add context, parsers and postoverflows for appsec deployment

charts/crowdsec/README.md.gotmpl

@@ -118,9 +118,11 @@ configuration.
 
 ## Supplying Custom AppSec Config and Rule Files
 
-The chart supports passing custom AppSec configuration and rule files as raw file content through values. This works with both local and remote charts, using the same approach as custom parsers, scenarios, and postoverflows.
+The chart supports passing custom AppSec configuration, rule, parser, scenario, context, and postoverflow files as raw file content through values. This works with both local and remote charts, using the same approach as custom parsers, scenarios, and postoverflows on the agent.
 
-AppSec configs are mounted at `/etc/crowdsec/appsec-configs/` and rules at `/etc/crowdsec/appsec-rules/` inside the AppSec pod.
+The AppSec pod is itself a full crowdsec engine instance that parses and evaluates its own out-of-band events locally before pushing alerts to the shared LAPI, so it needs its own copies of any custom parser/scenario/context/postoverflow used to process those events - the agent's `config.*` values are not shared with it.
+
+AppSec configs are mounted at `/etc/crowdsec/appsec-configs/`, rules at `/etc/crowdsec/appsec-rules/`, parsers at `/etc/crowdsec/parsers/<stage>/`, scenarios at `/etc/crowdsec/scenarios/`, contexts at `/etc/crowdsec/contexts/`, and postoverflows at `/etc/crowdsec/postoverflows/<stage>/` inside the AppSec pod.
 
 You can split your AppSec configuration across multiple values files:
 
@@ -129,7 +131,10 @@ helm upgrade --install crowdsec crowdsec/crowdsec \
   -n crowdsec \
   -f crowdsec-values.yaml \
   -f appsec-configs.yaml \
-  -f appsec-rules.yaml
+  -f appsec-rules.yaml \
+  -f appsec-parsers.yaml \
+  -f appsec-contexts.yaml \
+  -f appsec-postoverflows.yaml
 ```
 
 Example values files:
@@ -169,14 +174,51 @@ appsec:
         spoofable: 0
 ```
 
+```yaml
+# appsec-parsers.yaml
+appsec:
+  parsers:
+    s01-parse:
+      my-parser.yaml: |
+        name: my/parser
+        filter: "evt.Parsed.program == 'appsec' && evt.Parsed.source == 'my-source'"
+        onsuccess: next_stage
+```
+
+```yaml
+# appsec-contexts.yaml
+appsec:
+  contexts:
+    my-context.yaml: |
+      context:
+        my_field:
+          - evt.Meta.my_meta_key
+```
+
+```yaml
+# appsec-postoverflows.yaml
+appsec:
+  postoverflows:
+    s01-whitelist:
+      my-whitelist.yaml: |
+        name: my/whitelist
+        whitelist:
+          reason: "trusted source"
+          expression:
+            - evt.Parsed.remote_addr == '127.0.0.1'
+```
+
 If you prefer to keep each file on disk and inject it, use `--set-file`. Helm reads the local file and assigns its content to the matching value key:
 
 ```sh
 helm upgrade --install crowdsec crowdsec/crowdsec \
   -n crowdsec \
   -f crowdsec-values.yaml \
   --set-file appsec.configs.my-appsec-config\.yaml=./my-appsec-config.yaml \
-  --set-file appsec.rules.my-appsec-rule\.yaml=./my-appsec-rule.yaml
+  --set-file appsec.rules.my-appsec-rule\.yaml=./my-appsec-rule.yaml \
+  --set-file appsec.parsers.s01-parse.my-parser\.yaml=./my-parser.yaml \
+  --set-file appsec.contexts.my-context\.yaml=./my-context.yaml \
+  --set-file appsec.postoverflows.s01-whitelist.my-whitelist\.yaml=./my-whitelist.yaml
 ```
 
 This content is emitted into the generated ConfigMaps as-is. Filenames without a `.yaml` or `.yml` suffix are also accepted. If the key contains dots, escape them in `--set`/`--set-file`.

