twistlock values.yaml¶
domain¶
Type: string
"dev.bigbang.mil"
Description: domain to use for virtual service
monitoring.enabled¶
Type: bool
false
Description: Toggle monitoring integration, only used if init job is enabled, creates required metrics user, serviceMonitor, networkPolicy, etc
monitoring.serviceMonitor.scheme¶
Type: string
""
monitoring.serviceMonitor.tlsConfig¶
Type: object
{}
sso¶
Type: object
cert: ''
client_id: ''
console_url: ''
enabled: false
groups: ''
idp_url: ''
issuer_uri: ''
provider_name: ''
provider_type: shibboleth
Description: Configuration of Twistlock’s SAML SSO capability. This requires init.enabled=true, valid credentials, and a valid license. Refer to docs/KEYCLOAK.md for additional information.
sso.enabled¶
Type: bool
false
Description: Toggle SAML SSO
sso.client_id¶
Type: string
""
Description: SAML client ID
sso.provider_name¶
Type: string
""
Description: SAML Povider Alias (optional)
sso.provider_type¶
Type: string
"shibboleth"
Description: SAML Identity Provider. shibboleth is recommended by Twistlock support for Keycloak
sso.issuer_uri¶
Type: string
""
Description: Identity Provider url with path to realm, example: https://keycloak.bigbang.dev/auth/realms/baby-yoda
sso.idp_url¶
Type: string
""
Description: SAML Identity Provider SSO URL, example: https://keycloak.bigbang.dev/auth/realms/baby-yoda/protocol/saml
sso.console_url¶
Type: string
""
Description: Console URL of the Twistlock app. Example: https://twistlock.bigbang.dev (optional)
sso.groups¶
Type: string
""
Description: Groups attribute (optional)
sso.cert¶
Type: string
""` | X.509 Certificate from Identity Provider (i.e. Keycloak). See docs/KEYCLOAK.md for format. Use the
Description: -` syntax for multiline string
istio.enabled¶
Type: bool
false
Description: Toggle istio integration
istio.ambient¶
Type: object
enabled: false
Description: Toggle istio ambient mode (no sidecar)
istio.mtls¶
Type: object
mode: STRICT
Description: Mutual TLS configuration
istio.mtls.mode¶
Type: string
"STRICT"
Description: STRICT = Allow only mutual TLS traffic, PERMISSIVE = Allow both plain text and mutual TLS traffic
istio.sidecar¶
Type: object
enabled: false
outboundTrafficPolicyMode: REGISTRY_ONLY
Description: Sidecar configuration for restricting outbound traffic
istio.authorizationPolicies¶
Type: object
additionalPolicies:
allow-defender-to-console-port:
spec:
action: ALLOW
rules:
- to:
- operation:
ports:
- '8084'
selector:
matchLabels:
app.kubernetes.io/name: twistlock-console
custom: []
enabled: false
generateFromNetpol: false
Description: Authorization policies configuration
istio.serviceEntries¶
Type: object
custom: []
Description: Service entries for external services
istio.tempo¶
Type: object
enabled: false
namespaces:
- tempo
principals:
- cluster.local/ns/tempo/sa/tempo-tempo
Description: Tempo authorization policy (for tracing)
routes.inbound.console.enabled¶
Type: bool
true
routes.inbound.console.gateways[0]¶
Type: string
"istio-gateway/public-ingressgateway"
routes.inbound.console.hosts[0]¶
Type: string
"twistlock.{{ .Values.domain }}"
routes.inbound.console.service¶
Type: string
"twistlock-console"
routes.inbound.console.port¶
Type: int
8081
routes.inbound.console.selector.”app.kubernetes.io/name”¶
Type: string
"twistlock-console"
routes.outbound.twistlock-intelligence.enabled¶
Type: bool
true
routes.outbound.twistlock-intelligence.hosts[0]¶
Type: string
"intelligence.twistlock.com"
routes.outbound.twistlock-intelligence.ports[0].number¶
Type: int
443
routes.outbound.twistlock-intelligence.ports[0].name¶
Type: string
"https"
routes.outbound.twistlock-intelligence.ports[0].protocol¶
Type: string
"TLS"
routes.outbound.twistlock-intelligence.location¶
Type: string
"MESH_EXTERNAL"
