##################################################################################################
# eBPF Sensor Configuration Settings (Helm Values)
# Copyright: Levo Inc., 2025
#
# Helm Values file to configure eBPF Sensor.
# See https://helm.sh/docs/chart_template_guide/values_files/ for more information.
#
##################################################################################################

sensor:
  config:
    # --------------------------------------------------------------------------------------------
    # Factory Settings: DO NOT MODIFY
    # --------------------------------------------------------------------------------------------
    #bpf-object-file: /opt/levo/libexec/levo/ebpf-sensor/bpf_progs.bpf.o
    #debug: []
    #legacy-kernel-btf-path: ""
    #single-threaded-mode: false
    #worker-threads: 3 # Defaults to 3, or the number of CPUs in the system, whichever is greater
    #metadata-resolution-failure-policy: ignore # policy for handling metadata resolution failures
    trace-client-traffic: true # enable tracing of client-side traffic generated by the host
    #trace-non-k8s-traffic: false # enable tracing of non-Kubernetes traffic when deployed within a Kubernetes DaemonSet
    #http-proxy: "" # Proxy used for HTTP requests
    #https-proxy: "" # Proxy used for HTTPS requests
    #kube-api-rate-limit-time: 10 # Interval between each successful Kube Api call in seconds
    # --------------------------------------------------------------------------------------------
    
    
    # --------------------------------------------------------------------------------------------
    # Default Application Settings:
    # --------------------------------------------------------------------------------------------
    # Auto discovered API endpoints and their OpenAPI specifications are show in the API Catalog
    # grouped under this application name. The application name helps segregate and group API
    # endpoints from different environments.
    
    default-service-name: default
    # --------------------------------------------------------------------------------------------
    
    
    # --------------------------------------------------------------------------------------------
    # Satellite Settings:
    # --------------------------------------------------------------------------------------------
    
    # Use HTTP/2 (gRPC) for communication with the collector. If this is disabled, HTTP/1.1 will be used.
    collector-grpc-transport: true
    
    # --------------------------------------------------------------------------------------------
    
    # --------------------------------------------------------------------------------------------
    # API Trace Export Rate Limiting:
    # --------------------------------------------------------------------------------------------
    # By default, the sensor rate-limits the overall number of request-response traces it exports
    # to the satellite.  It also rate-limits traces on a per-endpoint basis.  Rate limiting can
    # be disabled or adjusted, but doing so may affect the performance of downstream Levo
    # services.
    
    # enable-export-rate-limiting: true
    # max-total-exported-requests-per-second: 100
    # max-per-endpoint-exported-requests-per-second: 2
    # token-bucket-refresh-period-ms: 1000 # 1 second
    
    # Maximum number of events within a fixed window of time, disabled by default, set to positive number to enable
    # bpf-rate-limit-window-size: -1
    # Time interval in milli-seconds during which the specified number of events (bpf-rate-limit-window-size) are allowed
    # bpf-rate-limit-window-duration-ms: 1000
    # --------------------------------------------------------------------------------------------
    
    # --------------------------------------------------------------------------------------------
    # Metrics Settings:
    # --------------------------------------------------------------------------------------------
    # Uncomment and modify to enable the printing of sensor metrics alongside other sensor logging
    # messages.
    
    # export-otel-logs: true
    # export-metrics-to-log: true
    enable-metrics: true
    # --------------------------------------------------------------------------------------------
    
    # --------------------------------------------------------------------------------------------
    # TLS Settings: Configs for TLS connectivity with Satellite
    # --------------------------------------------------------------------------------------------
    #ignore-ssl-verify: false # Ignore ssl verify when connecting to the collector
    #tls-client-cert-path: "" # TLS Client certificate path
    #tls-client-key-path: "" # TLS Client key path
    #tls-ca-cert-path: "" # TLS CA Cert path
    # --------------------------------------------------------------------------------------------
    
