DaemonEye Kubernetes#
Deployment Guide
This guide provides comprehensive instructions for deploying
DaemonEye on Kubernetes, including manifests, Helm charts, and
production deployment strategies.
Table of Contents#
[TOC]
Kubernetes Overview#
DaemonEye is designed to run efficiently on Kubernetes,
providing:
- Scalability: Horizontal pod autoscaling and
cluster-wide deployment - High Availability: Multi-replica deployments with
health checks - Security: RBAC, network policies, and pod security
standards - Observability: Prometheus metrics, structured
logging, and distributed tracing - Management: Helm charts and GitOps integration
Architecture Components#
- procmond: DaemonSet for process monitoring on each
node - daemoneye-agent: Deployment for alerting and
orchestration - daemoneye-cli: Job/CronJob for management
tasks
Prerequisites#
Cluster Requirements#
Minimum Requirements:
- Kubernetes 1.20+
- 2+ worker nodes
- 4+ CPU cores total
- 8+ GB RAM total
- 50+ GB storage
Recommended Requirements: - Kubernetes 1.24+
- 3+ worker nodes
- 8+ CPU cores total
- 16+ GB RAM total
- 100+ GB storage
Required Tools#
# Install kubectlcurl-LO"https://dl.k8s.io/release/$(curl-L-s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl# Install Helmcurl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 |bash# Install kustomizecurl-s"https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"|bash
Basic Deployment#
Namespace and RBAC#
namespace.yaml:
apiVersion: v1kind: Namespacemetadata:name: daemoneyelabels:name: daemoneyeapp.kubernetes.io/name: daemoneyeapp.kubernetes.io/version:1.0.0
rbac.yaml:
apiVersion: v1kind: ServiceAccountmetadata:name: daemoneye-procmondnamespace: daemoneye---apiVersion: v1kind: ServiceAccountmetadata:name: daemoneye-agentnamespace: daemoneye---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:name: daemoneye-procmondrules:-apiGroups:[""]resources:["nodes","pods"]verbs:["get","list","watch"]-apiGroups:[""]resources:["pods/exec"]verbs:["create"]---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:name: daemoneye-procmondroleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: daemoneye-procmondsubjects:-kind: ServiceAccountname: daemoneye-procmondnamespace: daemoneye
ConfigMap and Secrets#
configmap.yaml:
apiVersion: v1kind: ConfigMapmetadata:name: daemoneye-confignamespace: daemoneyedata: procmond.yaml: | app: scan_interval_ms: 30000 batch_size: 1000 log_level: info data_dir: /data log_dir: /logs database: path: /data/processes.db retention_days: 30 security: enable_privilege_dropping: true drop_to_user: 1000 drop_to_group: 1000 daemoneye-agent.yaml: | app: scan_interval_ms: 30000 batch_size: 1000 log_level: info data_dir: /data log_dir: /logs database: path: /data/processes.db retention_days: 30 alerting: enabled: true sinks: - type: syslog enabled: true facility: daemon - type: webhook enabled: true url: http://daemoneye-webhook:8080/webhook
secret.yaml:
apiVersion: v1kind: Secretmetadata:name: daemoneye-secretsnamespace: daemoneyetype: Opaquedata:webhook-token: <base64-encoded-token>database-encryption-key: <base64-encoded-key>
Persistent Storage#
pvc.yaml:
apiVersion: v1kind: PersistentVolumeClaimmetadata:name: daemoneye-datanamespace: daemoneyespec:accessModes:- ReadWriteOnceresources:requests:storage: 10GistorageClassName: fast-ssd
DaemonSet for procmond#
procmond-daemonset.yaml:
apiVersion: apps/v1kind: DaemonSetmetadata:name: daemoneye-procmondnamespace: daemoneyespec:selector:matchLabels:app: daemoneye-procmondtemplate:metadata:labels:app: daemoneye-procmondspec:serviceAccountName: daemoneye-procmondcontainers:-name: procmondimage: daemoneye/procmond:1.0.0imagePullPolicy: IfNotPresentsecurityContext:privileged:truerunAsUser:1000runAsGroup:1000volumeMounts:-name: configmountPath: /configreadOnly:true-name: datamountPath: /data-name: logsmountPath: /logsenv:-name: DaemonEye_LOG_LEVELvalue: info-name: DaemonEye_DATA_DIRvalue: /data-name: DaemonEye_LOG_DIRvalue: /logscommand:[procmond]args:[--config, /config/procmond.yaml]resources:requests:memory: 256Micpu: 100mlimits:memory: 512Micpu: 500mlivenessProbe:exec:command:- procmond- healthinitialDelaySeconds:30periodSeconds:30timeoutSeconds:10failureThreshold:3readinessProbe:exec:command:- procmond- healthinitialDelaySeconds:10periodSeconds:10timeoutSeconds:5failureThreshold:3volumes:-name: configconfigMap:name: daemoneye-config-name: datapersistentVolumeClaim:claimName: daemoneye-data-name: logsemptyDir:{}tolerations:-key: node-role.kubernetes.io/masteroperator: Existseffect: NoSchedule-key: node-role.kubernetes.io/control-planeoperator: Existseffect: NoSchedule
Deployment for#
daemoneye-agent
daemoneye-agent-deployment.yaml:
apiVersion: apps/v1kind: Deploymentmetadata:name: daemoneye-agentnamespace: daemoneyespec:replicas:1selector:matchLabels:app: daemoneye-agenttemplate:metadata:labels:app: daemoneye-agentspec:serviceAccountName: daemoneye-agentcontainers:-name: daemoneye-agentimage: daemoneye/daemoneye-agent:1.0.0imagePullPolicy: IfNotPresentsecurityContext:runAsUser:1000runAsGroup:1000volumeMounts:-name: configmountPath: /configreadOnly:true-name: datamountPath: /data-name: logsmountPath: /logsenv:-name: DaemonEye_LOG_LEVELvalue: info-name: DaemonEye_DATA_DIRvalue: /data-name: DaemonEye_LOG_DIRvalue: /logs-name: DaemonEye_PROCMOND_ENDPOINTvalue: tcp://daemoneye-procmond:8080command:[daemoneye-agent]args:[--config, /config/daemoneye-agent.yaml]resources:requests:memory: 512Micpu: 200mlimits:memory: 1Gicpu: 1000mlivenessProbe:exec:command:- daemoneye-agent- healthinitialDelaySeconds:30periodSeconds:30timeoutSeconds:10failureThreshold:3readinessProbe:exec:command:- daemoneye-agent- healthinitialDelaySeconds:10periodSeconds:10timeoutSeconds:5failureThreshold:3volumes:-name: configconfigMap:name: daemoneye-config-name: datapersistentVolumeClaim:claimName: daemoneye-data-name: logsemptyDir:{}
Service#
service.yaml:
apiVersion: v1kind: Servicemetadata:name: daemoneye-agentnamespace: daemoneyespec:selector:app: daemoneye-agentports:-name: httpport:8080targetPort:8080protocol: TCPtype: ClusterIP
Deploy Basic Setup#
# Create namespacekubectl apply -f namespace.yaml# Apply RBACkubectl apply -f rbac.yaml# Apply configurationkubectl apply -f configmap.yamlkubectl apply -f secret.yaml# Apply storagekubectl apply -f pvc.yaml# Deploy componentskubectl apply -f procmond-daemonset.yamlkubectl apply -f daemoneye-agent-deployment.yamlkubectl apply -f service.yaml# Check deployment statuskubectl get pods -n daemoneyekubectl get services -n daemoneye
Production Deployment#
Production Configuration#
production-configmap.yaml:
apiVersion: v1kind: ConfigMapmetadata:name: daemoneye-confignamespace: daemoneyedata: procmond.yaml: | app: scan_interval_ms: 60000 batch_size: 1000 log_level: info data_dir: /data log_dir: /logs max_memory_mb: 512 max_cpu_percent: 5.0 database: path: /data/processes.db retention_days: 30 max_connections: 20 cache_size: -128000 wal_mode: true security: enable_privilege_dropping: true drop_to_user: 1000 drop_to_group: 1000 enable_audit_logging: true audit_log_path: /logs/audit.log daemoneye-agent.yaml: | app: scan_interval_ms: 60000 batch_size: 1000 log_level: info data_dir: /data log_dir: /logs max_memory_mb: 1024 max_cpu_percent: 10.0 database: path: /data/processes.db retention_days: 30 max_connections: 20 cache_size: -128000 wal_mode: true alerting: enabled: true max_queue_size: 10000 delivery_timeout_ms: 5000 retry_attempts: 3 sinks: - type: syslog enabled: true facility: daemon priority: info - type: webhook enabled: true url: http://daemoneye-webhook:8080/webhook timeout_ms: 5000 retry_attempts: 3 - type: file enabled: true path: /logs/alerts.log format: json rotation: daily max_files: 30 detection: enable_detection: true rule_directory: /rules enable_hot_reload: true max_concurrent_rules: 10 rule_timeout_ms: 30000 enable_rule_caching: true cache_ttl_seconds: 300 observability: enable_metrics: true metrics_port: 9090 metrics_path: /metrics enable_health_checks: true health_check_port: 8080 health_check_path: /health logging: enable_structured_logging: true log_format: json enable_log_rotation: true max_log_file_size_mb: 100 max_log_files: 10
Production DaemonSet#
production-procmond-daemonset.yaml:
apiVersion: apps/v1kind: DaemonSetmetadata:name: daemoneye-procmondnamespace: daemoneyespec:selector:matchLabels:app: daemoneye-procmondtemplate:metadata:labels:app: daemoneye-procmondannotations:prometheus.io/scrape:'true'prometheus.io/port:'9090'prometheus.io/path: /metricsspec:serviceAccountName: daemoneye-procmondsecurityContext:runAsUser:1000runAsGroup:1000fsGroup:1000containers:-name: procmondimage: daemoneye/procmond:1.0.0imagePullPolicy: IfNotPresentsecurityContext:privileged:trueallowPrivilegeEscalation:falsereadOnlyRootFilesystem:truerunAsUser:1000runAsGroup:1000capabilities:add:- CAP_SYS_PTRACE- CAP_SYS_ADMINdrop:- ALLvolumeMounts:-name: configmountPath: /configreadOnly:true-name: datamountPath: /data-name: logsmountPath: /logs-name: rulesmountPath: /rulesreadOnly:true-name: tmpmountPath: /tmpenv:-name: DaemonEye_LOG_LEVELvalue: info-name: DaemonEye_DATA_DIRvalue: /data-name: DaemonEye_LOG_DIRvalue: /logs-name: DaemonEye_RULE_DIRvalue: /rulescommand:[procmond]args:[--config, /config/procmond.yaml]resources:requests:memory: 256Micpu: 100mlimits:memory: 512Micpu: 500mlivenessProbe:exec:command:- procmond- healthinitialDelaySeconds:30periodSeconds:30timeoutSeconds:10failureThreshold:3readinessProbe:exec:command:- procmond- healthinitialDelaySeconds:10periodSeconds:10timeoutSeconds:5failureThreshold:3ports:-name: metricscontainerPort:9090protocol: TCP-name: healthcontainerPort:8080protocol: TCPvolumes:-name: configconfigMap:name: daemoneye-config-name: datapersistentVolumeClaim:claimName: daemoneye-data-name: logsemptyDir:{}-name: rulesconfigMap:name: daemoneye-rules-name: tmpemptyDir:{}tolerations:-key: node-role.kubernetes.io/masteroperator: Existseffect: NoSchedule-key: node-role.kubernetes.io/control-planeoperator: Existseffect: NoSchedule-key: node.kubernetes.io/not-readyoperator: Existseffect: NoExecutetolerationSeconds:300-key: node.kubernetes.io/unreachableoperator: Existseffect: NoExecutetolerationSeconds:300nodeSelector:kubernetes.io/os: linuxaffinity:nodeAffinity:requiredDuringSchedulingIgnoredDuringExecution:nodeSelectorTerms:-matchExpressions:-key: kubernetes.io/archoperator: Invalues:- amd64- arm64