routes.outbound.twistlock-intelligence.resolution¶
Type: string
"DNS"
networkPolicies.enabled¶
Type: bool
true
Description: Toggle network policies
networkPolicies.controlPlaneCidr¶
Type: string
"0.0.0.0/0"
Description: Control Plane CIDR to allow init job communication to the Kubernetes API. Use kubectl get endpoints kubernetes to get the CIDR range needed for your cluster
networkPolicies.nodeCidr¶
Type: string
nil
Description: Node CIDR to allow defender to communicate with console. Defaults to allowing “10.0.0.0/8” “172.16.0.0/12” “192.168.0.0/16” “100.64.0.0/10” networks. use kubectl get nodes -owide and review the INTERNAL-IP column to derive CIDR range. Must be an IP CIDR range (x.x.x.x/x - ideally a /16 or /24 to include multiple IPs)
networkPolicies.ingress.defaults.enabled¶
Type: bool
true
networkPolicies.ingress.definitions.nodeCidrs.from[0].ipBlock.cidr¶
Type: string
"10.0.0.0/8"
networkPolicies.ingress.definitions.nodeCidrs.from[1].ipBlock.cidr¶
Type: string
"172.16.0.0/12"
networkPolicies.ingress.definitions.nodeCidrs.from[2].ipBlock.cidr¶
Type: string
"192.168.0.0/16"
networkPolicies.ingress.definitions.nodeCidrs.from[3].ipBlock.cidr¶
Type: string
"100.64.0.0/10"
networkPolicies.ingress.definitions.nodeCidrs.ports[0].port¶
Type: int
8084
networkPolicies.ingress.definitions.nodeCidrs.ports[0].protocol¶
Type: string
"TCP"
networkPolicies.ingress.to.twistlock-console:8081.from.k8s.monitoring-monitoring-kube-prometheus@monitoring/prometheus¶
Type: bool
false
networkPolicies.ingress.to.twistlock-console:8081.from.definition.gateway¶
Type: bool
true
networkPolicies.ingress.to.twistlock-console:8084.from.k8s.twistlock/twistlock-defender¶
Type: bool
true
networkPolicies.ingress.to.twistlock-console:8084.from.definition.nodeCidrs¶
Type: bool
true
networkPolicies.egress.defaults.enabled¶
Type: bool
true
networkPolicies.egress.from.*.to.k8s.tempo-tempo@tempo/tempo:9411¶
Type: bool
false
networkPolicies.egress.from.twistlock-init.to.definition.kubeAPI¶
Type: bool
true
networkPolicies.egress.from.twistlock-console.to.cidr.”0.0.0.0/0:443”¶
Type: bool
true
networkPolicies.egress.from.egress-kube-api.podSelector.matchLabels.”app.kubernetes.io/name”¶
Type: string
"twistlock-volume-upgrade-job"
networkPolicies.egress.from.egress-kube-api.metadata.annotations.”helm.sh/hook”¶
Type: string
"pre-upgrade"
networkPolicies.egress.from.egress-kube-api.metadata.annotations.”helm.sh/hook-weight”¶
Type: string
"-30"
networkPolicies.egress.from.egress-kube-api.metadata.annotations.”helm.sh/hook-delete-policy”¶
Type: string
"before-hook-creation,hook-succeeded,hook-failed"
networkPolicies.egress.from.egress-kube-api.to.definition.kubeAPI¶
Type: bool
true
networkPolicies.additionalPolicies¶
Type: list
[]
imagePullSecretName¶
Type: string
"private-registry"
Description: Defines the secret to use when pulling the container images
selinuxLabel¶
Type: string
"disable"
Description: Run Twistlock Console and Defender with a dedicated SELinux label. See https://docs.docker.com/engine/reference/run/#security-configuration
systemd¶
Type: object
enabled: false
Description: systemd configuration
systemd.enabled¶
Type: bool
false
Description: option to install Twistlock as systemd service. true or false
console.dataRecovery¶
Type: bool
true
Description: Enables or Disables data recovery. Values: true or false.
console.image.repository¶
Type: string
"registry1.dso.mil/ironbank/twistlock/console/console"
Description: Full image name for console
console.image.tag¶
Type: string
"34.05.157"
Description: Full image tag for console
console.image.imagePullPolicy¶
Type: string
"IfNotPresent"
Description: Pull policy for console image
console.ports.managementHttp¶
Type: int
8081
Description: Enables the management HTTP listener.
console.ports.managementHttps¶
Type: int
8083
Description: Enables the management HTTPS listener.
console.ports.communication¶
Type: int
8084
Description: Sets the port for communication between the Defender(s) and the Console
console.securityContext¶
Type: object
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 2674
runAsNonRoot: true
runAsUser: 2674
Description: Sets the container security context for the console
console.persistence.size¶
Type: string
"100Gi"
Description: Size of Twistlock PVC
console.persistence.accessMode¶
Type: string
"ReadWriteOnce"
Description: Access mode for Twistlock PVC
console.extraEnv¶
Type: list
[]
Description: Additional environment variables for the console container. Use this to set Prisma-specific env vars (e.g., CORE_MIN_LOG_LEVEL) without a post-renderer. Example: extraEnv: - name: CORE_MIN_LOG_LEVEL value: “WARNING”
console.syslogAuditIntegration¶
Type: object
enabled: false
Description: Enable syslog audit feature When integrating with BigBang, make sure to include an exception to Gatekeeper and/or Kyverno for Volume Types.
console.disableCgroupLimits¶
Type: bool
false
Description: Controls console container’s resource constraints. Set to “true” to run without limits. See https://docs.docker.com/engine/reference/run/#runtime-constraints-on-resources
console.license¶
Type: string
""
Description: The license key to use. If not specified, the license must be installed manually.
console.runAsRoot¶
Type: bool
false
Description: Run Twistlock Console processes as root (default false, twistlock user account). Values: true or false
console.credentials¶
Type: object
password: change_this_password
username: admin
Description: Required if init is enabled. Admin account to use for configuration through API. Will create account if Twistlock is a new install. Otherwise, an existing account needs to be provided.
console.credentials.username¶
Type: string
"admin"
Description: Username of account
console.credentials.password¶
Type: string
"change_this_password"
Description: Password of account
console.additionalUsers¶
Type: list
[]
Description: Additional users to setup. This requires init.enabled=true, valid credentials, and a valid license.
console.updateUsers¶
Type: bool
false
Description: Toggles whether to update the additionalUsers if the user is already created (e.g. on upgrades). This would overwrite the existing user configuration.
console.groups¶
Type: list
[]
Description: Additional users to setup. This requires init.enabled=true, valid credentials, and a valid license.
console.options.enabled¶
Type: bool
true
Description: Toggle setting all options in this section
console.options.network¶
Type: object
container: false
host: true
Description: Network monitoring options
console.options.network.container¶
Type: bool
false
Description: Toggle network monitoring of containers. Deprecated upstream (CNNS network-firewall enforcement, see https://docs.prismacloud.io/ce-release-notes/prisma-tm-cloud-compute-edition-release-information/release-notes-34-01#deprecation-notices); defaults to false as it is incompatible with Istio ambient (HBONE/ztunnel).
console.options.network.host¶
Type: bool
true
Description: Toggle network monitoring of hosts
console.options.logging¶
Type: bool
true
Description: Toggle logging Prisma Cloud events to standard output
console.options.telemetry¶
Type: bool
false
Description: Toggle sending product usage data to Palo Alto Networks
console.options.intelligence¶
Type: object
uploadDisabled: true
Description: Toggle intelligence settings
console.options.intelligence.uploadDisabled¶
Type: bool
true
Description: Disables allowing admins/operators to upload logs to Customer Support directly from the Console UI
console.options.scan¶
Type: object
scanRunningImages: false
Description: Toggle scan settings
console.options.scan.scanRunningImages¶
Type: bool
false
Description: Only scan images with running containers
console.options.logon¶
Type: object
basicAuthDisabled: false
requireStrongPassword: true
useSupportCredentials: false
Description: Toggle logon settings
console.options.logon.useSupportCredentials¶
Type: bool
false
Description: Enable SSO to Prisma Cloud Support
console.options.logon.requireStrongPassword¶
Type: bool
true
Description: Require strong passwords for local accounts
console.options.logon.basicAuthDisabled¶
Type: bool
false
Description: Disables basic authentication. Note: Setting to true will prevent metrics scraping
console.volumeUpgrade¶
Type: bool
true
Description: This value should be enabled when upgrading from a version <=0.10.0-bb.1 in order to allow the console to run as non-root
console.trustedImages¶
Type: object
enabled: true
extraGroups: []
groups:
- name: BigBang-Trusted
registryMatches:
- registry1.dso.mil/ironbank/*
rule:
collections:
- All
deniedGroups: []
effect: alert
name: BigBang-Trusted
Description: Trusted images allowlist policy. Despite the name, this is an evaluation policy, not a flat list. The chart manages one rule that allows the declared groups; deniedGroups takes precedence over allowedGroups.
