Configuration Reference

The knobs that matter, and the defaults you should leave alone.

Docs / Configuration

Configuration Reference

PandoCore is designed to be boring to configure. Most workloads need nothing beyond picking an operating mode. This page covers the common knobs. Additional advanced options exist for specialized workloads and are available through support.

Webhook Helm Values

Set at helm install / helm upgrade time:

Helm Value Default Description
licenseKey (required) License key from your portal account.
defaultMode monitor monitor, alert, isolate, or enforce. Modes layer additively — each does everything the prior mode does, plus one response action. See Operating Modes.
slackWebhookURL (empty) Slack incoming webhook for alert notifications.
excludedNamespaces [kube-system, kube-public, kube-node-lease] Namespaces skipped by injection. Add your infra namespaces.
failurePolicy Ignore Ignore admits pods if the webhook is down; Fail blocks them. See Production Hardening.
replicas 2 Webhook server replicas. Keep at 2+ in production.
sidecar.image Chart appVersion Pin explicitly in production (see Upgrading).
sidecar.resources 25Mi / 50Mi, 50m / 100m Injected sidecar CPU/memory (request / limit). Raise if you see OOM kills on high-throughput workloads.
responseActions (unset) Comma-separated response chain override, e.g. alert,isolate,terminate. Empty uses per-detection defaults.
escalationTimeoutSecs 120 Seconds to wait after isolation before escalating to terminate.
recoveryTimeoutSecs 60 Seconds of clean samples after isolation before lifting isolation.
portalWebhook.enabled true Send detection events to the PandoCore portal for the cluster dashboard.
portalWebhook.url https://portal.pandocore.io/api/events/ingest Portal event endpoint. Override for staging.
crd.enabled true Install the PandoCorePolicy CRD. See CRD Policy.
networkAudit.enabled false Cluster-wide default for the network connection audit. When on, the sidecar baselines the set of remote IPs during learning and emits attestation evidence on connections to addresses outside the baseline + allowlist. Per-pod override via the pandocore.io/audit-network annotation.
networkAudit.allowlistCIDRs "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,fd00::/8" Comma-separated CIDRs never flagged as unexpected. Default covers RFC1918, loopback, and ULA. Per-pod override via the pandocore.io/network-allowlist annotation.

Per-pod overrides via deployment annotations. See Admission Webhook.

Sidecar Runtime Settings

Change these on live workloads with kubectl set env, or via a PandoCorePolicy (CRD Policy).

Operating Mode

Variable Default Description
PANDO_MODE monitor monitor, alert, isolate, or enforce. See Operating Modes. 
kubectl set env deployment/your-app -c pando-sidecar PANDO_MODE=enforce
kubectl rollout restart deployment/your-app

Sensitivity

Variable Default Description
PANDO_SENSITIVITY 2.0 Higher = more permissive, lower = catches subtler anomalies.

The single tuning lever you should ever need. If a workload is chatty, raise it. If it's quiet, lower it. The webhook auto-applies runtime-aware defaults for common runtime families, so most workloads never need to touch this.

Runtime Profile

The webhook auto-detects common runtime families (JVM/Node/.NET, databases) and applies a slightly higher default sensitivity for their naturally variable behavior. Override it only if auto-detection picks the wrong profile.

Variable Default Description
PANDO_RUNTIME_PROFILE (auto-detected) default, jit, or database. Explicit override of the runtime profile.

Learning Window

Each sidecar builds a per-workload operational profile during a startup learning window before it begins detecting. The defaults suit most workloads. Only extend the window if your app has a long, variable warmup (slow JVM startup, bulk-import containers, batch jobs).

Variable Default Description
PANDO_LEARNING_DURATION_SECONDS 1800 (30 min) Minimum length of the learning window.
PANDO_LEARNING_MIN_SAMPLES 900 Minimum samples required before learning can complete.

Response Chain

In enforce mode, detections walk a response chain: alert, isolate, terminate.

Variable Default Description
PANDO_RESPONSE_ACTIONS alert,isolate,terminate Comma-separated chain. Valid: alert, isolate, terminate.
PANDO_ESCALATION_TIMEOUT_SECS 120 Seconds to wait after isolation before escalating to terminate.
PANDO_RECOVERY_TIMEOUT_SECS 60 Seconds of clean samples after isolation before de-escalating and lifting isolation.

Isolation applies a NetworkPolicy denying all egress except DNS. If the pod recovers, isolation is lifted automatically. See Operating Modes.

Slack Alerts

Variable Default Description
PANDO_SLACK_WEBHOOK_URL (empty) Per-workload override for the cluster-wide slackWebhookURL. 
kubectl set env deployment/your-app -c pando-sidecar \
  PANDO_SLACK_WEBHOOK_URL="https://hooks.slack.com/services/T.../B.../xxx"

Evidence Delivery

Every detection emits a structured JSON envelope. By default it's posted to the PandoCore portal; you can redirect to any endpoint that accepts JSON POSTs (SIEM, incident pipeline, etc.).

Variable Default Description
PANDO_EVIDENCE_WEBHOOK_URL (set by webhook) Override per-workload to redirect evidence.
PANDO_EVIDENCE_WEBHOOK_TIMEOUT_SECONDS 5 Per-request timeout for evidence delivery.
PANDO_EVIDENCE_WEBHOOK_MAX_RETRIES 3 Retry attempts on failure (exponential backoff).

See Evidence Format.

Logging

Variable Default Description
PANDO_LOG_LEVEL info trace, debug, info, warn, error.
PANDO_LOG_JSON true JSON-structured logs for SIEM ingestion.

What You Can't Configure

Detection internals are managed automatically and not user-tunable. If sensitivity isn't solving your problem, contact support.

Configuration Examples

Production Install

# values-production.yaml
licenseKey: "your-license-key"
defaultMode: monitor
slackWebhookURL: "https://hooks.slack.com/services/T.../B.../xxx"
failurePolicy: Ignore
excludedNamespaces:
  - kube-system
  - kube-public
  - kube-node-lease
  - cert-manager
  - istio-system
webhook:
  replicaCount: 2
sidecar:
  image: us-central1-docker.pkg.dev/pandocore-prod/sidecar/pando-sidecar:v0.5.2
replicas: 2

Per-Workload Override

kubectl set env deployment/critical-api -c pando-sidecar \
  PANDO_MODE=enforce \
  PANDO_SENSITIVITY=1.5
kubectl rollout restart deployment/critical-api

Next Steps