Installation

# values.yaml for auditty-edge (chart defaults shown)

image:
  repository: public.ecr.aws/o8y0g3i1/space/edge
  tag: ""                      # empty: the chart's appVersion
  pullPolicy: IfNotPresent

commonLabels: {}               # applied to every resource

# Edge configuration, rendered into the auditty-config ConfigMap.
# Most of it hot-reloads on helm upgrade; see the Configuration guide.
configMap:
  create: true
  rollOnConfigChange: false    # true: any ConfigMap change rolls the pods

  cluster_name: ""             # REQUIRED: how this cluster is named in Hivemind
  # env_name: "prod"           # optional: powers the Environment filter in Hivemind
  hivemind_api_key: "placeholder"  # REPLACE, or use secretRef below
  # log_level: info            # debug | info (default) | warn | error
  # shadow_mode: false         # true: measure everything, suppress nothing
  # remote_rules:
  #   enabled: true            # fleet rules from Hivemind, on by default
  enable_rule_annotations: false   # per-workload annotation rules (needs Edge API)

  rules:
    - name: "intercept-prod-databases"
      action: intercept
      scope:
        namespaceIncludes: "prod"
        workloadIncludes: "database"
      description: "Start monitoring all production database workloads"
    - name: "preserve-prod-db-critical-errors"
      action: preserve
      scope:
        namespaceIncludes: "prod"
        workloadIncludes: "database"
      match:
        any:
          - entryIncludes: "CRITICAL"
          - entryIncludes: "FATAL"
          - entryIncludes: "PANIC"
          - entryRegex: "ERROR.*database connection lost"
      description: "Preserve critical errors from production databases"

# Store the API key in a Secret instead of the ConfigMap
secretRef:
  enabled: false
  secretName: "auditty-secret"
  apiKeyName: "hivemind_api_key"

# The per-node DaemonSet
daemonSet:
  serviceAccount:
    create: true
    name: "auditty-edge"
  priorityClassName: ""
  nodeSelector: {}
  annotations: {}
  resources:
    requests:
      memory: "256Mi"
      cpu: "500m"
    limits:
      memory: "768Mi"
      cpu: "1500m"
  # Directory on the node where lines not yet archived wait while cloud storage
  # is unreachable. Survives pod deletion and node reboot; at most spool_max_mb
  # (1 GiB) of disk.
  spoolDir: /var/lib/auditty/edge
  # Needed on AppArmor-enforcing nodes (GKE, Ubuntu); harmless elsewhere.
  apparmorUnconfined: true
  # Needed on SELinux-enforcing nodes (Bottlerocket).
  seLinuxOptions:
    type: spc_t
  affinity: {}
  tolerations: []

# The cluster-level Edge API (keep replicas at 1)
edgeApi:
  enabled: true
  replicas: 1
  resources:
    requests:
      memory: "256Mi"
      cpu: "250m"
    limits:
      memory: "768Mi"
      cpu: "1000m"
  nodeSelector: {}
  tolerations: []
  affinity: {}

# The hourly Vault compactor (created only when the Vault is enabled)
compactor:
  schedule: "0 * * * *"
  resources:
    requests:
      memory: "256Mi"
      cpu: "500m"
    limits:
      memory: "2Gi"
      cpu: "1000m"

# The OTLP / HTTP network proxy, off by default (see "Edge Proxy" below)
edgeProxy:
  enabled: false

prometheusScrape:
  enabled: false               # true: add prometheus.io/scrape annotations

# Egress proxy (optional): for clusters where all outbound traffic must route
# through a forward proxy. Injected into edge, edge-api, and the compactor.
# In-cluster destinations (loopback, metadata IP, RFC1918 ranges, .svc /
# .cluster.local, kubernetes.default) are added to NO_PROXY automatically, so
# internal traffic (edge → edge-api, the K8s API) never goes through the proxy.
proxy:
  httpProxy: ""
  httpsProxy: ""
  noProxy: ""        # extra bypass entries, merged on top of the in-cluster defaults

# NetworkPolicy: REQUIRED on clusters with a default-deny policy. Without it the
# edge → edge-api hop (port 8080) is dropped, silently disabling metrics
# reporting and Vault backfill links.
networkPolicy:
  enabled: false
  # Opt-in egress hardening (default false). When true, egress is scoped to only
  # what Edge needs (DNS, the K8s API server, edge → edge-api on 8080, and HTTPS
  # to Hivemind / cloud storage) instead of allow-all. Left off by default because
  # egress topology is environment-specific; if you run a forward proxy you must
  # add the proxy's CIDR/port below before enabling, or all outbound traffic is
  # blocked (proxy traffic uses the proxy port, not 443).
  restrictEgress: false
  dnsNamespace: kube-system          # namespace where CoreDNS/kube-dns runs
  egressAPIServerCIDRs:              # K8s API server (ports 443/6443)
    - 0.0.0.0/0
  egressHTTPSCIDRs:                  # external HTTPS (Hivemind, cloud storage, proxy)
    - 0.0.0.0/0

Your App → /var/log/myapp/app.log → Auditty (tail) → /var/log/auditty/var_log_myapp_app.log → Your Log Collector

sender → edge-proxy → [fingerprint → dedup → rules → rate-limit] → survivors → your upstream (OTLP/HTTP or JSON)
                                                              └→ suppressed → Vault (optional)