    # --------------------------------------------------------------------------------------------
    # Process Filters: process command names/IDs to monitor & capture API traffic.
    # --------------------------------------------------------------------------------------------
    # Uncomment and modify appropriately to limit capture to specific process names or IDs.
    # Both monitored-commands and monitored-pids support list of names & IDs respectively.
    # NOTE: monitored-commands and monitored-pids settings are mutually exclusive
    # Command names will be truncated to 15 characters, since that is the maximum allowed comm size.
    # https://www.kernel.org/doc/html/latest/filesystems/proc.html#proc-pid-comm-proc-pid-task-tid-comm
    
    #monitored-commands:
    #  - <process command name. Example: nginx>
    #  - <process command name. Example: python3>
    
    ignored-commands:
      - proxy-agent
      - operator
      - metrics-server
      - kube-controller
      - pod_nanny
      - MetricsExtension
      - postgres
      - kube-state-metrics  # ref: https://github.com/kubernetes/kube-state-metrics
      - prometheus  # ref: https://github.com/prometheus/prometheus
      - node_exporter  # ref: https://github.com/prometheus/node_exporter
      - redis_exporter  # ref: https://github.com/oliver006/redis_exporter
      - cloud-node-manager  # ref: https://github.com/kubernetes-sigs/cloud-provider-azure/blob/ce798999ad48f6fb2063a808b9dcedec2fadd49a/examples/out-of-tree/cloud-node-manager.yaml
      - kube-proxy
      - loki
      - argocd-server
      - argocd-applicat
      - argocd-dex
      - argocd-notifica
      - argocd-repo-ser
      - kubectl-argo-ro
      - amazon-ssm-agen
      - aws
      - awsagent
      - aws_k8s_agent
      - aws_ebs_csi_dri
      - cluster_autosca
      - csi_attacher
      - csi_node_driver
      - csi_provisioner
      - csi_resizer
      - csi_snapshotter
      - datacollector
      - datadog_cluster
      - teleport
      - agent
      - process_agent
      - trace_agent
      - fluent-bit
    
    #monitored-pids:
    #  - <pid. Example: 123>
    #  - <pid. Example: 45>
    # --------------------------------------------------------------------------------------------
    
    
    # --------------------------------------------------------------------------------------------
    # IP Filters: IP/Port/Network address based granular filtering of API traffic.
    # --------------------------------------------------------------------------------------------
    # IP Filters enable granular capture of API traffic based on various criteria.
    # Default values ignore traffic from standard ports that normally do not carry HTTP traffic.
    # Refer to documentation on how these can be customized to suit your environment.
    ip-filter-list:
      default-policy: accept # Default policy is to capture all traffic
      entries: # Specific 'entries' can override the default policy
        ### Host Ports ###
        # Host Port is the server listening port, where client connections are accepted.
        - policy: drop
          host-ports: 53 # DNS
        - policy: drop
          host-ports: 2379-2380 # etcd
        - policy: drop
          host-ports: 9092-9093 # kafka
        - policy: drop
          host-ports: 27017-27019 # mongodb
        - policy: drop
          host-ports: 28017 # mongodb
        - policy: drop
          host-ports: 135 # SQL Server
        - policy: drop
          host-ports: 1433-1434 # SQL Server
        - policy: drop
          host-ports: 4022 # SQL Server
        - policy: drop
          host-ports: 3306 # MySQL
        - policy: drop
          host-ports: 33060-33062 # MySQL
        - policy: drop
          host-ports: 5432-5433 # Postgres
        - policy: drop
          host-ports: 5671-5672 # RabbitMQ
        - policy: drop
          host-ports: 15672-15675 # RabbitMQ
        - policy: drop
          host-ports: 25672 # RabbitMQ
        - policy: drop
          host-ports: 35672-35682 # RabbitMQ
        - policy: drop
          host-ports: 61613-61614 # RabbitMQ
        - policy: drop
          host-ports: 6379 # Redis
        - policy: drop
          host-ports: [2181, 3888, 3888] # ZooKeeper
        - policy: drop
          host-ports: [4317, 4318, 9999] # Levo's Satellite services
        - policy: drop
          host-ports: 8126 # datadog
        ### Peer Ports ###
        # Peer Port is the client port used in communication with the server listening port.
        - policy: drop
          peer-ports: 53 # DNS
        - policy: drop
          peer-ports: 2379-2380 # etcd
        - policy: drop
          peer-ports: 9092-9093 # kafka
        - policy: drop
          peer-ports: 27017-27019 # mongodb
        - policy: drop
          peer-ports: 28017 # mongodb
        - policy: drop
          peer-ports: 135 # SQL Server
        - policy: drop
          peer-ports: 1433-1434 # SQL Server
        - policy: drop
          peer-ports: 4022 # SQL Server
        - policy: drop
          peer-ports: 3306 # MySQL
        - policy: drop
          peer-ports: 33060-33062 # MySQL
        - policy: drop
          peer-ports: 5432-5433 # Postgres
        - policy: drop
          peer-ports: 5671-5672 # RabbitMQ
        - policy: drop
          peer-ports: 15672-15675 # RabbitMQ
        - policy: drop
          peer-ports: 25672 # RabbitMQ
        - policy: drop
          peer-ports: 35672-35682 # RabbitMQ
        - policy: drop
          peer-ports: 61613-61614 # RabbitMQ
        - policy: drop
          peer-ports: 6379 # Redis
        - policy: drop
          peer-ports: [2181, 3888, 3888] # ZooKeeper
        - policy: drop
          peer-ports: [4317, 4318, 9999] # Levo's Satellite services
        - policy: drop
          peer-ports: 8126 # datadog
        - policy: drop
          peer-network: 169.254.169.254 # AWS / Azure Metadata Service
    # --------------------------------------------------------------------------------------------
    