console.trustedImages.enabled¶
Type: bool
true
Description: Toggle chart management of the trust policy. When false, existing console state is left alone.
console.trustedImages.groups¶
Type: list
- name: BigBang-Trusted
registryMatches:
- registry1.dso.mil/ironbank/*
Description: Trust groups (allowlist bundles) managed by the chart. Each group’s name is auto-included in rule.allowedGroups.
console.trustedImages.extraGroups¶
Type: list
[]
Description: Trust groups appended to groups at template time. For overlays (kustomize SMP, subchart values) that need to add without replacing the base list.
console.trustedImages.rule¶
Type: object
collections:
- All
deniedGroups: []
effect: alert
name: BigBang-Trusted
Description: The single chart-managed rule, prepended to the policy so it evaluates first.
console.serviceAccount.automountServiceAccountToken¶
Type: bool
false
Description: Auto-mount the API token on the console ServiceAccount. Default false: the console SA exists only for OpenShift SCC and needs no token. Kyverno disallow-auto-mount-service-account-token compliance.
deploymentMode¶
Type: object
defenderOnly: false
Description: Deployment mode configuration
deploymentMode.defenderOnly¶
Type: bool
false
Description: defender_client_cert_old, defender_client_key_old, admission_cert, admission_key)
defender¶
Type: object
certCn: ''
clusterName: ''
collectLabels: true
collect_pod_labels: true
containerRuntime: containerd
dockerListenerType: ''
dockerSocket: ''
enabled: true
image:
repository: registry1.dso.mil/ironbank/twistlock/defender/defender
tag: 34.05.157
monitorIstio: true
monitorServiceAccounts: true
podLabels: {}
priorityClassName: ''
privileged: false
proxy: {}
readOnlyRootFilesystem: true
resources:
limits:
cpu: '1'
memory: 1Gi
requests:
cpu: 256m
memory: 512Mi
secrets:
admission_cert: ''
admission_key: ''
defender_ca: ''
defender_ca_old: ''
defender_client_cert: ''
defender_client_cert_old: ''
defender_client_key: ''
defender_client_key_old: ''
service_parameter: ''
securityCapabilitiesAdd:
- NET_ADMIN
- NET_RAW
- SYS_ADMIN
- SYS_PTRACE
- SYS_CHROOT
- MKNOD
- SETFCAP
- IPC_LOCK
securityCapabilitiesDrop:
- ALL
selinux: true
serviceAccount:
automountServiceAccountToken: false
servicePort: 443
serviceTargetPort: 9998
tolerations:
- operator: Exists
uniqueHostName: false
waitForRollout: true
ws_address: ''
Description: Configuration of Twistlock’s container defenders. This requires init.enabled=true, valid credentials, and a valid license.
defender.image¶
Type: object
repository: registry1.dso.mil/ironbank/twistlock/defender/defender
tag: 34.05.157
Description: Image for Twistlock defender. Leave blank to use twistlock official repo.
defender.image.repository¶
Type: string
"registry1.dso.mil/ironbank/twistlock/defender/defender"
Description: Repository and path for defender image
defender.image.tag¶
Type: string
"34.05.157"
Description: Image tag for defender
defender.waitForRollout¶
Type: bool
true
Description: Wait for defender DaemonSet rollout to complete during init
defender.clusterName¶
Type: string
""
Description: Name of cluster
defender.collectLabels¶
Type: bool
true
Description: Collect Deployment and Namespace labels
defender.containerRuntime¶
Type: string
"containerd"
Description: Set containerRuntime option for Defenders (“docker”, “containerd”, or “crio”)
defender.dockerSocket¶
Type: string
""
Description: Path to Docker socket. Leave blank to use /var/run/docker.sock
defender.tolerations¶
Type: list
- operator: Exists
Description: List of tolerations to be added to the Defender DaemonSet.
