deprecated-helm-charts/stable/sysdig

Sysdig

Sysdig is a unified platform for container and microservices monitoring, troubleshooting, security and forensics. Sysdig platform has been built on top of Sysdig tool and Sysdig Inspect open-source technologies.

Introduction

This chart adds the Sysdig agent for Sysdig Monitor and Sysdig Secure to all nodes in your cluster via a DaemonSet.

Prerequisites

• Kubernetes 1.2+ with Beta APIs enabled

Installing the Chart

To install the chart with the release name my-release, retrieve your Sysdig Monitor Access Key from your Account Settings and run:

$ helm install --name my-release \
    --set sysdig.accessKey=YOUR-KEY-HERE stable/sysdig

After a few seconds, you should see hosts and containers appearing in Sysdig Monitor and Sysdig Secure.

Tip

: List all releases using helm list

Uninstalling the Chart

To uninstall/delete the my-release deployment:

$ helm delete my-release

Tip

: Use helm delete --purge my-release to completely remove the release from Helm internal storage

The command removes all the Kubernetes components associated with the chart and deletes the release.

Configuration

The following table lists the configurable parameters of the Sysdig chart and their default values.

Parameter	Description	Default
image.registry	Sysdig agent image registry	docker.io
image.repository	The image repository to pull from	sysdig/agent
image.tag	The image tag to pull	latest
image.pullPolicy	The Image pull policy	Always
image.pullSecrets	Image pull secrets	nil
rbac.create	If true, create & use RBAC resources	true
serviceAccount.create	Create serviceAccount	true
serviceAccount.name	Use this value as serviceAccountName
sysdig.accessKey	Your Sysdig Monitor Access Key	Nil You must provide your own key
sysdig.settings	Settings for agent's configuration file	{}
secure.enabled	Enable Sysdig Secure	false
customAppChecks	The custom app checks deployed with your agent	{}
tolerations	The tolerations for scheduling	node-role.kubernetes.io/master:NoSchedule

Specify each parameter using the --set key=value[,key=value] argument to helm install. For example,

$ helm install --name my-release \
    --set sysdig.accessKey=YOUR-KEY-HERE,sysdig.settings.tags="role:webserver,location:europe" \
    stable/sysdig

Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,

$ helm install --name my-release -f values.yaml stable/sysdig

Tip

: You can use the default values.yaml

On-Premise deployment settings

There are several people who runs Sysdig platform On-Premise, in its own infrastructure.

This is also supported by the Helm chart, and you can enable it with the following parameters:

Parameter	Description	Default
sysdig.settings.collector	The IP address or hostname of the collector
sysdig.settings.collector_port	The port where collector is listening
sysdig.settings.ssl	The collector accepts SSL	true
sysdig.settings.ssl_verify_certificate	Set to false if you don't want to verify SSL certificate	true

For example:

$ helm install --name sysdig-agent-on-prem \
    --set sysdig.accessKey=YOUR-KEY-HERE \
    --set sysdig.settings.collector=42.32.196.18 \
    --set sysdig.settings.collector_port=6443 \
    --set sysdig.settings.ssl_verify_certificate=false \
    stable/sysdig

Using private image registries

To authenticate against an image registry you will need to store the credentials in a Secret:

kubectl create secret docker-registry NAME \
 --docker-server=SERVER \
 --docker-username=USERNAME \
 --docker-password=TOKEN \
 --docker-email=EMAIL

The values YAML file will need to point to the Secret you just created (this cannot be done using the command-line):

image:
  pullSecrets:
    - name: NAME

Finally, set the accessKey value and you are ready to deploy the Sysdig agent using the Helm chart:

helm install --name sysdig-agent -f private-registry-values.yaml stable/sysdig

You can read more details about this in Kubernetes Documentation.

Custom App Checks

Application checks are integrations that allow the Sysdig agent to poll specific metrics exposed by any application. Sysdig Monitor has several built-in app checks, but sometimes you need to create your own.

You can deploy them with the following YAML:

customAppChecks:
  sample.py: |-
    from checks import AgentCheck

    class MyCustomCheck(AgentCheck):
        def check(self, instance):
            self.gauge("testhelm", 1)

sysdig:
  settings:
    app_checks:
      - name: sample
        interval: 10
        pattern: # pattern to match the application
          comm: systemd
        conf:
          key: value

The first section, deploys the Custom App Check in a Kubernetes configmap, and the second configures it using dragent.yaml file. So that deploy Sysdig Chart using this file:

$ helm install --name sysdig-agent-1 \
  --set sysdig.accessKey=SYSDIG_ACCESS_KEY \
  -f custom-appchecks.yaml \
  stable/sysdig

And that's all, you will have your Custom App Check up and running.

You can get more information about Custom App Checks in Sysdig's Official Documentation.

Automating the generation of custom-app-checks.yaml file

Sometimes edit YAML files with multistrings is a bit cumbersome and error prone, so we added a script for automating this step and make your life easier.

This script lives in Helm Chart repository in the stable/sysdig/scripts directory.

Imagine that you would like to add rules for your Redis, MongoDB and Traefik containers, you have to:

$ git clone https://github.com/kubernetes/charts.git
$ cd stable/sysdig
$ ./scripts/appchecks2helm appChecks/solr.py appChecks/traefik.py appChecks/nats.py > custom-app-checks.yaml
$ helm install --name sysdig -f custom-app-checks.yaml stable/sysdig

Deploying the AWS Marketplace Sysdig agent image

This is an use case similar to pulling images from a private registry. First you need to get the authorization token for the AWS Marketplace ECS image registry:

aws ecr --region=us-east-1 get-authorization-token --output text --query authorizationData[].authorizationToken | base64 -d | cut -d: -f2

And then use it to create the Secret. Don't forget to replace TOKEN and EMAIL with your own values:

kubectl create secret docker-registry aws-marketplace-credentials \
 --docker-server=217273820646.dkr.ecr.us-east-1.amazonaws.com \
 --docker-username=AWS \
 --docker-password="TOKEN" \
 --docker-email="EMAIL"

Next you need to create a values YAML file to pass the specific ECS registry configuration (you will find these values when you activate the software from the AWS Marketplace):

sysdig:
  accessKey: XxxXXxXXxXXxxx

image:
  registry: 217273820646.dkr.ecr.us-east-1.amazonaws.com
  repository: 2df5da52-6fa2-46f6-b164-5b879e86fd85/cg-3361214151/agent
  tag: 0.85.1-latest
  pullSecrets:
    - name: aws-marketplace-credentials

Finally, set the accessKey value and you are ready to deploy the Sysdig agent using the Helm chart:

helm install --name sysdig-agent -f aws-marketplace-values.yaml stable/sysdig