    
    # --------------------------------------------------------------------------------------------
    # URL Filters: API parameter based granular filtering of API traffic.
    # --------------------------------------------------------------------------------------------
    # URL filters allow granular filtering of API traffic based on the 'API endpoint Method' (operation),
    # the 'API Host' (Host Header), and the 'API endpoint's URI'.
    # Refer to the documentation for instructions on configuring URL filters.
    url-filter:
      default-url-action: trace # Trace all API endpoints by default
      rules:
        - action: ignore
          request-uri: /stats/prometheus
    
    
    # --------------------------------------------------------------------------------------------
    # Memory-related settings
    # --------------------------------------------------------------------------------------------
    # The maximum request or response body size the sensor will parse.  Request or response bodies
    # larger than this limit will be ignored by the sensor.
    # max-msg-body-size-bytes: 512000
    # ---------------------------------------------------------------------------------------------


    # --------------------------------------------------------------------------------------------
    # Kubernetes Pod Filters: Kubernetes pod properties based granular filtering of API traffic.
    # --------------------------------------------------------------------------------------------
    # Pod Filters enable granular capture of API traffic based on Kubernetes Pod attributes.
    # Rules should ideally be in decreasing order of specificity.
    # The first rule to match a pod's properties will be used.
    #
    # The settings below filter out traffic for common Kubernetes infrastructure namespaces
    # --------------------------------------------------------------------------------------------
    #
    k8s-pod-filter-list:
      default-policy: trace
      rules:
        - policy: ignore
          namespace: datadog
        - policy: ignore
          namespace: monitoring
        - policy: ignore
          namespace: prometheus
        - policy: ignore
          namespace: kubecost
        - policy: ignore
          namespace: kube.*
        - policy: ignore
          namespace: istio.*
        - policy: ignore
          namespace: levoai
        - policy: ignore
          namespace: calico.*
        - policy: ignore
          namespace: tigera.*
        - policy: ignore
          namespace: openebs
        - policy: ignore
          namespace: grafana
        - policy: ignore
          namespace: observability
        - policy: ignore
          namespace: argocd
        - policy: ignore
          namespace: argo_rollouts
        - policy: ignore
          namespace: logstash
        - policy: ignore
          namespace: lacework
        - policy: ignore
          namespace: .*
          owner-reference:
            kind: Node
            name: .*
    # --------------------------------------------------------------------------------------------