charts/crowdsec/templates/_helpers.tpl

@@ -81,6 +81,15 @@ true
 {{- end -}}
 {{- end -}}
 
+{{/*
+  appsec parsers parameters check
+*/}}
+{{ define "appsecParsersIsNotEmpty" }}
+{{- if or (index .Values.appsec.parsers "s00-raw") (index .Values.appsec.parsers "s01-parse") (index .Values.appsec.parsers "s02-enrich") }}
+true
+{{- end -}}
+{{- end -}}
+
 {{/*
   lapi custom config check
 */}}

charts/crowdsec/templates/appsec-configmap.yaml

@@ -11,6 +11,24 @@ data:
     {{. | toYaml | nindent 4}}
     {{- end }}
 
+---
+{{ if (include "appsecParsersIsNotEmpty" .) }}
+{{- range $stage, $stageConfig := .Values.appsec.parsers -}}
+{{- if $stageConfig -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "crowdsec-appsec-parsers-%s" $stage }}
+data:
+{{ range $fileName, $content := $stageConfig -}}
+  {{ printf "%s: |" $fileName | indent 2 }}
+{{ $content | indent 4 }}
+{{ end }}
+---
+{{- end }}
+{{ end }}
+{{ end -}}
+
 ---
 {{- if .Values.appsec.scenarios }}
 apiVersion: v1
@@ -24,6 +42,19 @@ data:
 {{ end }}
 {{- end }}
 
+---
+{{- if .Values.appsec.contexts }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "crowdsec-appsec-contexts"
+data:
+{{ range $fileName, $content := .Values.appsec.contexts -}}
+  {{ printf "%s: |" $fileName | indent 2 }}
+{{ $content | indent 4 }}
+{{ end }}
+{{- end }}
+
 ---
 {{ if (include "appsecPostoverflowsIsNotEmpty" .) }}
 {{- range $stage, $stageConfig := .Values.appsec.postoverflows -}}

charts/crowdsec/templates/appsec-deployment.yaml

@@ -202,13 +202,31 @@ spec:
             subPath: {{ $fileName }}
           {{- end }}
           {{- end }}
+          {{- if (include "appsecParsersIsNotEmpty" .) }}
+          {{- range $stage, $stageConfig := .Values.appsec.parsers -}}
+          {{- if $stageConfig -}}
+          {{- range $fileName, $content := $stageConfig }}
+          - name: {{ include "crowdsec.volumeName" (printf "crowdsec-appsec-parsers-%s-%s" $stage $fileName) }}
+            mountPath: {{ printf "/etc/crowdsec/parsers/%s/%s" $stage $fileName }}
+            subPath: {{ $fileName }}
+          {{- end }}
+          {{- end }}
+          {{- end }}
+          {{- end }}
           {{- if .Values.appsec.scenarios -}}
           {{- range $fileName, $content := .Values.appsec.scenarios }}
           - name: {{ include "crowdsec.volumeName" (printf "crowdsec-appsec-scenarios-%s" $fileName) }}
             mountPath: {{ printf "/etc/crowdsec/scenarios/%s" $fileName }}
             subPath: {{ $fileName }}
           {{- end }}
           {{- end }}
+          {{- if .Values.appsec.contexts -}}
+          {{- range $fileName, $content := .Values.appsec.contexts }}
+          - name: {{ include "crowdsec.volumeName" (printf "crowdsec-appsec-contexts-%s" $fileName) }}
+            mountPath: {{ printf "/etc/crowdsec/contexts/%s" $fileName }}
+            subPath: {{ $fileName }}
+          {{- end }}
+          {{- end }}
           {{- if (include "appsecPostoverflowsIsNotEmpty" .) }}
           {{- range $stage, $stageConfig := .Values.appsec.postoverflows -}}
           {{- if $stageConfig -}}
@@ -263,6 +281,20 @@ spec:
             path: {{ $fileName }}
       {{- end }}
       {{- end }}
+      {{- if (include "appsecParsersIsNotEmpty" .) }}
+      {{- range $stage, $stageConfig := .Values.appsec.parsers -}}
+      {{- if $stageConfig -}}
+      {{- range $fileName, $content := $stageConfig }}
+      - name: {{ include "crowdsec.volumeName" (printf "crowdsec-appsec-parsers-%s-%s" $stage $fileName) }}
+        configMap:
+          name: {{ printf "crowdsec-appsec-parsers-%s" $stage }}
+          items:
+          - key: {{ $fileName }}
+            path: {{ $fileName }}
+      {{- end }}
+      {{- end }}
+      {{- end }}
+      {{- end }}
       {{- if .Values.appsec.scenarios -}}
       {{- range $fileName, $content := .Values.appsec.scenarios }}
       - name: {{ include "crowdsec.volumeName" (printf "crowdsec-appsec-scenarios-%s" $fileName) }}
@@ -273,6 +305,16 @@ spec:
             path: {{ $fileName }}
       {{- end }}
       {{- end }}
+      {{- if .Values.appsec.contexts -}}
+      {{- range $fileName, $content := .Values.appsec.contexts }}
+      - name: {{ include "crowdsec.volumeName" (printf "crowdsec-appsec-contexts-%s" $fileName) }}
+        configMap:
+          name: "crowdsec-appsec-contexts"
+          items:
+          - key: {{ $fileName }}
+            path: {{ $fileName }}
+      {{- end }}
+      {{- end }}
       {{- if (include "appsecPostoverflowsIsNotEmpty" .) }}
       {{- range $stage, $stageConfig := .Values.appsec.postoverflows -}}
       {{- if $stageConfig -}}

