Generate a Helm Deployment Chart for Defender
Creates a Helm deployment file that you can use to deploy Defenders to your cluster.
Refer to the following example cURL command:
$ curl -k \
-u <USER> \
-H 'Content-Type: application/json' \
-X POST \
-o twistlock-defender-helm.tar.gz \
- Array [
Annotations is mapping of key-value pairs of annotations metadata - optional.
Cluster is the kubernetes or ecs cluster name.
CollectPodLabels indicates whether to collect pod related labels resource labels.
ConsoleAddr is the console address for defender communication.
CPULimit is the cpu limit for the defender deamonset - optional.
CredentialID is the name of the credential used.
CRI indicates defender uses CRI instead of docker.
DockerSocketPath is the path of the docker socket file.
GKEAutopilot indicates the deployment is requested for GKE Autopilot.
Image is the full daemonset image name.
MonitorIstio indicates whether to monitor Istio.
MemoryLimit is a memory limit for the defender deamonset - optional.
Namespace is the target deamonset namespaces.
NodeSelector is a key/value node selector.
Orchestration is the orchestration type.
PriorityClassName is the name of the priority class for the defender - optional.
Privileged indicates whether to run defenders as privileged.
ProjectID is the kubernetes cluster project ID.
DefenderProxyOpt holds options for defender proxy configuration It embeds ProxySettings but override it's Password field with a simple string This is needed in order to avoid Secret's MarshalJSON method, which depends on existence of master key file
Proxy's CA for Defender to trust. Required when using TLS intercept proxies.
List of addresses for which the proxy should not be used.
Username to authenticate with the proxy.
Region is the kubernetes cluster location region.
RoleARN is the role's ARN to associate with the created service account - optional.
SecretsName is the name of the secret to pull.
SelinuxEnforced indicates whether selinux is enforced on the target host.
MonitorServiceAccounts indicates whether to monitor service accounts.
Talos indicates if the daemonset is to be deployed on a Talos Linux k8s cluster.
Tolerations is a list of tolerations for the defender deamonset - optional.
Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. +optional.
Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. +optional.
Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. +optional.
TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. +optional.
Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. +optional.
UniqueHostname indicates whether to assign unique hostnames.