Configuration

Requirements

To the Deckhouse Platform version: 1.76 and above.

To the versions of other modules:

• log-shipper: 1.0.6 and above.
• loki: any version.

Parameters

Schema version: 1

• settings

  object
  • settings.clusterSecurityEventDestination

    object

    Configs for ClusterSecurityEventDestination objects
    • settings.clusterSecurityEventDestination.clusterLoki

      boolean

      Whether to generate ClusterSecurityEventDestination for cluster Loki.

      Default: true

  • settings.controller

    object

    Security events controller settings.
    • settings.controller.replicas

      integer

      Number of controller replicas.

      Default: 1

      Allowed values: 1 <= X <= 10

    • settings.controller.resourcesRequests

      object

      Resource request management for controller. When vertical-pod-autoscaler is disabled, static or VPA min values are used as requests.
      • settings.controller.resourcesRequests.mode

        string

        Default: VPA

        Allowed values: VPA, Static

      • settings.controller.resourcesRequests.static

        object

        Default: {}

        • settings.controller.resourcesRequests.static.cpu

          Default: 10m

        • settings.controller.resourcesRequests.static.memory

          Default: 64Mi

      • settings.controller.resourcesRequests.vpa

        object

        Default: {}

        • settings.controller.resourcesRequests.vpa.cpu

          object

          Default: {}

          • settings.controller.resourcesRequests.vpa.cpu.max

            Default: 100m

          • settings.controller.resourcesRequests.vpa.cpu.min

            Default: 10m

        • settings.controller.resourcesRequests.vpa.memory

          object

          Default: {}

          • settings.controller.resourcesRequests.vpa.memory.max

            Default: 256Mi

          • settings.controller.resourcesRequests.vpa.memory.min

            Default: 64Mi

        • settings.controller.resourcesRequests.vpa.mode

          string

          Default: Initial

          Allowed values: Initial, Auto

    • settings.controller.vectorValidateTimeout

      string

      Timeout for the vector validate run the controller performs before publishing a new gateway Vector config (Go duration string, for example “30s”, “2m”). The controller validates with --no-environment, which takes about 2 seconds for a 256 KB config, so the default leaves a wide margin. If the check cannot be completed within the timeout, the config is published anyway and the gateway reloader validates it instead.

      Default: 60s

      Pattern: ^([0-9]+(\.[0-9]+)?(ns|us|ms|s|m|h))+$

  • settings.gateway

    object

    Security events gateway settings.
    • settings.gateway.buffer

      object

      Default buffer settings for all gateway Vector sinks. Can be overridden per-destination in ClusterSecurityEventDestination.spec.buffer. Defaults to Disk + Block for zero data loss of security events.
      • settings.gateway.buffer.maxEvents

        integer

        Maximum number of events in the buffer. Used as a secondary limit for Memory type. Ignored when type is Disk (disk buffer uses maxSize only).

        Default: 500

        Allowed values: 100 <= X <= 10000000

      • settings.gateway.buffer.maxSize

        string

        Maximum size of the buffer as a Kubernetes quantity string with a mandatory unit suffix (e.g. “512Mi”, “1Gi”, “256Mi”). Plain numbers without a unit suffix are NOT accepted. For Disk type: maximum disk space used on the volume. For Memory type: approximate memory limit for the in-memory ring buffer.

        Default: 512Mi

        Pattern: ^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|Pi|Ei|k|M|G|T|P|E)$

      • settings.gateway.buffer.type

        string

        Buffer type.

        • Disk: disk-based buffer using LevelDB. Survives Vector process restarts within the pod. DEFAULT — ensures no security events are lost during temporary destination outages.
        • Memory: in-memory ring buffer. Faster, but all events are lost on Vector process restart. Use only for test/dev environments.

        Default: Disk

        Allowed values: Memory, Disk

      • settings.gateway.buffer.whenFull

        string

        Behavior when the buffer is full.

        • Block: apply backpressure to upstream. Pipeline slows down but NO events are lost. DEFAULT — the correct choice for security events.
        • DropNewest: discard incoming events. Data loss occurs but no backpressure. Use only when data loss is acceptable (test environments).

        Default: Block

        Allowed values: Block, DropNewest

    • settings.gateway.logShipperBuffer

      object

      Buffer settings for the log-shipper ClusterLogDestination that ships events from agents to the gateway. Defaults to Disk + Block for zero data loss on the agent side.
      • settings.gateway.logShipperBuffer.maxEvents

        integer

        Maximum number of events in the agent buffer. Used as a secondary limit for Memory type.

        Default: 500

        Allowed values: 100 <= X <= 10000000

      • settings.gateway.logShipperBuffer.maxSize

        string

        Maximum size of the agent buffer as a Kubernetes quantity string with a mandatory unit suffix (e.g. “257Mi”, “512Mi”, “1Gi”). Plain numbers without a unit suffix are NOT accepted. Per node agent. Must be at least 268435488 bytes (~256MB) — log-shipper’s disk buffer minimum. A value of exactly “256Mi” (268435456 bytes) is rejected by the agent.

        Default: 257Mi

        Pattern: ^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|Pi|Ei|k|M|G|T|P|E)$

      • settings.gateway.logShipperBuffer.type

        string

        Buffer type for the log-shipper agent buffer.

        • Disk: disk-based buffer. Survives Vector process restarts on the agent node. DEFAULT.
        • Memory: in-memory ring buffer. Events are lost on agent restart.

        Default: Disk

        Allowed values: Memory, Disk

      • settings.gateway.logShipperBuffer.whenFull

        string

        Behavior when the agent buffer is full.

        • Block: apply backpressure. NO events are lost. DEFAULT.
        • DropNewest: discard incoming events. Data loss occurs.

        Default: Block

        Allowed values: Block, DropNewest

    • settings.gateway.nodeSelector

      object

      Node selector for gateway Deployment.
    • settings.gateway.reloaderValidateTimeout

      string

      Timeout for vector validate executed by the gateway reloader sidecar (Go duration string, e.g. “45s”, “2m”). Increase this if the gateway vector config is large (many SecurityEventDefinitions × transforms) and vector validate is being killed by the reloader before completing. Range: 5s–5m; invalid values fall back to 120s.

      Default: 120s

      Pattern: ^([0-9]+(\.[0-9]+)?(ns|us|ms|s|m|h))+$

    • settings.gateway.replicas

      integer

      Number of gateway replicas.

      Default: 2

      Allowed values: 1 <= X <= 100

    • settings.gateway.resources

      object

      Resource requests/limits for gateway pods.
      • settings.gateway.resources.limits

        object
        • settings.gateway.resources.limits.cpu

          string

          Pattern: ^([0-9]+(\.[0-9]+)?|[0-9]+m)$

        • settings.gateway.resources.limits.memory

          string

          Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|k|Ei|Pi|Ti|Gi|Mi|Ki)?$

      • settings.gateway.resources.requests

        object
        • settings.gateway.resources.requests.cpu

          string

          Default: 100m

          Pattern: ^([0-9]+(\.[0-9]+)?|[0-9]+m)$

        • settings.gateway.resources.requests.memory

          string

          Default: 128Mi

          Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|k|Ei|Pi|Ti|Gi|Mi|Ki)?$

    • settings.gateway.resourcesRequests

      object

      Resource request management for gateway (vector container). When vertical-pod-autoscaler is disabled, static or VPA min values are used as requests.
      • settings.gateway.resourcesRequests.mode

        string

        Default: VPA

        Allowed values: VPA, Static

      • settings.gateway.resourcesRequests.static

        object

        Default: {}

        • settings.gateway.resourcesRequests.static.cpu

          Default: 100m

        • settings.gateway.resourcesRequests.static.memory

          Default: 128Mi

      • settings.gateway.resourcesRequests.vpa

        object

        Default: {}

        • settings.gateway.resourcesRequests.vpa.cpu

          object

          Default: {}

          • settings.gateway.resourcesRequests.vpa.cpu.max

            Default: 3000m

          • settings.gateway.resourcesRequests.vpa.cpu.min

            Default: 100m

        • settings.gateway.resourcesRequests.vpa.memory

          object

          Default: {}

          • settings.gateway.resourcesRequests.vpa.memory.max

            Default: 4096Mi

          • settings.gateway.resourcesRequests.vpa.memory.min

            Default: 128Mi

        • settings.gateway.resourcesRequests.vpa.mode

          string

          Default: Initial

          Allowed values: Initial, Auto

    • settings.gateway.tolerations

      array of objects

      Tolerations for gateway pods.
  • settings.securityEventConfig

    object

    Default configuration of security alert sources and destination (default resource ClusterSecurityEventConfig). Can be overridden per CR ClusterSecurityEventShipper.

    Default: { "destinations": [ "cluster-loki" ], "enabled": true, "sourcesMasks": [ "podSecurityEventShipper/*", "clusterSecurityEventShipper/*" ] }

    • settings.securityEventConfig.cef

      object

      Default CEF (Common Event Format) metadata for the generated ClusterSecurityEventConfig. These values populate spec.cef in the default CSEC and are used as fallbacks when a ClusterSecurityEventDestination with encoding.codec=CEF does not specify its own device vendor/product/version and CEF format version.
      • settings.securityEventConfig.cef.deviceProduct

        string

        Default device product for CEF header.

        Applies to a destination that does not set encoding.cef.deviceProduct of its own. When the parameter is omitted, security-events-manager is used.

        Maximum length: 63

      • settings.securityEventConfig.cef.deviceVendor

        string

        Default device vendor for CEF header.

        Applies to a destination that does not set encoding.cef.deviceVendor of its own. When the parameter is omitted, Deckhouse is used.

        Maximum length: 63

      • settings.securityEventConfig.cef.deviceVersion

        string

        Default device version for CEF header. This is the fourth field of the CEF header and is unrelated to version, which selects the format of the CEF: prefix.

        Applies to a destination that does not set encoding.cef.deviceVersion of its own. When the parameter is omitted, 1 is used.

        Maximum length: 63

      • settings.securityEventConfig.cef.extensions

        array of objects

        Default additional CEF extensions built from SecurityEvent fields.

        The list populates spec.cef.extensions of the generated ClusterSecurityEventConfig and applies to a CEF destination that does not set encoding.cef.extensions of its own. Every item adds a key=value pair after the base set of extensions; an item whose key is in the base set replaces that pair. The item format and the validation rules are those of encoding.cef.extensions of ClusterSecurityEventDestination: keys are unique, label is required exactly for the custom keys cs1–cs6, cn1–cn3 and the like, a key does not end with Label, and a path segment is at most 128 characters long.

        • settings.securityEventConfig.cef.extensions.field

          string

          Path to the SecurityEvent field the value is taken from.

          The path is dot-separated, for example metadata.extra.repository.

          Length: 1..1024

          Pattern: ^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*){0,15}$

        • settings.securityEventConfig.cef.extensions.key

          string

          Key of the CEF extension.

          For example, cs4, cn1 or fname.

          Length: 1..63

          Pattern: ^[A-Za-z][A-Za-z0-9]*$

        • settings.securityEventConfig.cef.extensions.label

          string

          Name of the value for a custom key, written as the <KEY>Label pair.

          Length: 1..255

      • settings.securityEventConfig.cef.version

        string

        Default CEF format version written in the CEF: prefix of the header.

        Applies to a destination that does not set encoding.cef.version of its own. When the parameter is omitted, V0 is used.

        Possible values:

        • V0 — emit the CEF:0 prefix, used by default and expected by most SIEM systems;
        • V1 — emit the CEF:1 prefix.

        Allowed values: V0, V1

    • settings.securityEventConfig.destinations

      array of strings

      List of ClusterSecurityEventDestination names.

      Default: [ "cluster-loki" ]

      • settings.securityEventConfig.destinations.Element of the array

        string

        Maximum length: 253

    • settings.securityEventConfig.enabled

      boolean

      Generate default ClusterSecurityEventConfig.

      Default: true

    • settings.securityEventConfig.minimumSeverityThreshold

      string

      Minimal severity to ship (inclusive).

      Default: Low

      Allowed values: Low, Medium, High, Critical

    • settings.securityEventConfig.sources

      array of strings

      List of enabled source identifiers (used when sourcesMasks is not set).
      • settings.securityEventConfig.sources.Element of the array

        string

        Maximum length: 253

    • settings.securityEventConfig.sourcesMasks

      array of strings

      List of glob-style masks for enabled sources (e.g. “*” for all). Mutually exclusive with sources. When set, ClusterSecurityEventConfig uses enabledSourcesMasks.
      • settings.securityEventConfig.sourcesMasks.Element of the array

        string

        Maximum length: 253