Skip to content
bifrost security

Helm Chart

Current bifrost-agent version: 1.3.0

Example configurations

Section titled “Example configurations”

Below are some example configurations for the helm chart.

Inline secret

Section titled “Inline secret”
agent:
    key: <AGENT_KEY>

Existing secret

Section titled “Existing secret”
Terminal window
kubectl create secret generic bifrost-agent --from-literal=agent-key=<AGENT_KEY>
agent:
    secret:
        name: bifrost-agent
        key: agent-key

Mounted secret

Section titled “Mounted secret”

Use a secret mounted as a volume. It can be mounted by as CSI driver or in this case, as a configMap.

Terminal window
kubectl create configmap bifrost-agent --from-literal=agent-key=<AGENT_KEY>
agent:
    keyFilePath: /mnt/secrets/agent-key


extraVolumes:
    - name: agent-key
      configMap:
          name: bifrost-agent
          items:
              - key: agent-key
                path: agent-key


extraVolumeMounts:
    - name: agent-key
      mountPath: /mnt/secrets
      readOnly: true

Monitor all pods

Section titled “Monitor all pods”

By default, bifrost is only used for pods with the label bifrost.com/enabled: "true". Set monitor.mode to all to use bifrost for every pod in the cluster, without having to label them.

monitor:
    mode: all

Pods in the kube-system namespace and the bifrost-agent’s own pods are always excluded. To exclude other pods, label them with bifrost.com/enabled: "false". See Annotations & labels.

Reference

Section titled “Reference”
image:
  # The container registry to pull the agent image from.
  repository: public.ecr.aws/bifrostsec/bifrost-agent
  # Kubernetes imagePullPolicy on Deployment.
  pullPolicy: IfNotPresent
  # Image tag for the container, this will default to `.Chart.AppVersion` if not set.
  tag: ""

# Image pull secrets.
imagePullSecrets: []

admissionWebhook:
  # Enable the admission webhook in the agent.
  enabled: true
  # Port agent should listen on for webhook requests.
  servicePort: 9443
  certManager:
    # Enable cert-manager integration.
    enabled: false
  # Policy for reinvoking the webhook. One of "Never" or "IfNeeded".
  reinvocationPolicy: Never

monitor:
  # Which Pods the admission webhook is called for. One of "bifrost_label" or "all".
  # "bifrost_label": only call the webhook for Pods with the label bifrost.com/enabled="true".
  # "all": call the webhook for every Pod action, except for Pods in the kube-system namespace and
  #        Pods with the label bifrost.com/enabled="false" (set on the agent's own Pods).
  mode: bifrost_label
  # Namespaces to exclude in addition to kube-system. Only used when mode is "all".
  excludeNamespaces: []
  # - my-unmonitored-namespace

agent:
  #  Secret key for the agent to authenticate with the server.
  key: ""
  #  Path to the mount file for the agent key. Can be set if using CSI driver to mount the secret.
  keyFilePath: ""
  secret:
    name: ""
    key: ""

extraVolumes: []  # Additional volumes
extraVolumeMounts: []  # Additional volume mounts

server:
  # URL of the upstream server (defaults to: https://portal.bifrostsec.com).
  url: ""

event:
  # URL of the event receiver (defaults to: server.url).
  url: ""

kernelAuditControl: true

# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
tolerations: []

# Port for the agent to listen on for health checks and metrics scraping
port: 8080

# Enable debug logging in the agent
debug: false

securityfs:
  # Enable securityfs mount in the agent.
  enabled: true
  # Path to the securityfs mount point on host. Specify /sys/kernel/security/apparmor if you only want to mount the AppArmor sub-folder to reduce exposed securityfs.
  mountPath: /sys/kernel/security