values.yaml

# kub0 Hunt — Helm values
# https://kub0.ai/docs/hunt

# Your kub0 API token. Required.
# Get one at https://kub0.ai/signup or:
#   curl -sX POST https://kub0.ai/api/signup -H "Content-Type: application/json" \
#     -d '{"email":"you@example.com"}'
token: ""

# Namespace to deploy into.
namespace:
  # Create the namespace if it doesn't exist.
  create: true
  name: security

# vigiles-probe eBPF sensor.
# Runs as a DaemonSet on every amd64 node. Streams kernel events to the kub0 API.
# Requires: Linux kernel ≥5.10, Tetragon installed (for TracingPolicy CRDs).
# Architecture: amd64 only — the eBPF binary is x86_64-unknown-linux-musl.
vigiles:
  enabled: true
  image:
    repository: ghcr.io/kub0-ai/vigiles-probe
    tag: latest
    pullPolicy: Always
  # API endpoint for event submission. Defaults to the kub0 public API.
  # Override for on-prem deployments: http://detonate-api.security.svc.cluster.local:8080
  apiUrl: "https://api.kub0.io"
  logLevel: "info"
  resources:
    requests:
      cpu: 10m
      memory: 32Mi
    limits:
      cpu: 100m
      memory: 64Mi
  # amd64 only — arm64 nodes (RPi, Apple Silicon) do not have an eBPF binary.
  nodeSelector:
    kubernetes.io/arch: amd64
  # Tolerate all taints so vigiles-probe runs on control-plane and GPU nodes too.
  tolerations:
    - operator: Exists
  # Custom DNS config. Overrides ndots behavior that causes FQDN resolution to fail
  # on some cluster DNS setups (e.g., ASUS router wildcard entries).
  dnsConfig:
    nameservers:
      - "10.43.0.10"   # CoreDNS ClusterIP — override if your cluster IP differs
    searches:
      - "security.svc.cluster.local"
      - "svc.cluster.local"
      - "cluster.local"
    options:
      - name: ndots
        value: "5"

# Hunt TracingPolicies.
# Deploys all kub0 TracingPolicies to the cluster (cluster-scoped, no namespace).
# Requires Tetragon ≥1.0 to be installed. See https://tetragon.io/docs/installation/
hunt:
  enabled: true