appsentinels-sniffer/0000775000177400017770000000000015223156020014206 5ustar sagarsagarappsentinels-sniffer/README.md0000644000177400017770000002225315102601066015470 0ustar sagarsagar# AppSentinels Sniffer Helm Chart

This Helm chart deploys the AppSentinels Sniffer as a DaemonSet on a Kubernetes cluster.

## Prerequisites

- Kubernetes

- Helm

## Installing the Chart

To install the chart with the release name `appsentinels-sniffer`:

```bash

helm install appsentinels-sniffer ./sniffer-sensor/helm-chart

```

The command deploys the AppSentinels Sniffer DaemonSet on the Kubernetes cluster with default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.

## Uninstalling the Chart

To uninstall/delete the `appsentinels-sniffer` deployment:

```bash

helm uninstall appsentinels-sniffer

```

## Parameters

The following table lists the configurable parameters of the AppSentinels Sniffer chart and their default values.

| Parameter | Description | Default |

|--------------------------------|-------------------------------------------------|---------------------------------------|

| `nameOverride` | Override the name of the chart | `""` |

| `fullnameOverride` | Override the full name of the chart | `""` |

| `namespace` | Namespace to deploy the DaemonSet | `appsentinels` |

| `image.repository` | Image repository | `docker.io/appsentinels/ng-controller`|

| `image.tag` | Image tag | `test` |

| `image.pullPolicy` | Image pull policy | `Always` |

| `resources.limits.cpu` | CPU resource limits | `2` |

| `resources.limits.memory` | Memory resource limits | `2Gi` |

| `resources.requests.cpu` | CPU resource requests | `1` |

| `resources.requests.memory` | Memory resource requests | `1Gi` |

| `controller.serverName` | Remote controller server name | `devsaas3.appsentinels.ai` |

| `controller.serverPort` | Remote controller server port | `9006` |

| `environment` | Environment setting | `dev` |

| `sensorInstance` | Sniffer sensor instance name | `dev-cluster-1-sensor` |

| `tapInterface` | Network interface to tap | `all or any or default or interface-name` |

| `tapFilter` | Tap filter expression | `tcp-and-port-8091` |

| `relayProtocol` | Protocol for relay communication | `http` |

| `tapProfile` | Tap profile setting | `low` |

| `nodeSelector` | Node labels for pod assignment | `{}` |

| `tolerations` | Tolerations for pod assignment | See values.yaml |

## TAP Interface

The `tapInterface` parameter can be set to `all` or `any` or `default` or an interface name.

- `all` - Tap all interfaces

- `any` - Tap local and ingress/egress interfaces

- `default` - Tap the default route interface

- `interface-name` - Tap a specific interface by name

## Example: Customizing the Installation

A YAML file that specifies the values for the parameters can be provided while installing the chart:

```bash

helm install appsentinels-sniffer ./sniffer-sensor/helm-chart -f values.yaml

```

Example `values.yaml`:

```yaml

environment: production

controller:

serverName: prod.appsentinels.ai

serverPort: 9006

sensorInstance: prod-cluster-sensor

tapFilter: tcp-and-not-port-443

resources:

limits:

cpu: 2

memory: 4Gi

requests:

cpu: 1

memory: 2Gi

```

## Upgrading the Chart

To upgrade the `appsentinels-sniffer` deployment:

```bash

helm upgrade appsentinels-sniffer ./sniffer-sensor/helm-chart

```

Or with custom values:

```bash

helm upgrade appsentinels-sniffer ./sniffer-sensor/helm-chart -f values.yaml

```

## Configuration Notes

### Node Selection

By default, the DaemonSet will run on all nodes in the cluster. To restrict it to specific nodes, you can use the `nodeSelector` parameter:

```yaml

nodeSelector:

node-role.kubernetes.io/worker: "true"

```

### Privileged Mode

The sniffer sensor runs in privileged mode to access network interfaces. Ensure your cluster security policies allow privileged containers.

### Network Access

The DaemonSet uses `hostNetwork: true` to access the host's network stack directly. This is required for network traffic sniffing.

### Filtering for URI Extension, Hostname and Extension Filtering

=============================================

These environment variables should be set in the container environment for your sniffer sensor

-------------------------------------------------------------------------------

#### skipHostnameRegex

-----------------------------

Purpose:

Skip (exclude) HTTP transactions where the hostname matches this regular expression.

How it works:

- If the regex matches the hostname, the transaction is SKIPPED (not logged)

- If not set or empty, no hostnames are excluded by this filter.

- Please note that this filter shouldnt be used with port numbers

Example values:

skipHostnameRegex="^www\.example\.com$"

# Skips any transaction where the hostname is exactly 'www.example.com'

skipHostnameRegex="(test|dev)\.mydomain\.org$"

# Skips hostnames ending with 'test.mydomain.org' or 'dev.mydomain.org'

-------------------------------------------------------------------------------

#### includeHostnameRegex

-----------------------------------

Purpose:

ONLY process (include) HTTP transactions where the hostname matches this regular expression.

How it works:

- If set, ONLY hostnames matching this regex are processed.

- If the hostname does NOT match, the transaction is skipped.

- If not set or empty, all hostnames are included (unless excluded by skipHostnameRegex).

- Please note that this filter shouldnt be used with port numbers

Example values:

includeHostnameRegex="^api\."

# Only process hostnames starting with 'api.'

includeHostnameRegex="(prod|main)\.mydomain\.org$"

# Only process hostnames ending with 'prod.mydomain.org' or 'main.mydomain.org'

-------------------------------------------------------------------------------

#### uriExtentionFilter

-----------------------

Purpose:

Skip (exclude) HTTP transactions where the URI path ends with one of the specified file extensions.

How it works:

- If set, the value should be a '|' (pipe) separated list of file extensions (e.g., 'svg|png|jpg').

- If the URI path ends with one of these extensions, the transaction is skipped.

- If not set or empty, a default list of common static file extensions is used.

Default Extensions Skipped:

"svg|txt|png|jpg|jpeg|io|tff|woff|woff2|ico|css|pdf|html|mp4|php|ajax|js|gif|tiff|ttf|docx|wasm|aspx"

Example values:

uriExtentionFilter="svg|png|jpg|ico"

# Skips URIs ending with .svg, .png, .jpg, or .ico

uriExtentionFilter="js|css|woff2"

# Skips URIs ending with .js, .css, or .woff2

--------------------------------

#### Order of Evaluation

-------------------

1. If includeHostnameRegex is set, the hostname MUST match this regex to be processed.

2. If skipHostnameRegex is set, the hostname MUST NOT match this regex to be processed.

3. If uriExtentionFilter is set, the URI path MUST NOT end with one of the specified extensions.

4. If both hostname regexes are set, the hostname must match the include regex AND must not match the skip regex.

-------------------------------------------------------------------------------

#### Regex Syntax and Escaping

-------------------------

- Write regexes as you would in C or Python (e.g., ^foo\.bar$, .*\.test\.local$).

- Use a single backslash (\.) for regex metacharacters.

- When writing YAML (Kubernetes, Compose), you may need to double the backslash (\\.) for proper escaping.

-------------------------------------------------------------------------------

#### Examples for Kubernetes

-------------

```yaml

values.yaml:

skipHostnameRegex: "^www\\.example\\.com$"

includeHostnameRegex: "^api\\."

uriExtentionFilter: "svg|png|jpg"

```

-------------------------------------------------------------------------------

Notes:

------

- All regexes are case-insensitive.

- If neither hostname regex is set, all hostnames are processed.

- If both hostname regexes are set, both conditions must be satisfied for a transaction to be processed.

- If uriExtentionFilter is not set, a default list of static file extensions is used.

appsentinels-sniffer/Chart.yaml0000644000177400017770000000023215223156020016126 0ustar sagarsagarapiVersion: v2

appVersion: 1.0.0

description: A Helm chart for AppSentinels Sniffer DaemonSet

name: appsentinels-sniffer

type: application

version: 2.0.5

appsentinels-sniffer/values.yaml0000644000177400017770000001160615223155775016413 0ustar sagarsagar# appsentinels-sniffer Helm Chart

#

# This Helm chart deploys the AppSentinels Sniffer sensor as a DaemonSet in your Kubernetes cluster.

# It supports both

# 1. TAP

# 2. eBPF packet capture/monitoring modes,

# with extensive configuration options for resources, deployment environment, and runtime behavior.

# Default values for appsentinels-sniffer

nameOverride: ""

fullnameOverride: ""

createNamespace: true # Set to false if namespace already exists

namespace: appsentinels

image:

repository: docker.io/appsentinels/ng-controller

tag: latest

pullPolicy: Always

resources:

limits:

cpu: 2

memory: 4Gi

requests:

cpu: 1

memory: 2Gi

controller:

serverName: "<edge controller hostname>"

# if the port changes, update the TAP_FILTER as well, we dont want to sniff our own traffic

serverPort: "9004"

relayProtocol: http

environment: "<environment this sensor is being deployed to>"

sensorInstance: "<sensor instance name>"

########################################################################################

########## Tap Mode Specific Configuration ############################################

########################################################################################

enableTapMode: true # default true to enable backward compat

tapInterface: "all"

tapFilter: "tcp-and-not-port-22-and-not-port-443-and-not-port-9004-and-not-port-9101"

tapProfile: "low"

########################################################################################

########## eBPF Mode Specific Configuration ###########################################

########################################################################################

# Set enableEbpfSensor: true to enable eBPF mode instead of TAP mode. All the below are eBPF mode specific configurations.

enableEbpfSensor: false

# ServiceAccount name (will be created automatically if eBPF mode is enabled and this is defined)

serviceAccountName: "sslsniffer-sa"

# Enable non-TLS monitoring for eBPF mode

ebpfEnableNonSslSniffTcp: "true"

# Filtering section for eBPF mode

# Container filter for eBPF mode - monitor containers matching this regex

ebpfContainerIncludeFilter: ".*" # monitor all containers

ebpfContainerExcludeFilter: "sniffer-sensor" # exclude the sniffer sensor itself

# Process filter for eBPF mode - monitor processes matching this regex

# ebpfProcessIncludeFilter: "^(server|go)$"

# Exclude log shippers and other noisy processes for eBPF mode

ebpfProcessExcludeFilter: "(data-path-handler|tail|bash|sh|cat|ls|ps|grep|awk|sed|sleep|nc|netcat|sslsniffer|pause|kube-proxy|coredns|kube-dns|proxy-agent|server-with-metrics|sidecar|otelsvc|istio-proxy|envoy|linkerd-proxy|fluentd|fluent-bit|promtail|filebeat|logstash|datadog-agent|newrelic-infra|collectd|telegraf|metrics-server|aws-vpc-cni|aws-k8s-agent)"

# Monitor only local processes for eBPF mode

ebpfLocalProcOnly: false

# Logging level for eBPF mode (use 'debug' for testing, 'error' for production, 'trace' for detailed)

ebpfLoggingLevel: "error"

########################################################################################

########## Common filtering section (applies to tap and ebpf) ##########################

########################################################################################

# Filtering section

uriExtentionFilter: "svg|txt|png|jpg|jpeg|io|tff|woff|woff2|ico|css|pdf|html|mp4|php|ajax|js|gif|tiff|ttf|docx|wasm|aspx"

skipHostnameRegex: ""

includeHostnameRegex: ""

urlSkipFilter: "health" # skip complete uris using this regex. Eg: skip all paths that contain health in them

########################################################################################

########## Advanced configs ###########################################################

########################################################################################

# tapWorkers: 1 # use only if tapProfile is set to performance

connectorLimit: 4 # use only if needed to lower buffering

maxSaasQueueHoldingCap: 1024 # use only if needed to lower buffering

tapperMemThresholdPercent: 60

ebpfMemThresholdPercent: 70

memoryMonitorInterval: 5

goMemLimit: "128MiB" # Go memory limit (supports units like MiB, MB, GiB, GB)

goGCCPercent: 10 # in percentage

yieldEveryNSeconds: 30

yieldForNMilliseconds: 10

dpMemHighThreshold: 60

########################################################################################

########## Health check probes #########################################################

########################################################################################

# Health check probes

probes:

liveness:

enabled: true

initialDelaySeconds: 90

periodSeconds: 30

timeoutSeconds: 5

failureThreshold: 3

successThreshold: 1

port: 80

path: /dp-health

# Node selection

nodeSelector: {}

# node-role.kubernetes.io/worker: "true"

# Tolerations

tolerations:

- operator: Exists

effect: NoExecute

- operator: Exists

effect: NoSchedule

appsentinels-sniffer/templates/0000775000177400017770000000000015223156043016211 5ustar sagarsagarappsentinels-sniffer/templates/daemonset.yaml0000644000177400017770000002202415102601066021046 0ustar sagarsagarapiVersion: apps/v1

kind: DaemonSet

metadata:

name: {{ include "appsentinels-sniffer.fullname" . }}

namespace: {{ .Values.namespace }}

labels:

{{- include "appsentinels-sniffer.labels" . | nindent 4 }}

spec:

selector:

matchLabels:

{{- include "appsentinels-sniffer.selectorLabels" . | nindent 6 }}

template:

metadata:

labels:

{{- include "appsentinels-sniffer.selectorLabels" . | nindent 8 }}

spec:

{{- if .Values.enableEbpfSensor }}

hostPID: true

{{- if and (hasKey .Values "serviceAccountName") (ne .Values.serviceAccountName "") }}

serviceAccountName: {{ .Values.serviceAccountName }}

{{- end }}

{{- end }}

{{- if .Values.enableTapMode }}

hostNetwork: true

{{- end }}

containers:

- name: sniffer-sensor

image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

imagePullPolicy: {{ .Values.image.pullPolicy }}

securityContext:

privileged: true

{{- if .Values.enableEbpfSensor }}

capabilities:

add:

- SYS_ADMIN # required for eBPF mode

- SYS_PTRACE # Required for process inspection

- NET_ADMIN # Required for network operations

- IPC_LOCK # Required for eBPF map memory locking

{{- end }}

resources:

{{- toYaml .Values.resources | nindent 12 }}

{{- if .Values.probes.liveness.enabled }}

livenessProbe:

httpGet:

path: {{ .Values.probes.liveness.path }}

port: {{ .Values.probes.liveness.port }}

initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}

periodSeconds: {{ .Values.probes.liveness.periodSeconds }}

timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}

failureThreshold: {{ .Values.probes.liveness.failureThreshold }}

successThreshold: {{ .Values.probes.liveness.successThreshold }}

{{- end }}

env:

{{- if and (hasKey .Values "enableEbpfSensor") .Values.enableEbpfSensor }}

- name: BYPASS

value: "authzbypass,accesslogbypass"

{{- end }}

{{- if and (hasKey .Values "enableEbpfSensor") .Values.enableEbpfSensor }}

- name: ENABLE_EBPF_SENSOR

value: "true"

{{- end }}

{{- if hasKey .Values.controller "serverName" }}

- name: REMOTE_CONTROLLER_SERVER_NAME

value: {{ .Values.controller.serverName | quote }}

{{- end }}

{{- if hasKey .Values.controller "serverPort" }}

- name: REMOTE_CONTROLLER_SERVER_PORT

value: {{ .Values.controller.serverPort | quote }}

{{- end }}

{{- if hasKey .Values "environment" }}

- name: ENVIRONMENT

value: {{ .Values.environment | quote }}

{{- end }}

{{- if hasKey .Values "sensorInstance" }}

- name: INSTANCE_NAME

value: {{ .Values.sensorInstance | quote }}

{{- end }}

{{- if hasKey .Values "sensorInstance" }}

- name: SNIFFER_SENSOR_INSTANCE

value: {{ .Values.sensorInstance | quote }}

{{- end }}

{{- if hasKey .Values "ebpfEnableNonSslSniffTcp" }}

- name: ENABLE_NONSSL_SNIFF_TCP

value: {{ .Values.ebpfEnableNonSslSniffTcp | quote }}

{{- end }}

{{- if hasKey .Values "ebpfLoggingLevel" }}

- name: LOGGING_LEVEL

value: {{ .Values.ebpfLoggingLevel | quote }}

{{- end }}

{{- if hasKey .Values "ebpfContainerIncludeFilter" }}

- name: SSLSNIFF_CONTAINER_INCLUDE_FILTER

value: {{ .Values.ebpfContainerIncludeFilter | quote }}

{{- end }}

{{- if hasKey .Values "ebpfContainerExcludeFilter" }}

- name: SSLSNIFF_CONTAINER_EXCLUDE_FILTER

value: {{ .Values.ebpfContainerExcludeFilter | quote }}

{{- end }}

{{- if hasKey .Values "ebpfProcessIncludeFilter" }}

- name: SSLSNIFF_PROCESS_INCLUDE_FILTER

value: {{ .Values.ebpfProcessIncludeFilter | quote }}

{{- end }}

{{- if hasKey .Values "ebpfProcessExcludeFilter" }}

- name: SSLSNIFF_PROCESS_EXCLUDE_FILTER

value: {{ .Values.ebpfProcessExcludeFilter | quote }}

{{- end }}

- name: KUBERNETES_NAMESPACE

valueFrom:

fieldRef:

fieldPath: metadata.namespace

{{- if and .Values.enableTapMode (hasKey .Values "tapInterface") }}

- name: TAP_INTERFACE

value: {{ .Values.tapInterface | quote }}

{{- end }}

{{- if and .Values.enableTapMode (hasKey .Values "tapFilter") }}

- name: TAP_FILTER

value: {{ .Values.tapFilter | quote }}

{{- end }}

{{- if hasKey .Values "relayProtocol" }}

- name: RELAY_PROTOCOL

value: {{ .Values.relayProtocol | quote }}

{{- end }}

{{- if and .Values.enableTapMode (hasKey .Values "tapProfile") }}

- name: TAP_PROFILE

value: {{ .Values.tapProfile | quote }}

{{- end }}

- name: CPU_LIMIT

valueFrom:

resourceFieldRef:

resource: limits.cpu

- name: MEMORY_LIMIT

valueFrom:

resourceFieldRef:

resource: limits.memory

{{- if and (hasKey .Values "uriExtentionFilter") (ne .Values.uriExtentionFilter "") }}

- name: SKIP_EXTENSIONS

value: {{ .Values.uriExtentionFilter | quote }}

{{- end }}

{{- if and (hasKey .Values "skipHostnameRegex") (ne .Values.skipHostnameRegex "") }}

- name: SKIP_HOSTNAME_REGEX

value: {{ .Values.skipHostnameRegex | quote }}

{{- end }}

{{- if and (hasKey .Values "includeHostnameRegex") (ne .Values.includeHostnameRegex "") }}

- name: HOSTNAME_INCLUDE_REGEX

value: {{ .Values.includeHostnameRegex | quote }}

{{- end }}

{{- if and (hasKey .Values "urlSkipFilter") (ne .Values.urlSkipFilter "") }}

- name: SKIP_URI_REGEX

value: {{ .Values.urlSkipFilter | quote }}

{{- end }}

{{- if and .Values.enableTapMode (hasKey .Values "tapWorkers") }}

- name: TAP_WORKER_THREADS

value: {{ .Values.tapWorkers | quote }}

{{- end }}

{{- if hasKey .Values "connectorLimit" }}

- name: SAAS_CONNECTOR_LIMIT

value: {{ .Values.connectorLimit | quote }}

{{- end }}

{{- if hasKey .Values "maxSaasQueueHoldingCap" }}

- name: MAX_SAAS_QUEUE_HOLDING_CAP

value: {{ .Values.maxSaasQueueHoldingCap | quote }}

{{- end }}

{{- if hasKey .Values "tapperMemThresholdPercent" }}

- name: SURICATA_MEM_THRESHOLD

value: {{ .Values.tapperMemThresholdPercent | quote }}

{{- end }}

{{- if hasKey .Values "ebpfMemThresholdPercent" }}

- name: EBPFSENSOR_MEM_THRESHOLD

value: {{ .Values.ebpfMemThresholdPercent | quote }}

{{- end }}

{{- if hasKey .Values "dpMemHighThreshold" }}

- name: DP_MEM_HIGH_THRESHOLD

value: {{ .Values.dpMemHighThreshold | quote }}

{{- end }}

{{- if hasKey .Values "memoryMonitorInterval" }}

- name: MEM_MONITOR_INTERVAL

value: {{ .Values.memoryMonitorInterval | quote }}

{{- end }}

{{- if hasKey .Values "yieldEveryNSeconds" }}

- name: YIELD_EVERY_N_SECONDS

value: {{ .Values.yieldEveryNSeconds | quote }}

{{- end }}

{{- if hasKey .Values "yieldForNMilliseconds" }}

- name: YIELD_FOR_N_MILLISECONDS

value: {{ .Values.yieldForNMilliseconds | quote }}

{{- end }}

{{- if hasKey .Values "ebpfLocalProcOnly" }}

- name: SNIFF_LOCAL_ONLY

value: {{ .Values.ebpfLocalProcOnly | quote }}

{{- end }}

{{- if hasKey .Values "ebpfDataEventsChanCap" }}

- name: DATA_EVENTS_CHAN_CAP

value: {{ .Values.ebpfDataEventsChanCap | quote }}

{{- end }}

{{- if hasKey .Values "goMemLimit" }}

- name: GOMEMLIMIT

value: {{ .Values.goMemLimit | quote }}

{{- end }}

{{- if hasKey .Values "goGCCPercent" }}

- name: GOGC

value: {{ .Values.goGCCPercent | quote }}

{{- end }}

{{- if .Values.enableEbpfSensor }}

volumeMounts:

- name: containerd-socket

mountPath: /var/run/containerd/containerd.sock

- name: sys-fs

mountPath: /sys

readOnly: true

- name: debugfs

mountPath: /sys/kernel/debug

{{- end }}

{{- if .Values.enableEbpfSensor }}

volumes:

- name: containerd-socket

hostPath:

path: /var/run/containerd/containerd.sock

type: Socket

- name: sys-fs

hostPath:

path: /sys

type: Directory

- name: debugfs

hostPath:

path: /sys/kernel/debug

type: Directory

{{- end }}

{{- with .Values.nodeSelector }}

nodeSelector:

{{- toYaml . | nindent 8 }}

{{- end }}

{{- with .Values.tolerations }}

tolerations:

{{- toYaml . | nindent 8 }}

{{- end }}

appsentinels-sniffer/templates/_helpers.tpl0000644000177400017770000000311215102601066020522 0ustar sagarsagar{{/*

Expand the name of the chart.

*/}}

{{- define "appsentinels-sniffer.name" -}}

{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}

{{- end }}

{{/*

Create a default fully qualified app name.

We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).

If release name contains chart name it will be used as a full name.

*/}}

{{- define "appsentinels-sniffer.fullname" -}}

{{- if .Values.fullnameOverride }}

{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}

{{- else }}

{{- $name := default .Chart.Name .Values.nameOverride }}

{{- if contains $name .Release.Name }}

{{- .Release.Name | trunc 63 | trimSuffix "-" }}

{{- else }}

{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}

{{- end }}

{{- end }}

{{- end }}

{{/*

Create chart name and version as used by the chart label.

*/}}

{{- define "appsentinels-sniffer.chart" -}}

{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}

{{- end }}

{{/*

Common labels

*/}}

{{- define "appsentinels-sniffer.labels" -}}

helm.sh/chart: {{ include "appsentinels-sniffer.chart" . }}

{{ include "appsentinels-sniffer.selectorLabels" . }}

{{- if .Chart.AppVersion }}

app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}

{{- end }}

app.kubernetes.io/managed-by: {{ .Release.Service }}

{{- end }}

{{/*

Selector labels

*/}}

{{- define "appsentinels-sniffer.selectorLabels" -}}

app.kubernetes.io/name: {{ include "appsentinels-sniffer.name" . }}

app.kubernetes.io/instance: {{ .Release.Name }}

app: appsentinels-sniffer

{{- end }} appsentinels-sniffer/templates/serviceaccount.yaml0000644000177400017770000000037015102601066022104 0ustar sagarsagar{{- if and .Values.enableEbpfSensor (hasKey .Values "serviceAccountName") (ne .Values.serviceAccountName "") }}

apiVersion: v1

kind: ServiceAccount

metadata:

name: {{ .Values.serviceAccountName }}

namespace: {{ .Values.namespace }}

{{- end }}

appsentinels-sniffer/templates/namespace.yaml0000644000177400017770000000021415102601066021020 0ustar sagarsagar{{- if and .Values.namespace .Values.createNamespace }}

apiVersion: v1

kind: Namespace

metadata:

name: {{ .Values.namespace }}

{{- end }} appsentinels-sniffer/templates/clusterrole.yaml0000644000177400017770000000047015102601066021433 0ustar sagarsagar{{- if and .Values.enableEbpfSensor (hasKey .Values "serviceAccountName") (ne .Values.serviceAccountName "") }}

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

name: sslsniffer-role

rules:

- apiGroups: [""]

resources: ["pods", "namespaces"]

verbs: ["get", "list", "watch"]

{{- end }}

appsentinels-sniffer/templates/NOTES.txt0000644000177400017770000000131215102601066017631 0ustar sagarsagarAppSentinels Sniffer DaemonSet has been deployed.

The DaemonSet is running on all eligible nodes in your cluster.

Configuration:

- Controller Server: {{ .Values.controller.serverName }}:{{ .Values.controller.serverPort }}

- Environment: {{ .Values.environment }}

- Sensor Instance: {{ .Values.sensorInstance }}

- TAP Interface: {{ .Values.tapInterface }}

- TAP Filter: {{ .Values.tapFilter }}

To check the status of the DaemonSet, run:

kubectl get daemonset -n {{ .Values.namespace }} {{ include "appsentinels-sniffer.fullname" . }}

To check the logs of a pod, run:

kubectl logs -n {{ .Values.namespace }} -l app.kubernetes.io/name={{ include "appsentinels-sniffer.name" . }} -c sniffer-sensor -fappsentinels-sniffer/templates/clusterrolebinding.yaml0000644000177400017770000000066115102601066022770 0ustar sagarsagar{{- if and .Values.enableEbpfSensor (hasKey .Values "serviceAccountName") (ne .Values.serviceAccountName "") }}

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

name: sslsniffer-rolebinding

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

name: sslsniffer-role

subjects:

- kind: ServiceAccount

name: {{ .Values.serviceAccountName }}

namespace: {{ .Values.namespace }}

{{- end }}