Production Deployment#
production-daemoneye-agent-deployment.yaml:
apiVersion: apps/v1kind: Deploymentmetadata:name: daemoneye-agentnamespace: daemoneyespec:replicas:2selector:matchLabels:app: daemoneye-agenttemplate:metadata:labels:app: daemoneye-agentannotations:prometheus.io/scrape:'true'prometheus.io/port:'9090'prometheus.io/path: /metricsspec:serviceAccountName: daemoneye-agentsecurityContext:runAsUser:1000runAsGroup:1000fsGroup:1000containers:-name: daemoneye-agentimage: daemoneye/daemoneye-agent:1.0.0imagePullPolicy: IfNotPresentsecurityContext:allowPrivilegeEscalation:falsereadOnlyRootFilesystem:truerunAsUser:1000runAsGroup:1000capabilities:drop:- ALLvolumeMounts:-name: configmountPath: /configreadOnly:true-name: datamountPath: /data-name: logsmountPath: /logs-name: tmpmountPath: /tmpenv:-name: DaemonEye_LOG_LEVELvalue: info-name: DaemonEye_DATA_DIRvalue: /data-name: DaemonEye_LOG_DIRvalue: /logs-name: DaemonEye_PROCMOND_ENDPOINTvalue: tcp://daemoneye-procmond:8080command:[daemoneye-agent]args:[--config, /config/daemoneye-agent.yaml]resources:requests:memory: 512Micpu: 200mlimits:memory: 1Gicpu: 1000mlivenessProbe:exec:command:- daemoneye-agent- healthinitialDelaySeconds:30periodSeconds:30timeoutSeconds:10failureThreshold:3readinessProbe:exec:command:- daemoneye-agent- healthinitialDelaySeconds:10periodSeconds:10timeoutSeconds:5failureThreshold:3ports:-name: metricscontainerPort:9090protocol: TCP-name: healthcontainerPort:8080protocol: TCPvolumes:-name: configconfigMap:name: daemoneye-config-name: datapersistentVolumeClaim:claimName: daemoneye-data-name: logsemptyDir:{}-name: tmpemptyDir:{}affinity:podAntiAffinity:preferredDuringSchedulingIgnoredDuringExecution:-weight:100podAffinityTerm:labelSelector:matchExpressions:-key: appoperator: Invalues:- daemoneye-agenttopologyKey: kubernetes.io/hostname
Horizontal Pod Autoscaler#
hpa.yaml:
apiVersion: autoscaling/v2kind: HorizontalPodAutoscalermetadata:name: daemoneye-agent-hpanamespace: daemoneyespec:scaleTargetRef:apiVersion: apps/v1kind: Deploymentname: daemoneye-agentminReplicas:2maxReplicas:10metrics:-type: Resourceresource:name: cputarget:type: UtilizationaverageUtilization:70-type: Resourceresource:name: memorytarget:type: UtilizationaverageUtilization:80behavior:scaleDown:stabilizationWindowSeconds:300policies:-type: Percentvalue:10periodSeconds:60scaleUp:stabilizationWindowSeconds:60policies:-type: Percentvalue:50periodSeconds:60
Helm Chart Deployment#
Helm Chart Structure#
daemoneye/ ├── Chart.yaml ├── values.yaml ├── values-production.yaml ├── values-development.yaml ├── templates/ │ ├── namespace.yaml │ ├── rbac.yaml │ ├── configmap.yaml │ ├── secret.yaml │ ├── pvc.yaml │ ├── procmond-daemonset.yaml │ ├── daemoneye-agent-deployment.yaml │ ├── service.yaml │ ├── hpa.yaml │ ├── networkpolicy.yaml │ └── servicemonitor.yaml └── charts/
Chart.yaml#
apiVersion: v2name: daemoneyedescription: DaemonEye Security Monitoring Agenttype: applicationversion:1.0.0appVersion:1.0.0keywords:- security- monitoring- processes- threat-detectionhome: https://daemoneye.comsources:- https://github.com/daemoneye/daemoneyemaintainers:-name: DaemonEye Teamemail: team@daemoneye.comdependencies:-name: prometheusversion:15.0.0repository: https://prometheus-community.github.io/helm-chartscondition: monitoring.prometheus.enabled
values.yaml#
# Default values for daemoneyeimage:repository: daemoneyetag:1.0.0pullPolicy: IfNotPresentreplicaCount:1serviceAccount:create:trueannotations:{}name:''podSecurityContext:runAsUser:1000runAsGroup:1000fsGroup:1000securityContext:allowPrivilegeEscalation:falsecapabilities:drop:- ALLreadOnlyRootFilesystem:truerunAsNonRoot:truerunAsUser:1000service:type: ClusterIPport:8080ingress:enabled:falseclassName:''annotations:{}hosts:-host: daemoneye.example.compaths:-path: /pathType: Prefixtls:[]resources:limits:cpu: 1000mmemory: 1Girequests:cpu: 200mmemory: 512Miautoscaling:enabled:falseminReplicas:1maxReplicas:10targetCPUUtilizationPercentage:80targetMemoryUtilizationPercentage:80nodeSelector:{}tolerations:[]affinity:{}persistence:enabled:truestorageClass:''accessMode: ReadWriteOncesize: 10Giconfig:app:scan_interval_ms:30000batch_size:1000log_level: infodatabase:retention_days:30alerting:enabled:truesinks:-type: syslogenabled:truefacility: daemonsecrets:{}monitoring:enabled:falseserviceMonitor:enabled:falsenamespace:''interval: 30sscrapeTimeout: 10sprometheus:enabled:falseserver:enabled:truepersistentVolume:enabled:truesize: 8Gialertmanager:enabled:truepersistentVolume:enabled:truesize: 2Gigrafana:enabled:falseadminPassword: adminpersistentVolume:enabled:truesize: 1GinetworkPolicy:enabled:falseingress:enabled:truerules:[]egress:enabled:truerules:[]
Deploy with Helm#
# Add DaemonEye Helm repositoryhelm repo add daemoneye https://charts.daemoneye.comhelm repo update# Install DaemonEyehelm install daemoneye daemoneye/daemoneye \--namespace daemoneye \--create-namespace\--values values.yaml# Install with production valueshelm install daemoneye daemoneye/daemoneye \--namespace daemoneye \--create-namespace\--values values-production.yaml# Upgrade deploymenthelm upgrade daemoneye daemoneye/daemoneye \--namespace daemoneye \--values values.yaml# Uninstallhelm uninstall daemoneye --namespace daemoneye
Security Configuration#
Network Policies#
networkpolicy.yaml:
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:name: daemoneye-network-policynamespace: daemoneyespec:podSelector:matchLabels:app: daemoneyepolicyTypes:- Ingress- Egressingress:-from:-namespaceSelector:matchLabels:name: daemoneye-podSelector:matchLabels:app: daemoneyeports:-protocol: TCPport:8080-protocol: TCPport:9090egress:-to:-namespaceSelector:matchLabels:name: daemoneye-podSelector:matchLabels:app: daemoneyeports:-protocol: TCPport:8080-protocol: TCPport:9090-to:[]ports:-protocol: TCPport:53-protocol: UDPport:53
Pod Security Standards#
pod-security-policy.yaml:
apiVersion: policy/v1beta1kind: PodSecurityPolicymetadata:name: daemoneye-pspspec:privileged:falseallowPrivilegeEscalation:falserequiredDropCapabilities:- ALLvolumes:- configMap- emptyDir- projected- secret- downwardAPI- persistentVolumeClaimrunAsUser:rule: MustRunAsNonRootseLinux:rule: RunAsAnyfsGroup:rule: RunAsAny
RBAC Configuration#
rbac.yaml:
apiVersion: v1kind: ServiceAccountmetadata:name: daemoneye-procmondnamespace: daemoneye---apiVersion: v1kind: ServiceAccountmetadata:name: daemoneye-agentnamespace: daemoneye---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:name: daemoneye-procmondrules:-apiGroups:[""]resources:["nodes","pods"]verbs:["get","list","watch"]-apiGroups:[""]resources:["pods/exec"]verbs:["create"]---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:name: daemoneye-procmondroleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: daemoneye-procmondsubjects:-kind: ServiceAccountname: daemoneye-procmondnamespace: daemoneye---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:name: daemoneye-agentrules:-apiGroups:[""]resources:["pods","services","endpoints"]verbs:["get","list","watch"]---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:name: daemoneye-agentroleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: daemoneye-agentsubjects:-kind: ServiceAccountname: daemoneye-agentnamespace: daemoneye
