Auditbeat is a lightweight shipper to audit the activities of users and processes on your systems, so that you can identify potential security policy violations. You can use Auditbeat to collect audit events from the Linux Audit Framework. You can also use Auditbeat for file integrity check, that is to detect changes to critical files, like binaries and configuration files.
This chart deploys auditbeat agents to all the nodes in your cluster via a DaemonSet.
By default this chart only ships a single output to a file on the local system. Users should set config.output.file.enabled=false and configure their own outputs as documented
- Kubernetes 1.9+
Installing the Chart
To install the chart with the release name
$ helm install --name my-release stable/auditbeat
After a few minutes, you should see service statuses being written to the configured output, which is a log file inside the auditbeat container.
Tip: List all releases using
Uninstalling the Chart
To uninstall/delete the
$ helm delete my-release
The command removes all the Kubernetes components associated with the chart and deletes the release.
The following table lists the configurable parameters of the auditbeat chart and their default values.
||The image repository to pull from||
||The image tag to pull||
||Image pull policy||
||If true, create & use RBAC resources||
||existing ServiceAccount to use (ignored if rbac.create=true)||
||The content of the configuration file consumed by auditbeat. See the auditbeat documentation for full details|
||List of beat plugins|
||A map of additional environment variables|
||Additional volumes and mounts, for example to provide other configuration files|
||CPU resource requests|
||CPU resource limits|
||Memory resource requests|
||Memory resource limits|
Specify each parameter using the
--set key=value[,key=value] argument to
helm install. For example,
$ helm install --name my-release \ --set rbac.create=true \ stable/auditbeat
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
$ helm install --name my-release -f values.yaml stable/auditbeat
Tip: You can use the default values.yaml