch:9200"]
|
|
# protocol: "https"
|
|
# username: "elastic"
|
|
# password: "changeme"
|
|
|
|
# List of beat plugins
|
|
plugins: []
|
|
# - kinesis.so
|
|
|
|
# Additional container arguments
|
|
extraArgs: []
|
|
# - -d
|
|
# - *
|
|
|
|
# A map of additional environment variables
|
|
extraVars: {}
|
|
# test1: "test2"
|
|
|
|
# Add additional volumes and mounts, for example to read other log files on the host
|
|
extraVolumes: []
|
|
# - hostPath:
|
|
# path: /var/log
|
|
# name: varlog
|
|
extraVolumeMounts: []
|
|
# - name: varlog
|
|
# mountPath: /host/var/log
|
|
# readOnly: true
|
|
|
|
## Labels to be added to pods
|
|
podLabels: {}
|
|
|
|
## Annotations to be added to pods
|
|
podAnnotations: {}
|
|
|
|
resources: {}
|
|
## We usually recommend not to specify default resources and to leave this as a conscious
|
|
## choice for the user. This also increases chances charts run on environments with little
|
|
## resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 200Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 100Mi
|
|
|
|
## Node labels for pod assignment
|
|
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
|
|
nodeSelector: {}
|
|
|
|
## Affinity configuration for pod assignment
|
|
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
|
|
affinity: {}
|
|
|
|
rbac:
|
|
# Specifies whether RBAC resources should be created
|
|
create: true
|
|
|
|
serviceAccount:
|
|
# Specifies whether a ServiceAccount should be created
|
|
create: true
|
|
# The name of the ServiceAccount to use.
|
|
# If not set and create is true, a name is generated using the fullname template
|
|
name:
|