From ed9ce1b561c11b0debf986bd40b76ece6d15c893 Mon Sep 17 00:00:00 2001 From: Volodymyr Stoiko Date: Wed, 12 Aug 2026 22:01:23 +0300 Subject: [PATCH] helm: gate the worker hub token on the same condition as AUTH_ENABLED (#1955) * helm: gate worker hub token on the same condition as hub AUTH_ENABLED (#1954) The hub's AUTH_ENABLED is derived from cloudLicenseEnabled/demoModeEnabled/ tap.auth.enabled, but the worker DaemonSet gated HUB_INTERNAL_TOKEN_PATH, its volumeMount and the projected serviceAccountToken on tap.auth.enabled alone. With demoModeEnabled: true (or the default cloudLicenseEnabled: true) and tap.auth.enabled unset, the hub required a bearer token the workers never got, so every worker -> hub call returned 401: tracer target refresh and name resolution history silently stopped while capture kept working. Extract the condition into a kubeshark.authEnabled helper and consume it from both 12-config-map.yaml and 09-worker-daemon-set.yaml so the two cannot drift. AUTH_ENABLED renders identically to before for all combinations of cloudLicenseEnabled/license/demoModeEnabled/tap.auth.enabled/tap.auth.type. * helm: mount the hub internal token in the tracer container too (#1954) The tracer polls the hub's /pods/all and /pods/targeted on every sync cycle, but only the sniffer container received HUB_INTERNAL_TOKEN_PATH and the token mount, so with auth enabled the tracer's requests were rejected and TLS hooking never picked up newly started pods. Wire the same env var and projected-token mount into the tracer container. Requires the matching tracer2 change that sends the Bearer header. --- helm-chart/templates/09-worker-daemon-set.yaml | 15 ++++++++++++--- helm-chart/templates/12-config-map.yaml | 6 +----- helm-chart/templates/_helpers.tpl | 14 ++++++++++++++ 3 files changed, 27 insertions(+), 8 deletions(-) diff --git a/helm-chart/templates/09-worker-daemon-set.yaml b/helm-chart/templates/09-worker-daemon-set.yaml index 713062e35..61485b249 100644 --- a/helm-chart/templates/09-worker-daemon-set.yaml +++ b/helm-chart/templates/09-worker-daemon-set.yaml @@ -146,7 +146,7 @@ spec: value: '{{ (include "sentry.enabled" .) }}' - name: SENTRY_ENVIRONMENT value: '{{ .Values.tap.sentry.environment }}' - {{- if (((.Values.tap).auth).enabled) }} + {{- if eq (include "kubeshark.authEnabled" .) "true" }} - name: HUB_INTERNAL_TOKEN_PATH value: /var/run/secrets/kubeshark/hub-token/token {{- end }} @@ -239,7 +239,7 @@ spec: {{- if .Values.tap.persistentStorage }} subPathExpr: $(NODE_NAME) {{- end }} - {{- if (((.Values.tap).auth).enabled) }} + {{- if eq (include "kubeshark.authEnabled" .) "true" }} - mountPath: /var/run/secrets/kubeshark/hub-token name: hub-internal-token readOnly: true @@ -284,6 +284,10 @@ spec: value: '{{ (include "sentry.enabled" .) }}' - name: SENTRY_ENVIRONMENT value: '{{ .Values.tap.sentry.environment }}' + {{- if eq (include "kubeshark.authEnabled" .) "true" }} + - name: HUB_INTERNAL_TOKEN_PATH + value: /var/run/secrets/kubeshark/hub-token/token + {{- end }} resources: limits: {{ if ne (toString .Values.tap.resources.tracer.limits.cpu) "0" }} @@ -359,6 +363,11 @@ spec: mountPropagation: HostToContainer name: root readOnly: true + {{- if eq (include "kubeshark.authEnabled" .) "true" }} + - mountPath: /var/run/secrets/kubeshark/hub-token + name: hub-internal-token + readOnly: true + {{- end }} {{- end }} dnsPolicy: ClusterFirstWithHostNet hostNetwork: {{ .Values.tap.hostNetwork }} @@ -439,7 +448,7 @@ spec: emptyDir: sizeLimit: {{ .Values.tap.storageLimit }} {{- end }} - {{- if (((.Values.tap).auth).enabled) }} + {{- if eq (include "kubeshark.authEnabled" .) "true" }} - name: hub-internal-token projected: sources: diff --git a/helm-chart/templates/12-config-map.yaml b/helm-chart/templates/12-config-map.yaml index aa7d8aa9f..ecc396f5c 100644 --- a/helm-chart/templates/12-config-map.yaml +++ b/helm-chart/templates/12-config-map.yaml @@ -18,11 +18,7 @@ data: INGRESS_ENABLED: '{{ .Values.tap.ingress.enabled }}' INGRESS_HOST: '{{ .Values.tap.ingress.host }}' PROXY_FRONT_PORT: '{{ .Values.tap.proxy.front.port }}' - AUTH_ENABLED: '{{- if and .Values.cloudLicenseEnabled (not (empty .Values.license)) -}} - {{ (default false .Values.demoModeEnabled) | ternary true ((and .Values.tap.auth.enabled (or (eq .Values.tap.auth.type "oidc") (eq .Values.tap.auth.type "dex"))) | ternary true false) }} - {{- else -}} - {{ .Values.cloudLicenseEnabled | ternary "true" ((default false .Values.demoModeEnabled) | ternary "true" .Values.tap.auth.enabled) }} - {{- end }}' + AUTH_ENABLED: '{{ include "kubeshark.authEnabled" . }}' AUTH_TYPE: '{{- if and .Values.cloudLicenseEnabled (not (or (eq .Values.tap.auth.type "oidc") (eq .Values.tap.auth.type "dex"))) -}} default {{- else -}} diff --git a/helm-chart/templates/_helpers.tpl b/helm-chart/templates/_helpers.tpl index dd60cd68d..fde9514e2 100644 --- a/helm-chart/templates/_helpers.tpl +++ b/helm-chart/templates/_helpers.tpl @@ -110,3 +110,17 @@ Dex IdP: retrieve a secret for static client with a specific ID {{- end }} {{- end }} {{- end }} + +{{/* +Single source of truth for whether the hub enforces authentication. +Consumed by the hub ConfigMap (AUTH_ENABLED) and by the worker DaemonSet, which +must mount an internal hub token whenever the hub requires one. Keeping the two +in sync prevents workers from being issued no token while the hub demands one. +*/}} +{{- define "kubeshark.authEnabled" -}} +{{- if and .Values.cloudLicenseEnabled (not (empty .Values.license)) -}} +{{ (default false .Values.demoModeEnabled) | ternary true ((and .Values.tap.auth.enabled (or (eq .Values.tap.auth.type "oidc") (eq .Values.tap.auth.type "dex"))) | ternary true false) }} +{{- else -}} +{{ .Values.cloudLicenseEnabled | ternary "true" ((default false .Values.demoModeEnabled) | ternary "true" .Values.tap.auth.enabled) }} +{{- end -}} +{{- end -}}