defender.podLabels¶
Type: object
{}
Description: Additional labels for Defender pods. When istio ambient mode is enabled, istio.io/dataplane-mode: none is added automatically to exclude the hostNetwork Defender from ambient capture (override here if needed)
defender.securityCapabilitiesDrop¶
Type: list
- ALL
Description: Sets the container security context dropped capabilities for the defenders
defender.securityCapabilitiesAdd¶
Type: list
- NET_ADMIN
- NET_RAW
- SYS_ADMIN
- SYS_PTRACE
- SYS_CHROOT
- MKNOD
- SETFCAP
- IPC_LOCK
Description: Sets the container security context added capabilities for the defenders
defender.dockerListenerType¶
Type: string
""
Description: Sets the type of the Docker listener (TCP or NONE)
defender.monitorServiceAccounts¶
Type: bool
true
Description: Monitor service accounts
defender.monitorIstio¶
Type: bool
true
Description: Monitor Istio
defender.readOnlyRootFilesystem¶
Type: bool
true
Description: Security Context: readOnlyRootFileSystem
defender.privileged¶
Type: bool
false
Description: Run as privileged. If selinux is true, this automatically gets set to false
defender.proxy¶
Type: object
{}
Description: Proxy settings
defender.selinux¶
Type: bool
true
Description: Deploy with SELinux Policy
defender.uniqueHostName¶
Type: bool
false
Description: Assign globally unique names to hosts
defender.resources¶
Type: object
limits:
cpu: '1'
memory: 1Gi
requests:
cpu: 256m
memory: 512Mi
Description: Define resource limits and requests for the Defender DaemonSet
defender.priorityClassName¶
Type: string
""
Description: Priority Class Name to prioritize pod scheduling
defender.ws_address¶
Type: string
""
Description: Websocket address of the console the defender intends to connect to, generally in the format wss://URL:8084
defender.secrets¶
Type: object
admission_cert: ''
admission_key: ''
defender_ca: ''
defender_ca_old: ''
defender_client_cert: ''
defender_client_cert_old: ''
defender_client_key: ''
defender_client_key_old: ''
service_parameter: ''
Description: These can be obtained from the Twistlock UI or contrib/defenders.sh script.
defender.serviceAccount.automountServiceAccountToken¶
Type: bool
false
Description: Auto-mount the API token on the defender ServiceAccount (both defenderOnly Helm and init-script API paths). Default false: the defender still gets its token via an explicit projected volume (it queries the k8s API for MONITOR_SERVICE_ACCOUNTS / MONITOR_ISTIO / COLLECT_POD_LABELS).
policies¶
Type: object
compliance:
alertThreshold: medium
enabled: true
templates:
- DISA STIG
- NIST SP 800-190
enabled: true
name: Default
runtime:
enabled: true
vulnerabilities:
alertThreshold: medium
enabled: true
Description: Configures defender policies. This requires init.enabled=true, valid credentials, and a valid license.
policies.enabled¶
Type: bool
true
Description: Toggles configuration of defender policies
policies.name¶
Type: string
"Default"
Description: Name to use as prefix to policy rules. NOTE: If you change the name after the initial deployment, you may end up with duplicate policy sets and need to manually cleanup old policies.
policies.vulnerabilities¶
Type: object
alertThreshold: medium
enabled: true
Description: Vulnerability policies
policies.vulnerabilities.enabled¶
Type: bool
true
Description: Toggle deployment and updating of vulnerability policies
policies.vulnerabilities.alertThreshold¶
Type: string
"medium"
Description: The minimum severity to alert on
policies.compliance¶
Type: object
alertThreshold: medium
enabled: true
templates:
- DISA STIG
- NIST SP 800-190
Description: Compliance policies
policies.compliance.enabled¶
Type: bool
true
Description: Toggle deployment and updating of compliance policies
policies.compliance.templates¶
Type: list
- DISA STIG
- NIST SP 800-190
Description: The policy templates to use. Valid values are ‘GDPR’, ‘DISA STIG’, ‘PCI’, ‘NIST SP 800-190’, or ‘HIPAA’
policies.compliance.alertThreshold¶
Type: string
"medium"
Description: If template does not apply, set policy to alert using this severity or higher. Valid values are ‘low’, ‘medium’, ‘high’, or ‘critical’.
