Repository navigation
Daemonset mode for appsec deployment #348
Description
Activity
@especially-relative: Thanks for opening an issue, it is currently awaiting triage.
If you haven't already, please provide the following information:
- kind :
bug,enhancementordocumentation - area :
agent,appsec,configuration,cscli,local-api
In the meantime, you can:
- Check Crowdsec Documentation to see if your issue can be self resolved.
- You can also join our Discord.
- Check Releases to make sure your agent is on the latest version.
Details
I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the forked project rr404/oss-governance-bot repository.
- kind :
@especially-relative: There are no 'kind' label on this issue. You need a 'kind' label to start the triage process.
/kind bug/kind documentation/kind enhancement
Details
I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the forked project rr404/oss-governance-bot repository.
/kind enchancement
Problem Statement
Many ingress/gateway installations use daemonsets to run an instance of the ingress/gateway controller per node. Many appsec configurations require a round-trip between the ingress/gateway container and the appsec container. In cases where the cluster spans many regions this may cause issues.
Feature suggestion
Provide an option to run the appsec container as a daemonset in addition to running as a deployment (left as default for backwards compatibility). The appsec service should also support both
internalTrafficPolicyandtrafficDistributionto provide options to avoid cross-region or even cross-node trafficAdditional background
The crowdsec agent container already supports both deployment and daemonset modes for a somewhat similar reason: it may be the case that it needs to collect logs from every node
Alternatives
internalTrafficPolicy/trafficDistributionvia kustomize to provide traffic supportAssumption
Appsec container does not need to make frequent round-trips to LAPI for each request
disclaimer
No AI was used