Chart: Node Analyzer

The Node Analyzer (NA) provides a method for deploying the components for three different Sysdig Secure features:

The Node Analyzer is deployed by default unless you set the value nodeAnalyzer.deploy to false.

The Node Analyzer daemonset contains three containers, each providing a specific functionality. This daemonset replaces the (deprecated) Node Image Analyzer daemonset.

Table of Contents

• Introduction
• Prerequisites
• Installing the Chart
• Uninstalling the Chart
• Configuration
• Support

Introduction

This chart adds the Sysdig Node Analyzer to all nodes in your cluster via a DaemonSet.

Prerequisites

• Kubernetes 1.9+ with Beta APIs enabled

Installing the Chart

First of all you need to add the Sysdig Helm Charts repository:

$ helm repo add sysdig https://charts.sysdig.com/

To install the chart with the release name node-analyzer, run:

$ helm install --namespace nodeanalyzer node-analyzer --set sysdig.accessKey=YOUR-KEY-HERE --set sysdig.settings.collector=COLLECTOR_URL sysdig/node-analyzer --set nodeAnalyzer.apiEndpoint=API_ENDPOINT

To find the values:

• YOUR-KEY-HERE: This is the sysdig access key.
• COLLECTOR_URL: This value is region-dependent in SaaS and is auto-completed on the Get Started page in the UI. (It is a custom value in on-prem installations.)
• API_ENDPOINT: This is the base URL (region-dependent) for Sysdig Secure and is auto-completed on the Get Started page. E.g. secure.sysdig.com, us2.app.sysdig.com, eu1.app.sysdig.com.

After a few seconds, you should see hosts and containers appearing in Sysdig Monitor and Sysdig Secure.

Tip: List all releases using helm list

See the Node Analyzer installation documentation for details about installation, and Running Node Analyzer Behind a Proxy for proxy settings.

Uninstalling the Chart

To uninstall/delete the sysdig-agent deployment:

$ helm delete --namespace nodeanalyzer node-analyzer

Tip: Use helm delete --namespace nodeanalyzer --purge node-analyzer to completely remove the release from Helm internal storage

The command removes all the Kubernetes components associated with the chart and deletes the release.

Configuration

The following table lists the configurable parameters of the Sysdig Node Analyzer chart and their default values.

Specify each parameter using the --set key=value[,key=value] argument to helm install. For example,

$ helm install --namespace nodeanalyzer node-analyzer \
    --set sysdig.accessKey=YOUR-KEY-HERE, \
    sysdig/node-analyzer

Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,

$ helm install --namespace nodeanalyzer node-analyzer -f values.yaml sysdig/node-analyzer

Tip: You can use the default values.yaml

Chart Components

Node Image Analyzer

See the Image Analyzer Configmap Options for details about the available options, and the Node Image Analyzer documentation for details about the Node Image Analyzer feature.

The node image analyzer (NIA) provides the capability to scan images as soon as they start running on hosts where the analyzer is installed. It is typically installed alongside the Sysdig agent container.

On container start-up, the analyzer scans all pre-existing running images present in the node. Additionally, it will scan any new image that enters a running state in the node. It will scan each image once, then forward the results to the Sysdig Secure scanning backend. Image metadata and the full scan report is then available in the Sysdig Secure UI.

Host Analyzer

See the Host Scanning Configuration Options for details about installation options, and the Host Scanning documentation for details about the Host Scanning feature.

The host analyzer provides the capability to scan packages installed on the host operating system to identify potential vulnerabilities. It is typically installed as part of the Node Analyzer which in turn is installed alongside the Sysdig Agent.

The host analyzer works by inspecting the files on the host root filesystem looking for installed packages and sending them to the Sysdig backend. It performs this operation by default once a day and its schedule can be configured as described below. Likewise, the list of directories to be examined during each scan can be configured.

Benchmark Runner

See the Benchmarks documentation for details on the Benchmark feature. The Benchmark Runner provides the capability to run CIS inspired benchmarks against your infrastructure. Benchmark tasks are configured in the UI, and the runner automatically runs these benchmarks on the configured scope and schedule. Note: if nodeAnalyzer.benchmarkRunner.includeSensitivePermissions is set to false, the service account will not have the full set of permissions needed to execute oc commands, which most checks in CIS Benchmark for OS4 require.

Support

For getting support from the Sysdig team, you should refer to the official Sysdig Support page.

In addition to this, you can browse the documentation for the different components of the Sysdig Platform:

• Sysdig Monitor
• Sysdig Secure
• Platform Documentation
• Monitor Documentation
• Secure Documentation