feat(crowdsec): switch agent to loki acquisition with static identity

Read traefik logs from Loki instead of file tail. Static machine identity via pre-created secret stops 403 register races. Add janitor cronjob, dashboards, whitelists and metrics.

crowdsec/k8s/crowdsec-values.yaml

@@ -1,57 +1,102 @@
 container_runtime: containerd
+
 agent:
+  acquisition: []
+  additionalAcquisition:
+    - labels:
+        type: traefik
+      limit: 1000
+      query: |
+        {namespace="traefik"}
+      source: loki
+      url: http://loki.prometheus.svc.cluster.local:3100/
+      wait_for_ready: 30s
   env:
     - name: COLLECTIONS
-      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios"
+      value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
     - name: DISABLE_COLLECTIONS
-      value: "crowdsecurity/linux crowdsecurity/sshd"
-
-  acquisition:
-    - namespace: traefik
-      podName: "*traefik*"
-      program: traefik
-      poll_without_inotify: true
-
+      value: crowdsecurity/sshd
+  metrics:
+    enabled: true
+    serviceMonitor:
+      additionalLabels:
+        release: prometheus-stack
+      enabled: true
+  # Static machine identity: agent pods mount pre-created LAPI credentials
+  # (Secret crowdsec-agent-credentials, key local_api_credentials.yaml)
+  # at the exact path the agent entrypoint expects. Together with the
+  # patched register-init (enforced by janitor-cronjob.yaml) the agent
+  # never calls `cscli lapi register` in steady state, so pod names,
+  # restarts and reboots can no longer break it.
+  extraVolumes:
+    - name: static-creds
+      secret:
+        secretName: crowdsec-agent-credentials
+        items:
+          - key: local_api_credentials.yaml
+            path: local_api_credentials.yaml
+  extraVolumeMounts:
+    - name: static-creds
+      mountPath: /tmp_config/local_api_credentials.yaml
+      subPath: local_api_credentials.yaml
+      readOnly: true
   resources:
-    requests:
-      cpu: 50m
-      memory: 100Mi
     limits:
       cpu: 200m
       memory: 500Mi
+    requests:
+      cpu: 50m
+      memory: 100Mi
+
+config:
+  parsers:
+    s02-enrich:
+      mobile-whitelist.yaml: |
+        name: forust/mobile-whitelist
+        description: "Whitelist SWAN/4ka mobile network"
+        whitelist:
+          reason: "Mobile IP whitelist"
+          cidr:
+            - "84.245.64.0/18"
+
+  postoverflows:
+    s01-whitelist:
+      home-dynamic-ip.yaml: |
+        name: forust/home-dynamic-ip
+        description: "Whitelist home dynamic IP"
+        whitelist:
+          reason: "Home dynamic IP"
+          expression:
+            - evt.Overflow.Alert.Source.IP in LookupHost("ddns.forust.xyz")
 
 lapi:
   env:
     - name: COLLECTIONS
-      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios"
+      value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
     - name: DISABLE_COLLECTIONS
-      value: "crowdsecurity/linux crowdsecurity/sshd"
-  service:
-    type: ClusterIP
-  persistentVolume:
-    data:
+      value: crowdsecurity/linux crowdsecurity/sshd
+  metrics:
+    enabled: true
+    serviceMonitor:
+      additionalLabels:
+        release: prometheus-stack
       enabled: true
-      storageClassName: local-path-retain
-      size: 1Gi
+  persistentVolume:
     config:
       enabled: true
-      storageClassName: local-path-retain
       size: 100Mi
-  storeLAPICscliCredentialsInSecret: true
+      storageClassName: local-path-retain
+    data:
+      enabled: true
+      size: 1Gi
+      storageClassName: local-path-retain
   resources:
-    requests:
-      cpu: 50m
-      memory: 150Mi
     limits:
       cpu: 400m
       memory: 500Mi
-
-metrics:
-  enabled: true
-  serviceMonitor:
-    additionalLabels:
-      release: prometheus-stack
-    enabled: true
-    interval: 30s
-    scrapeTimeout: 10s
-    namespace: prometheus
+    requests:
+      cpu: 50m
+      memory: 150Mi
+  service:
+    type: ClusterIP
+  storeLAPICscliCredentialsInSecret: true