From 91181532cd4708f31a39dd26232b20477b2bdd3e Mon Sep 17 00:00:00 2001 From: Volodymyr Stoiko Date: Thu, 27 Aug 2026 14:55:19 +0300 Subject: [PATCH] chart: add tap.networkPolicies.enabled, off by default The Hub's network-policy routes create and remove Kubernetes NetworkPolicy objects and compute pod-reachability impact. That acts outside Kubeshark's own data, so it is not something a role should carry implicitly and not something a deployment should offer unasked. It gets the same shape as scripting: a switch the operator sets, rendering NETWORK_POLICIES_DISABLED for the Hub. Off by default. The dashboard never calls these routes, so nothing in the UI changes; a caller that wants them is asking on purpose. --- config/configStructs/tapConfig.go | 14 ++++++++++++-- helm-chart/README.md | 1 + helm-chart/templates/12-config-map.yaml | 1 + helm-chart/tests/demo_posture_test.yaml | 17 +++++++++++++++++ helm-chart/values.yaml | 2 ++ 5 files changed, 33 insertions(+), 2 deletions(-) diff --git a/config/configStructs/tapConfig.go b/config/configStructs/tapConfig.go index bb7ea155c..7f0eae337 100644 --- a/config/configStructs/tapConfig.go +++ b/config/configStructs/tapConfig.go @@ -484,8 +484,14 @@ type TapConfig struct { Pprof PprofConfig `yaml:"pprof" json:"pprof"` Misc MiscConfig `yaml:"misc" json:"misc"` SecurityContext SecurityContextConfig `yaml:"securityContext" json:"securityContext"` - MountBpf bool `yaml:"mountBpf" json:"mountBpf" default:"true"` - HostNetwork bool `yaml:"hostNetwork" json:"hostNetwork" default:"true"` + // NetworkPolicies exposes the Hub's network-policy routes, which create + // and remove Kubernetes NetworkPolicy objects and compute pod-reachability + // impact. The feature reaches outside Kubeshark's own data, so it is off + // unless an operator asks for it, and no role grants it: whether a + // deployment offers it at all is not a question about the caller. + NetworkPolicies NetworkPoliciesConfig `yaml:"networkPolicies" json:"networkPolicies"` + MountBpf bool `yaml:"mountBpf" json:"mountBpf" default:"true"` + HostNetwork bool `yaml:"hostNetwork" json:"hostNetwork" default:"true"` } func (config *TapConfig) PodRegex() *regexp.Regexp { @@ -501,3 +507,7 @@ func (config *TapConfig) Validate() error { return nil } + +type NetworkPoliciesConfig struct { + Enabled bool `yaml:"enabled" json:"enabled" default:"false"` +} diff --git a/helm-chart/README.md b/helm-chart/README.md index 51a51a536..ebf265bc2 100644 --- a/helm-chart/README.md +++ b/helm-chart/README.md @@ -240,6 +240,7 @@ Example for overriding image names: | `tap.globalFilter` | Prepends to any KFL filter and can be used to limit what is visible in the dashboard. For example, `redact("request.headers.Authorization")` will redact the appropriate field. Another example `!dns` will not show any DNS traffic. | `""` | | `tap.metrics.port` | Pod port used to expose Prometheus metrics | `49100` | | `tap.enabledDissectors` | This is an array of strings representing the list of supported protocols. Remove or comment out redundant protocols (e.g., dns).| The default list excludes: `udp` and `tcp` | +| `tap.networkPolicies.enabled` | Exposes the Hub's network-policy routes, which create and remove Kubernetes NetworkPolicy objects and compute pod-reachability impact. Off by default: the feature acts outside Kubeshark's own data, and no role grants it, so whether a deployment offers it at all is an operator decision rather than a permission. When `false` those routes answer 409. | `false` | | `tap.mountBpf` | BPF filesystem needs to be mounted for eBPF to work properly. This helm value determines whether Kubeshark will attempt to mount the filesystem. This option is not required if filesystem is already mounts. │ `true`| | `tap.hostNetwork` | Enable host network mode for worker DaemonSet pods. When enabled, worker pods use the host's network namespace for direct network access. | `true` | | `tap.packetCapture` | Packet capture backend: `best`, `af_packet`, or `pf_ring` | `best` | diff --git a/helm-chart/templates/12-config-map.yaml b/helm-chart/templates/12-config-map.yaml index 0ade315f6..6cd1ab722 100644 --- a/helm-chart/templates/12-config-map.yaml +++ b/helm-chart/templates/12-config-map.yaml @@ -41,6 +41,7 @@ data: {{- end }}' TELEMETRY_DISABLED: '{{ not .Values.internetConnectivity | ternary "true" (not .Values.tap.telemetry.enabled | ternary "true" "false") }}' SCRIPTING_DISABLED: '{{ not (default false ((.Values.scripting).enabled)) }}' + NETWORK_POLICIES_DISABLED: '{{ not (default false (((.Values.tap).networkPolicies).enabled)) }}' GLOBAL_FILTER: {{ include "kubeshark.escapeDoubleQuotes" .Values.tap.globalFilter | quote }} DEFAULT_FILTER: {{ include "kubeshark.escapeDoubleQuotes" .Values.tap.defaultFilter | quote }} TRAFFIC_SAMPLE_RATE: '{{ .Values.tap.misc.trafficSampleRate }}' diff --git a/helm-chart/tests/demo_posture_test.yaml b/helm-chart/tests/demo_posture_test.yaml index 5bee23565..a4fb2dcd2 100644 --- a/helm-chart/tests/demo_posture_test.yaml +++ b/helm-chart/tests/demo_posture_test.yaml @@ -78,3 +78,20 @@ tests: - equal: path: data.SCRIPTING_DISABLED value: "false" + + ## Network policies create and remove Kubernetes NetworkPolicy objects, which + ## is not a question about who is asking: no role grants it. Like scripting it + ## is a deployment-wide switch, and it is off unless an operator asks for it. + - it: disables the network-policy routes by default + asserts: + - equal: + path: data.NETWORK_POLICIES_DISABLED + value: "true" + + - it: exposes the network-policy routes when the operator asks for them + set: + tap.networkPolicies.enabled: true + asserts: + - equal: + path: data.NETWORK_POLICIES_DISABLED + value: "false" diff --git a/helm-chart/values.yaml b/helm-chart/values.yaml index 774458245..7112ad1ec 100644 --- a/helm-chart/values.yaml +++ b/helm-chart/values.yaml @@ -280,6 +280,8 @@ tap: - SYS_PTRACE - SYS_RESOURCE - IPC_LOCK + networkPolicies: + enabled: false mountBpf: true hostNetwork: true logs: