From b2f6473de0352b7384c92ed61e3c7e5eba9a0f29 Mon Sep 17 00:00:00 2001 From: Anastasios Papagiannis Date: Mon, 16 Sep 2024 09:46:33 +0000 Subject: [PATCH] Export EventCache tunables in the Helm Chart Signed-off-by: Anastasios Papagiannis --- docs/content/en/docs/reference/helm-chart.md | 2 ++ install/kubernetes/tetragon/README.md | 2 ++ install/kubernetes/tetragon/templates/tetragon_configmap.yaml | 2 ++ install/kubernetes/tetragon/values.yaml | 4 ++++ 4 files changed, 10 insertions(+) diff --git a/docs/content/en/docs/reference/helm-chart.md b/docs/content/en/docs/reference/helm-chart.md index 80b6c21d583..7dce1c9593c 100644 --- a/docs/content/en/docs/reference/helm-chart.md +++ b/docs/content/en/docs/reference/helm-chart.md @@ -81,6 +81,8 @@ To use [the values available](#values), with `helm install` or `helm upgrade`, u | tetragon.enableProcessCred | bool | `false` | Enable Capabilities visibility in exec and kprobe events. | | tetragon.enableProcessNs | bool | `false` | Enable Namespaces visibility in exec and kprobe events. | | tetragon.enabled | bool | `true` | | +| tetragon.eventCacheRetries | int | `15` | Configure the number of retries in tetragon's event cache. | +| tetragon.eventCacheRetryDelay | int | `2` | Configure the delay (in seconds) between retires in tetragon's event cache. | | tetragon.exportAllowList | string | `"{\"event_set\":[\"PROCESS_EXEC\", \"PROCESS_EXIT\", \"PROCESS_KPROBE\", \"PROCESS_UPROBE\", \"PROCESS_TRACEPOINT\", \"PROCESS_LSM\"]}"` | Allowlist for JSON export. For example, to export only process_connect events from the default namespace: exportAllowList: | {"namespace":["default"],"event_set":["PROCESS_EXEC"]} | | tetragon.exportDenyList | string | `"{\"health_check\":true}\n{\"namespace\":[\"\", \"cilium\", \"kube-system\"]}"` | Denylist for JSON export. For example, to exclude exec events that look similar to Kubernetes health checks and all the events from kube-system namespace and the host: exportDenyList: | {"health_check":true} {"namespace":["kube-system",""]} | | tetragon.exportFileCompress | bool | `false` | Compress rotated JSON export files. | diff --git a/install/kubernetes/tetragon/README.md b/install/kubernetes/tetragon/README.md index 732ffcc162a..3f72e09d051 100644 --- a/install/kubernetes/tetragon/README.md +++ b/install/kubernetes/tetragon/README.md @@ -63,6 +63,8 @@ Helm chart for Tetragon | tetragon.enableProcessCred | bool | `false` | Enable Capabilities visibility in exec and kprobe events. | | tetragon.enableProcessNs | bool | `false` | Enable Namespaces visibility in exec and kprobe events. | | tetragon.enabled | bool | `true` | | +| tetragon.eventCacheRetries | int | `15` | Configure the number of retries in tetragon's event cache. | +| tetragon.eventCacheRetryDelay | int | `2` | Configure the delay (in seconds) between retires in tetragon's event cache. | | tetragon.exportAllowList | string | `"{\"event_set\":[\"PROCESS_EXEC\", \"PROCESS_EXIT\", \"PROCESS_KPROBE\", \"PROCESS_UPROBE\", \"PROCESS_TRACEPOINT\", \"PROCESS_LSM\"]}"` | Allowlist for JSON export. For example, to export only process_connect events from the default namespace: exportAllowList: | {"namespace":["default"],"event_set":["PROCESS_EXEC"]} | | tetragon.exportDenyList | string | `"{\"health_check\":true}\n{\"namespace\":[\"\", \"cilium\", \"kube-system\"]}"` | Denylist for JSON export. For example, to exclude exec events that look similar to Kubernetes health checks and all the events from kube-system namespace and the host: exportDenyList: | {"health_check":true} {"namespace":["kube-system",""]} | | tetragon.exportFileCompress | bool | `false` | Compress rotated JSON export files. | diff --git a/install/kubernetes/tetragon/templates/tetragon_configmap.yaml b/install/kubernetes/tetragon/templates/tetragon_configmap.yaml index 511692a2417..4d56e68c84e 100644 --- a/install/kubernetes/tetragon/templates/tetragon_configmap.yaml +++ b/install/kubernetes/tetragon/templates/tetragon_configmap.yaml @@ -67,4 +67,6 @@ data: {{- if .Values.tetragon.pprof.enabled }} pprof-address: {{ .Values.tetragon.pprof.address }}:{{ .Values.tetragon.pprof.port }} {{- end }} + event-cache-retries: {{ .Values.tetragon.eventCacheRetries | quote }} + event-cache-retry-delay: {{ .Values.tetragon.eventCacheRetryDelay | quote }} {{- include "configmap.extra" . | nindent 2 }} diff --git a/install/kubernetes/tetragon/values.yaml b/install/kubernetes/tetragon/values.yaml index f1686d31f08..60f2a76bb87 100644 --- a/install/kubernetes/tetragon/values.yaml +++ b/install/kubernetes/tetragon/values.yaml @@ -222,6 +222,10 @@ tetragon: extraVolumeMounts: [] # -- resources for the the oci-hook-setup init container resources: {} + # -- Configure the number of retries in tetragon's event cache. + eventCacheRetries: 15 + # -- Configure the delay (in seconds) between retires in tetragon's event cache. + eventCacheRetryDelay: 2 # Tetragon Operator settings tetragonOperator: # -- Enables the Tetragon Operator.