From 90a6fb3d407bcc72911ccc309c143b4588dc7716 Mon Sep 17 00:00:00 2001
From: Volodymyr Stoiko <me@volodymyrstoiko.com>
Date: Sun, 17 May 2026 21:34:50 +0000
Subject: [PATCH] auth: set helm default role to kubeshark-viewer

Per round-2 permissions clarifications: SSO users whose claim doesn't
match any built-in role and isn't in AUTH_GROUP_MAPPING should fall
back to a read-only baseline instead of strict-deny ("").

defaultRole="" causes the dashboard to 403-storm gated endpoints from
unmatched users; viewer (snapshot:read only) gives them a sensible
read-only UX while still preventing any state change.
---
 config/configStruct.go | 1 +
 helm-chart/values.yaml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/configStruct.go b/config/configStruct.go
index 83832434b..4b07f313e 100644
--- a/config/configStruct.go
+++ b/config/configStruct.go
@@ -103,6 +103,7 @@ func CreateDefaultConfig() ConfigStruct {
 			},
 			Auth: configStructs.AuthConfig{
 				RolesClaim:   "groups",
+				DefaultRole:  "kubeshark-viewer",
 				GroupMapping: map[string]string{},
 			},
 			EnabledDissectors: []string{
diff --git a/helm-chart/values.yaml b/helm-chart/values.yaml
index cd39e1aa1..586424ab4 100644
--- a/helm-chart/values.yaml
+++ b/helm-chart/values.yaml
@@ -154,7 +154,7 @@ tap:
     enabled: false
     type: saml
     rolesClaim: groups
-    defaultRole: ""
+    defaultRole: kubeshark-viewer
     groupMapping: {}
     saml:
       idpMetadataUrl: ""