charts/crowdsec/values.yaml

@@ -752,6 +752,20 @@ appsec:
     #  appsec_config: crowdsecurity/virtual-patching
     #  labels:
     #    type: appsec
+  # -- Custom parsers for the appsec pod. See https://docs.crowdsec.net/docs/next/parsers/intro/
+  # Those files are only mounted in the appsec pods
+  parsers:
+    ## @param appsec.parsers.s00-raw First step custom parsers definitions for the appsec pod, usually used to label logs
+    s00-raw: {}
+    ## @param appsec.parsers.s01-parse Second step custom parsers definitions for the appsec pod, usually to normalize logs into events
+    s01-parse: {}
+      # my-parser.yaml: |
+      #   filter: "evt.Line.Labels.type == 'myProgram'"
+      #   onsuccess: next_stage
+      #   ....
+      # `--set-file appsec.parsers.s01-parse.my-parser\.yaml=./my-parser.yaml` is also supported.
+    ## @param appsec.parsers.s02-enrich Third step custom parsers definitions for the appsec pod, usually to enrich events
+    s02-enrich: {}
   # -- Custom scenarios for the appsec pod. See https://docs.crowdsec.net/docs/next/scenarios/intro
   # Those files are only mounted in the appsec pods
   ## @param appsec.scenarios [object] Custom scenario files for the appsec pod (key = filename, value = file content)
@@ -761,6 +775,15 @@ appsec:
     #   name: my/scenario
     #   ...
     # `--set-file appsec.scenarios.my-scenario\.yaml=./my-scenario.yaml` is also supported.
+  # -- Custom alert contexts for the appsec pod. See https://docs.crowdsec.net/docs/next/context/intro
+  # Those files are only mounted in the appsec pods
+  ## @param appsec.contexts [object] Custom alert context files for the appsec pod (key = filename, value = file content)
+  contexts: {}
+    # my-context.yaml: |
+    #   context:
+    #     my_field:
+    #       - evt.Meta.my_meta_key
+    # `--set-file appsec.contexts.my-context\.yaml=./my-context.yaml` is also supported.
   # -- Custom postoverflows for the appsec pod. See https://docs.crowdsec.net/docs/next/log_processor/parsers/intro#postoverflows
   # Those files are only mounted in the appsec pods
   postoverflows: