lacework agent k8s

lacework-k8s.yaml

apiVersion: apps/v1

kind: DaemonSet
metadata:
  name: lacework-agent
  labels:
    tier: monitoring
    app: lacework-agent
spec:
  selector:
    matchLabels:
      name: lacework
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        name: lacework
    spec:
      tolerations: 
        - key: node-role.kubernetes.io/master
          effect: NoSchedule
        - key: node-role.kubernetes.io/control-plane
          effect: NoSchedule
        - key: node-role.kubernetes.io/infra
          effect: NoSchedule
      terminationGracePeriodSeconds: 20
      hostPID: true
      hostNetwork: true
      containers:
      - name: lacework
        image: lacework/datacollector
        imagePullPolicy: Always
        resources:
          requests:
            cpu: "200m"
            memory: "512Mi"
          limits:
            cpu: "500m"
            memory: "1450Mi"
        securityContext:
          privileged: true
        volumeMounts:
          - name: cfgmap
            mountPath: /var/lib/lacework/config
          - name: dev
            mountPath: /dev
          - name: sys
            mountPath: /sys
          - name: log
            mountPath: /var/log
          - name: passwd
            mountPath: /etc/passwd
            readOnly: true
          - name: group
            mountPath: /etc/group
            readOnly: true
          - name: hostlacework
            mountPath: /var/lib/lacework/collector
          - name: hostlaceworkcontroller
            mountPath: /var/lib/lacework/controller
          - name: hostroot
            mountPath: /laceworkfim
            readOnly: true
          - name: podinfo
            mountPath: /etc/podinfo
      volumes:
        - name: dev
          hostPath:
              path: /dev
        - name: sys
          hostPath:
              path: /sys
        - name: log
          hostPath:
              path: /var/log
        - name: passwd
          hostPath:
              path: /etc/passwd
        - name: group
          hostPath:
              path: /etc/group
        - name: hostroot
          hostPath:
              path: /
        - name: hostlacework
          hostPath:
              path: /var/lib/lacework/collector
        - name: hostlaceworkcontroller
          hostPath:
              path: /var/lib/lacework/controller
        - name: cfgmap
          configMap:
            defaultMode: 0640
            name: lacework-config
            items:
            - key: config.json
              path: config.json
            - key: syscall_config.yaml
              path: syscall_config.yaml
        - name: podinfo
          downwardAPI:
            items:
              - path: "labels"
                fieldRef:
                  fieldPath: metadata.labels
              - path: "annotations"
                fieldRef:
                  fieldPath: metadata.annotations