Monitoring and Observability#
Prometheus ServiceMonitor#
servicemonitor.yaml:
apiVersion: monitoring.coreos.com/v1kind: ServiceMonitormetadata:name: daemoneyenamespace: daemoneyelabels:app: daemoneyespec:selector:matchLabels:app: daemoneyeendpoints:-port: metricspath: /metricsinterval: 30sscrapeTimeout: 10s
Grafana Dashboard#
grafana-dashboard.yaml:
apiVersion: v1kind: ConfigMapmetadata:name: daemoneye-grafana-dashboardnamespace: daemoneyelabels:grafana_dashboard:'1'data: daemoneye-dashboard.json: | { "dashboard": { "title": "DaemonEye Monitoring", "panels": [ { "title": "Process Collection Rate", "type": "graph", "targets": [ { "expr": "rate(daemoneye_processes_collected_total[5m])", "legendFormat": "Processes/sec" } ] }, { "title": "Memory Usage", "type": "graph", "targets": [ { "expr": "daemoneye_memory_usage_bytes", "legendFormat": "Memory Usage" } ] } ] } }
Troubleshooting#
Common Issues#
Pod Won't Start:
# Check pod statuskubectl get pods -n daemoneye# Check pod logskubectl logs -n daemoneye daemoneye-procmond-xxx# Check pod eventskubectl describe pod -n daemoneye daemoneye-procmond-xxx
Permission Denied:
# Check security contextkubectl get pod -n daemoneye daemoneye-procmond-xxx -o yaml |grep securityContext# Check file permissionskubectl exec -n daemoneye daemoneye-procmond-xxx -- ls -la /data
Network Issues:
# Check service endpointskubectl get endpoints -n daemoneye# Check network connectivitykubectl exec -n daemoneye daemoneye-agent-xxx -- ping daemoneye-procmond
Database Issues:
# Check database statuskubectl exec -n daemoneye daemoneye-agent-xxx -- daemoneye-cli database status# Check database integritykubectl exec -n daemoneye daemoneye-agent-xxx -- daemoneye-cli database integrity-check
Debug Mode#
Enable Debug Logging:
# Update ConfigMapapiVersion: v1kind: ConfigMapmetadata:name: daemoneye-confignamespace: daemoneyedata: procmond.yaml: | app: log_level: debug # ... rest of config
Debug Pod:
# Run debug podkubectl run debug --image=daemoneye/daemoneye-cli:1.0.0 -it--rm-- /bin/sh# Check system capabilitieskubectl run debug --image=daemoneye/daemoneye-cli:1.0.0 -it--rm-- capsh --print
Performance Issues#
High CPU Usage:
# Check resource usagekubectl top pods -n daemoneye# Check HPA statuskubectl get hpa -n daemoneye# Scale up manuallykubectl scale deployment daemoneye-agent --replicas=3 -n daemoneye
High Memory Usage:
# Check memory usagekubectl top pods -n daemoneye# Check memory limitskubectl describe pod -n daemoneye daemoneye-agent-xxx |grep Limits
Slow Database Operations:
# Check database performancekubectl exec -n daemoneye daemoneye-agent-xxx -- daemoneye-cli database query-stats# Optimize databasekubectl exec -n daemoneye daemoneye-agent-xxx -- daemoneye-cli database optimize
This Kubernetes deployment guide provides comprehensive
instructions for deploying DaemonEye on Kubernetes. For additional help,
consult the troubleshooting section or contact support.
Source note: Populated from the public repo
(docs/src/deployment/kubernetes.md) on 2026-04-18. This
page was previously empty; the content above mirrors the repo at the
time of sync.