deployment: configure K8s export logs #1575
Conversation
tixxdz
commented
Oct 10, 2023
•
592f9ab to
03ab16d
Compare
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
install/kubernetes/values.yaml
Outdated
| extraEnv: | ||
| # Tetragon can be deployed in different forms, from a Kubernetes pod, container, | ||
| # or a systemd service, having this environment variable helps to properly | ||
| # detect the environment where Tetragon is running. | ||
| - name: TETRAGON_DEPLOYMENT_MODE | ||
| value: k8s | ||
| # Tetragon export logs file permissions as a string, default readable/writable by owner only. | ||
| - name: TETRAGON_LOGS_PERM | ||
| value: "0660" |
There was a problem hiding this comment.
ah yeah sorry i shouldn't have suggested to use extraEnv, i thought you were just testing something out locally to pass some environment variables. i think these should be proper helm values.
there are already existing helm values related to export files, so i think we should add:
tetragon.exportFilePermission: "0660"
or some such setting instead of using extraEnv.
regarding TETRAGON_DEPLOYMENT_MODE, i'm kind of hoping tetragon can somehow autodetect it instead of asking users to specify it 💭
There was a problem hiding this comment.
for the extraEnv, I thought we can get a way with it ;-) as didn't want to overcharge tetragon --flags, as by default they should be restricted, and those permission make sense only under k8s... anyway I made the change now as you suggested!
For TETRAGON_DEPLOYMENT_MODE I removed it , and yes we have some autologic detection, that first checks --enable-k8s-api and assumes kubernetes, otherwise it does some foo cgroup namespace detection.
Then the improvement later would be to differentiate between k8s and pure container (without k8s) deployments as the container tries to hide some information, but will improve it later to do detection from kernel side.
Switch to default permissions on exported JSON to 0600. This flag allows users to change this and set their own permissions. Signed-off-by: Djalal Harouni <tixxdz@gmail.com>
Signed-off-by: Djalal Harouni <tixxdz@gmail.com>
Signed-off-by: Djalal Harouni <tixxdz@gmail.com>
03ab16d to
5465b07
Compare