Advanced Install

Install

License

To claim a free license go to m9sweeper licensing. Claiming a license is optional, but if you setup a license our online portal will enable remote monitoring. We can notify you, for example, if you a new version is available or if your environment is no longer being monitored for some reason.

Installation

We recommend putting your configuration in a values.yaml file and then deploying our app using helm. This example uses “helm upgrade –install”, which is an idempotent way of installing and/or upgrading the app. This is repeatable and the same command can be run regardless of whether you intend to upgrade or install the app.

helm repo add m9sweeper https://helm.m9sweeper.io/chartrepo/m9sweeper && \
helm repo update && \
helm upgrade m9sweeper m9sweeper/m9sweeper --install --wait --create-namespace --namespace m9sweeper-system \
  --values values.yaml --version latest

When implementing for our customers we automate this in a CICD pipeline. Upgrades can be done simply by changing which chart version you are deploying. By default, it installs the latest version, but you can add –version to install a specific version of m9sweeper.

At a minimum, you MUST specify these 4 values:

--set-string dash.init.superAdminEmail="super.admin@m9sweeper.io"
--set-string dash.init.superAdminPassword="password"
--set-string global.jwtSecret="changeme" \
--set-string global.apiKey="YOUR-API-KEY"

Validating Webhook

If you wish to have m9sweeper prevent applications from booting up that are not compliant with your specified policies, you will need the validating webhook. This installs automatically and should work without any configuration.

However, if you are running in Azure Kubernetes Service OR have the kubernetes api firewalled in such a way that it cannot reach out to a remote url for the validating webhook, then you will need to setup an nginx reverse proxy using our reverse proxy self-installer. This script will generate a CA Certificate Bundle and Nginx configuration to enable the reverse proxy to work in Azure Kubernetes Service.

Falco bulkhead Deployment

Depending on your environment, Falco can send an immense amount of alerts to M9sweeper. This could overload the application and cause it to crash. To avoid this, there is an option to deploy multiple instances of M9sweeper that only take api requests sent to /api/falco.

falco:
  bulkhead: true
  replicas: 1

When set to true, this will create a seperate deployment appended with “-falco”, a service, and when applicable, a service monitor. This also edits ingress, routing all API calls from Falco, into the bulkhead deployment.

Configuration Options

If postgresql is enabled, then it will deploy postgres db. Set to false to use an external postgres DB

postgres:
  enabled: true

If rabbitmq is enabled, then it will deploy rabbitmq. Set to false to use an external rabbitmq.

rabbitmq:
  enabled: true

The following table lists the configurable parameters of the chart and the default values.