Add configuration override for lapi, and basic support for HA

erwanval · Sep 20, 2023 · dfb62cf · dfb62cf
1 parent 54314f9
commit dfb62cf
Show file tree

Hide file tree

Showing 4 changed files with 42 additions and 0 deletions.
diff --git a/charts/crowdsec/README.md b/charts/crowdsec/README.md
@@ -45,6 +45,7 @@ helm delete crowdsec -n crowdsec
 | config."simulation.yaml" | string | `""` | Simulation configuration (https://docs.crowdsec.net/docs/next/scenarios/simulation/) |
 | config."console.yaml" | string | `""` |  |
 | config."capi_whitelists.yaml" | string | `""` |  |
+| config."config-override.yaml" | string | `""` | Override for common configuration parameters (https://docs.crowdsec.net/docs/configuration/crowdsec_configuration/#configuration-example) |
 | config."profiles.yaml" | string | `""` | Profiles configuration (https://docs.crowdsec.net/docs/next/profiles/format/#profile-configuration-example) |
 | config.notifications | object | `{}` | notifications configuration (https://docs.crowdsec.net/docs/next/notification_plugins/intro) |
 | tls.enabled | bool | `false` |  |
@@ -59,6 +60,7 @@ helm delete crowdsec -n crowdsec
 | tls.lapi.secret | string | `"{{ .Release.Name }}-lapi-tls"` |  |
 | secrets.username | string | `""` | agent username (default is generated randomly) |
 | secrets.password | string | `""` | agent password (default is generated randomly) |
+| lapi.replicas | number | `1` |  |
 | lapi.env | list | `[]` | environment variables from crowdsecurity/crowdsec docker image |
 | lapi.ingress | object | `{"annotations":{"nginx.ingress.kubernetes.io/backend-protocol":"HTTP"},"enabled":false,"host":"","ingressClassName":""}` | Enable ingress lapi object |
 | lapi.dashboard.enabled | bool | `false` | Enable Metabase Dashboard (by default disabled) |
@@ -83,6 +85,8 @@ helm delete crowdsec -n crowdsec
 | lapi.service.externalTrafficPolicy | string | `"Cluster"` |  |
 | lapi.nodeSelector | object | `{}` | nodeSelector for lapi |
 | lapi.tolerations | object | `{}` | tolerations for lapi |
+| lapi.affinity | object | `{}` | affinity for lapi |
+| lapi.topologySpreadConstraints | object | `{}` | topologySpreadConstraints for lapi |
 | lapi.metrics | object | `{"enabled":false,"serviceMonitor":{"enabled":false}}` | Enable service monitoring (exposes "metrics" port "6060" for Prometheus) |
 | lapi.metrics.serviceMonitor | object | `{"enabled":false}` | See also: https://github.com/prometheus-community/helm-charts/issues/106#issuecomment-700847774 |
 | lapi.strategy.type | string | `"RollingUpdate"` |  |

diff --git a/charts/crowdsec/templates/lapi-configmap.yaml b/charts/crowdsec/templates/lapi-configmap.yaml
@@ -31,6 +31,16 @@ data:
 {{ printf "%+v" (index .Values.config "capi_whitelists.yaml") | indent 4 }}
 {{ end }}
 ---
+{{- if index .Values.config "config-override.yaml" }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: crowdsec-config-override
+data:
+  config.yaml.local: |
+{{ printf "%+v" (index .Values.config "config-override.yaml") | indent 4 }}
+{{ end }}
+---
 {{ if (include "notificationsIsNotEmpty" .) }}
 apiVersion: v1
 kind: ConfigMap

diff --git a/charts/crowdsec/templates/lapi-deployment.yaml b/charts/crowdsec/templates/lapi-deployment.yaml
@@ -10,6 +10,7 @@ metadata:
     type: lapi
     version: v1
 spec:
+  replicas: {{ .Values.lapi.replicas }}
   selector:
     matchLabels:
       k8s-app: {{ .Release.Name }}
@@ -182,6 +183,11 @@ spec:
             mountPath: {{ $crowdsecConfig }}/capi_whitelists.yaml
             subPath: capi_whitelists.yaml
           {{ end }}
+          {{ if index .Values.config "config-override.yaml" }}
+          - name: crowdsec-config-override-volume
+            mountPath: {{ $crowdsecConfig }}/config.yaml.local
+            subPath: config.yaml.local
+          {{ end }}
           {{- if (include "notificationsIsNotEmpty" .) -}}
           {{ range $fileName, $content := .Values.config.notifications -}}
           {{- if $content }}
@@ -294,6 +300,11 @@ spec:
         configMap:
           name: crowdsec-capi-whitelists
       {{- end }}
+      {{ if index .Values.config "config-override.yaml" }}
+      - name: crowdsec-config-override-volume
+        configMap:
+          name: crowdsec-config-override
+      {{- end }}
       {{- if (include "notificationsIsNotEmpty" .) -}}
       {{ range $fileName, $content := .Values.config.notifications -}}
       {{- if $content }}
@@ -327,3 +338,7 @@ spec:
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.lapi.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/charts/crowdsec/values.yaml b/charts/crowdsec/values.yaml
@@ -71,6 +71,17 @@ config:
     #  filters:
     #    - Alert.Remediation == true && Alert.GetScope() == "Ip"
     #  ...
+  # -- General configuration (https://docs.crowdsec.net/docs/configuration/crowdsec_configuration/#configuration-example)
+  config-override.yaml: ""
+    #   |
+    # db_config:
+    #   type:     "postgresql"
+    #   user:     "crowdsec"
+    #   password: "${DB_PASSWORD}"
+    #   db_name:  "crowdsec"
+    #   host:     "192.168.0.2"
+    #   port:     "5432"
+    #   sslmode:  "required"
   # -- notifications configuration (https://docs.crowdsec.net/docs/next/notification_plugins/intro)
   notifications: {}
     # email.yaml: |
@@ -111,6 +122,8 @@ secrets:
 
 # lapi will deploy pod with crowdsec lapi and dashboard as deployment
 lapi:
+  # -- Replicas for lapi
+  replicas: 1
   # -- environment variables from crowdsecurity/crowdsec docker image
   env: []
     # by default disable the agent because it only needs the local API.