mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-02-14 10:00:08 +00:00
Rename generic capture to l7 dissection specific config (#1841)
* Rename generic capture to l7 dissection specific config * upd * upd flags * Create `REACT_APP_DISSECTION_ENABLED` env to set initial dissection state --------- Co-authored-by: Serhii Ponomarenko <116438358+tiptophelmet@users.noreply.github.com> Co-authored-by: tiptophelmet <serhii.ponomarenko.jobs@gmail.com>
This commit is contained in:
Volodymyr Stoiko
GitHub
@@ -116,6 +116,7 @@ func CreateDefaultConfig() ConfigStruct {
|
|||||||
},
|
},
|
||||||
CanUpdateTargetedPods: true,
|
CanUpdateTargetedPods: true,
|
||||||
CanStopTrafficCapturing: true,
|
CanStopTrafficCapturing: true,
|
||||||
|
CanControlDissection: true,
|
||||||
ShowAdminConsoleLink: true,
|
ShowAdminConsoleLink: true,
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
@@ -154,8 +155,10 @@ func CreateDefaultConfig() ConfigStruct {
|
|||||||
CompleteStreamingEnabled: true,
|
CompleteStreamingEnabled: true,
|
||||||
},
|
},
|
||||||
Capture: configStructs.CaptureConfig{
|
Capture: configStructs.CaptureConfig{
|
||||||
Stopped: false,
|
Dissection: configStructs.DissectionConfig{
|
||||||
StopAfter: "5m",
|
Enabled: true,
|
||||||
|
StopAfter: "5m",
|
||||||
|
},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -167,6 +167,7 @@ type Role struct {
|
|||||||
ScriptingPermissions ScriptingPermissions `yaml:"scriptingPermissions" json:"scriptingPermissions"`
|
ScriptingPermissions ScriptingPermissions `yaml:"scriptingPermissions" json:"scriptingPermissions"`
|
||||||
CanUpdateTargetedPods bool `yaml:"canUpdateTargetedPods" json:"canUpdateTargetedPods" default:"false"`
|
CanUpdateTargetedPods bool `yaml:"canUpdateTargetedPods" json:"canUpdateTargetedPods" default:"false"`
|
||||||
CanStopTrafficCapturing bool `yaml:"canStopTrafficCapturing" json:"canStopTrafficCapturing" default:"false"`
|
CanStopTrafficCapturing bool `yaml:"canStopTrafficCapturing" json:"canStopTrafficCapturing" default:"false"`
|
||||||
|
CanControlDissection bool `yaml:"canControlDissection" json:"canControlDissection" default:"false"`
|
||||||
ShowAdminConsoleLink bool `yaml:"showAdminConsoleLink" json:"showAdminConsoleLink" default:"false"`
|
ShowAdminConsoleLink bool `yaml:"showAdminConsoleLink" json:"showAdminConsoleLink" default:"false"`
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -316,9 +317,13 @@ type DelayedDissectionConfig struct {
|
|||||||
Memory string `yaml:"memory" json:"memory" default:"4Gi"`
|
Memory string `yaml:"memory" json:"memory" default:"4Gi"`
|
||||||
}
|
}
|
||||||
|
|
||||||
|
type DissectionConfig struct {
|
||||||
|
Enabled bool `yaml:"enabled" json:"enabled" default:"true"`
|
||||||
|
StopAfter string `yaml:"stopAfter" json:"stopAfter" default:"5m"`
|
||||||
|
}
|
||||||
|
|
||||||
type CaptureConfig struct {
|
type CaptureConfig struct {
|
||||||
Stopped bool `yaml:"stopped" json:"stopped" default:"false"`
|
Dissection DissectionConfig `yaml:"dissection" json:"dissection"`
|
||||||
StopAfter string `yaml:"stopAfter" json:"stopAfter" default:"5m"`
|
|
||||||
CaptureSelf bool `yaml:"captureSelf" json:"captureSelf" default:"false"`
|
CaptureSelf bool `yaml:"captureSelf" json:"captureSelf" default:"false"`
|
||||||
Raw RawCaptureConfig `yaml:"raw" json:"raw"`
|
Raw RawCaptureConfig `yaml:"raw" json:"raw"`
|
||||||
DbMaxSize string `yaml:"dbMaxSize" json:"dbMaxSize" default:"500Mi"`
|
DbMaxSize string `yaml:"dbMaxSize" json:"dbMaxSize" default:"500Mi"`
|
||||||
|
|||||||
@@ -120,122 +120,122 @@ Example for overriding image names:
|
|||||||
|
|
||||||
## Configuration
|
## Configuration
|
||||||
|
|
||||||
| Parameter | Description | Default |
|
| Parameter | Description | Default |
|
||||||
|------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|-------------------------------------------|-----------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||||
| `tap.docker.registry` | