Set up the cluster context

1. Log in to your account. If you have a federated account, include the --sso option.

   ibmcloud login [-g <resource_group>] [--sso]
   

2. Download and add the kubeconfig configuration file for your cluster to your existing kubeconfig in ~/.kube/config or the last file in the KUBECONFIG environment variable.

   ibmcloud oc cluster config --cluster <cluster_name_or_ID>
   

3. In your browser, navigate to the address of your cluster controller URL and append /console. For example, https://c0.containers.cloud.ibm.com:23652/console.

4. From the Red Hat OpenShift web console menu bar, click your profile IAM#user.name@email.com > Copy Login Command. Display and copy the oc login token command into your command line to authenticate from the CLI.

5. Verify that the oc commands run properly with your cluster by checking the version.

   oc version
   

   Example output:

   Client Version: v4.11.0
   Kubernetes Version: v1.25.8.2
   

Set up the Sysdig Helm repository

Add the Workload Protection Helm repository to your Helm instance.

1. Set the cluster context.

   ibmcloud ks cluster config --cluster <CLUSTER_NAME>
   

2. Add the Helm repository.

   helm repo add sysdig https://charts.sysdig.com
   

3. Update the repository to retrieve the latest versions of all Helm charts.

   helm repo update
   

4. List the Helm charts that are currently available for the Sysdig repository.

   helm search repo sysdig
   

5. Verify that the sysdig/sysdig-deploy Helm chart is listed.

Create the Helm values file

Define a YAML file and include the values to deploy the Workload Protection components that you plan to deploy. For example, name the file agent-values-monitor-secure.yaml.

The following YAML is a template that you can use to configure the Workload Protection components. You can customize the file by removing or commenting with # the sections that are not required for your agent deployment.

agent:
  ebpf:
    enabled: true
    kind: universal_ebpf
  collectorSettings:
    collectorHost: INGESTION_SATELLITE_ENDPOINT
    collectorPort: INGESTION_SATELLITE_ENDPOINT_PORT
  slim:
    enabled: true
global:
  clusterConfig:
    name: CLUSTER_NAME
  kspm:
    deploy: true
  sysdig:
    accessKey: SERVICE_ACCESS_KEY
    apiHost: API_ENDPOINT
nodeAnalyzer:
  secure: 
    vulnerabilityManagement:
      newEngineOnly: true
  nodeAnalyzer:
    runtimeScanner: 
      deploy: false
    benchmarkRunner:
      deploy: false
    hostScanner:
      deploy: false
    deploy: true
  natsUrl: wss://API_ENDPOINT
  sslVerifyCertificate: false
kspmCollector:
  natsUrl: wss://API_ENDPOINT
  sslVerifyCertificate: false
clusterScanner:
  enabled: true
  eveEnabled: true
  sslVerifyCertificate: false

Where:

CLUSTER_NAME

The name of the cluster where you are deploying the agent.

SERVICE_ACCESS_KEY

The Workload Protection instance access key.

INGESTION_SATELLITE_ENDPOINT

The Satellite endpoint extracted previously that points to the ingest endpoint. For example, c1bcda0323e0ef4b83aba-6b64a6ccc9c596bf59a86625d8fa2202-c111.us-east.satellite.appdomain.cloud.

INGESTION_SATELLITE_ENDPOINT_PORT

The port from the Satellite endpoint extracted previously that points to the ingest endpoint. For example, 30771.

API_ENDPOINT

The Satellite endpoint extracted previously that points to the Workload Protection private API endpoint. For example, c1bcda0323e0ef4b83aba-6b64a6ccc9c596bf59a86625d8fa2202-c111.us-east.satellite.appdomain.cloud:31924. In this case, both hostname and port are defined together.

Install the Helm chart

To deploy the agent, the Workload Protection components, or both, install the sysdig/sysdig-deploy chart and use the variables YAML file that you configured in the previous step.

Run the following command to install the agent by using the Helm chart:

helm install -n ibm-observe sysdig-agent sysdig/sysdig-deploy -f agent-values-monitor-secure.yaml

If you want to directly install the Workload Protection components without a Helm values file, you can run the following command. Use --set to set all the variables.

helm install sysdig-agent sysdig/sysdig-deploy --namespace ibm-observe --create-namespace \
    --set agent.ebpf.enabled=true \
    --set agent.ebpf.kind=universal_ebpf \
    --set global.sysdig.accessKey=<SERVICE_ACCESS_KEY> \
    --set global.sysdig.apiHost=<API_ENDPOINT> \
    --set agent.collectorSettings.collectorHost=<INGESTION_SATELLITE_ENDPOINT> \
    --set agent.collectorSettings.collectorPort=<INGESTION_SATELLITE_ENDPOINT_PORT> \
    --set nodeAnalyzer.natsUrl=wss://<API_ENDPOINT> \
    --set nodeAnalyzer.nodeAnalyzer.runtimeScanner.deploy=false \
    --set nodeAnalyzer.nodeAnalyzer.hostScanner.deploy=false \
    --set nodeAnalyzer.nodeAnalyzer.benchmarkRunner.deploy=false \
    --set nodeAnalyzer.nodeAnalyzer.sslVerifyCertificate=false \
    --set nodeAnalyzer.secure.vulnerabilityManagement.newEngineOnly=true \
    --set global.kspm.deploy=true \
    --set global.clusterConfig.name=<CLUSTER_NAME> \
    --set kspmCollector.natsUrl=wss://<API_ENDPOINT> \
    --set kspmCollector.sslVerifyCertificate=false \
    --set clusterScanner.enabled=true \
    --set clusterScanner.eveEnabled=true \
    --set clusterScanner.sslVerifyCertificate=true 

Where:

CLUSTER_NAME

The name of the cluster where you are deploying the agent.

SERVICE_ACCESS_KEY

The Workload Protection instance access key.

INGESTION_SATELLITE_ENDPOINT

The Satellite endpoint extracted previously that points to the ingest endpoint. For example, c1bcda0323e0ef4b83aba-6b64a6ccc9c596bf59a86625d8fa2202-c111.us-east.satellite.appdomain.cloud.

INGESTION_SATELLITE_ENDPOINT_PORT

The port from the Satellite endpoint extracted previously that points to the ingest endpoint. For example, 30771.

API_ENDPOINT

The Satellite endpoint extracted previously that points to the Workload Protection private API endpoint. For example, c1bcda0323e0ef4b83aba-6b64a6ccc9c596bf59a86625d8fa2202-c111.us-east.satellite.appdomain.cloud:31924. In this case, both hostname and port are defined together.