Defender-Only Mode¶

This document explains how to deploy the Twistlock Helm chart in defender-only mode, which deploys only the Defender DaemonSet without the Console.

Required Configuration¶

To run the chart in defender-only mode, you must configure the following values:

1. Enable Defender-Only Mode¶

deploymentMode:
  defenderOnly: true

2. Configure WebSocket Address¶

Define the WebSocket address of the remote Console the defender will connect to:

defender:
  ws_address: "wss://twistlock.example.mil:8084"

3. Configure Cluster Name¶

Define the cluster identifier:

defender:
  clusterName: "example-staging"

4. Configure Secrets¶

The defender requires certificates and keys to authenticate with the Console. These values must be obtained from the Twistlock Console UI or API before deployment:

Obtaining Secret Values¶

The secret values can be obtained from:

Twistlock Console UI: Navigate to Manage > Defenders > Deploy > DaemonSet and download the YAML configuration
Twistlock Console API: Query the endpoint https://CONSOLE_URL:8083/api/v1/defenders/daemonset.yaml

SOPS Configuration (Recommended)¶

In version controlled environments, use SOPS to encrypt and manage these secrets securely.

The file should look something like this before being encrypted. Commit the encrypted file afterwards.

Double check and match the structure according to the chart being patched into.

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: twistlock-defender-secrets
  namespace: bigbang
stringData:
  values.yaml: |
    twistlock:
      values:
        defender:
          secrets:
            service_parameter: eyJhZG1pc3Npb25D...
            defender_ca: LS0tLS1ABC123...
            defender_client_cert: LS0tLS1ABC123...
            defender_client_key: LS0tLS1ABC123...
            defender_ca_old: LS0tLS1ABC123...
            defender_client_cert_old: LS0tLS1ABC123...
            defender_client_key_old: LS0tLS1ABC123...
            admission_cert: LS0tLS1ABC123...
            admission_key: LS0tLS1ABC123...

Manual Configuration/Direct Values (For Testing/Development Only)¶

defender:
  secrets:
    service_parameter: "BASE64_ENCODED_VALUE"
    defender_ca: "BASE64_ENCODED_VALUE"
    defender_client_cert: "BASE64_ENCODED_VALUE"
    defender_client_key: "BASE64_ENCODED_VALUE"
    defender_ca_old: "BASE64_ENCODED_VALUE"
    defender_client_cert_old: "BASE64_ENCODED_VALUE"
    defender_client_key_old: "BASE64_ENCODED_VALUE"
    admission_cert: "BASE64_ENCODED_VALUE"
    admission_key: "BASE64_ENCODED_VALUE"

Example Deployment¶

bb-values.yaml

twistlock:
  git:
    repo: https://repo1.dso.mil/big-bang/product/packages/twistlock
    path: "./chart"
    tag: 0.29.0-bb.0
  enabled: true
  values:
    deploymentMode:
      defenderOnly: true
    defender:
      ws_address: "wss://twistlock.example.com:8084"
      clusterName: "staging-0123"
  # secrets: patched separately

pcc-defender-enc.yaml

apiVersion: v1
kind: Secret
type: Opaque
metadata:
    name: twistlock-defender-secrets
    namespace: bigbang
stringData:
    values.yaml: ENC[AES256_GCM,data:ABC123==,type:str]
sops:
    kms:
        - arn: arn:...
          created_at: "2026..."
          enc: AQI...
          aws_profile: ""
    lastmodified: "2026..."
    mac: ENC[AES256_GCM,data:ABC123==,type:str]
    encrypted_regex: ^(key|sso|values|password|data|stringData|binaryData|registryCredentials|private|credentials)$
    version: 3.10.2