policies.runtime¶
Type: object
enabled: true
Description: Runtime policies
policies.runtime.enabled¶
Type: bool
true
Description: Toggle deployment and updating of runtime policies
init¶
Type: object
enabled: true
image:
imagePullPolicy: IfNotPresent
repository: registry1.dso.mil/ironbank/big-bang/base
tag: 2.1.0
resources:
limits:
cpu: 0.5
memory: 256Mi
requests:
cpu: 0.5
memory: 256Mi
serviceAccount:
automountServiceAccountToken: false
Description: Initialization job. Sets up users, license, container defenders, default policies, and other settings.
init.enabled¶
Type: bool
true
Description: Toggles the initialization on or off
init.image¶
Type: object
imagePullPolicy: IfNotPresent
repository: registry1.dso.mil/ironbank/big-bang/base
tag: 2.1.0
Description: Initialization job image configuration
init.image.repository¶
Type: string
"registry1.dso.mil/ironbank/big-bang/base"
Description: Repository and path to initialization image. Image must contain jq and kubectl
init.image.tag¶
Type: string
"2.1.0"
Description: Initialization image tag
init.image.imagePullPolicy¶
Type: string
"IfNotPresent"
Description: Initialization image pull policy
init.serviceAccount.automountServiceAccountToken¶
Type: bool
false
Description: Auto-mount the API token on the init ServiceAccount. Default false: the init Job still gets its token via an explicit projected volume (it kubectl-applies the defender DaemonSet). Set true to fall back to k8s default automount.
affinity¶
Type: object
{}
Description: affinity for console pod
nodeSelector¶
Type: object
{}
Description: nodeSelector for console pod
tolerations¶
Type: list
[]
Description: tolerations for console pod
podLabels¶
Type: object
{}
Description: labels for console pod
annotations¶
Type: object
{}
Description: annotations for console pod
resources¶
Type: object
limits:
cpu: 250m
memory: 3Gi
requests:
cpu: 250m
memory: 3Gi
Description: resources for console pod
openshift¶
Type: bool
false
Description: Toggle to setup special configuration for OpenShift clusters
bbtests.enabled¶
Type: bool
false
Description: Toggle bbtests on/off for CI/Dev
bbtests.scripts.image¶
Type: string
"registry1.dso.mil/ironbank/big-bang/base:2.1.0"
Description: Image to use for script tests
bbtests.scripts.envs¶
Type: object
cypress_password: '{{ .Values.console.credentials.password }}'
cypress_user: '{{ .Values.console.credentials.username }}'
desired_version: '{{ .Values.console.image.tag }}'
twistlock_host: http://twistlock-console.twistlock.svc.cluster.local:8081
Description: Set envs for use in script tests
bbtests.cypress.resources.requests.cpu¶
Type: string
"2"
bbtests.cypress.resources.requests.memory¶
Type: string
"2Gi"
bbtests.cypress.resources.limits.cpu¶
Type: string
"2"
bbtests.cypress.resources.limits.memory¶
Type: string
"2Gi"
bbtests.cypress.artifacts¶
Type: bool
true
bbtests.cypress.envs.cypress_twistlock_url¶
Type: string
"http://twistlock-console.twistlock.svc.cluster.local:8081"
bbtests.cypress.envs.cypress_user¶
Type: string
"{{ .Values.console.credentials.username }}"
bbtests.cypress.envs.cypress_password¶
Type: string
"{{ .Values.console.credentials.password }}"
bbtests.cypress.envs.CYPRESS_experimental_Modify_Obstructive_Third_Party_Code¶
Type: string
"true"
waitJob.enabled¶
Type: bool
true
waitJob.permissions.apiGroups[0]¶
Type: string
""
waitJob.permissions.resources[0]¶
Type: string
"pods"
waitJob.permissions.resources[1]¶
Type: string
"namespaces"
waitJob.permissions.verbs[0]¶
Type: string
"get"
waitJob.permissions.verbs[1]¶
Type: string
"list"
waitJob.permissions.verbs[2]¶
Type: string
"watch"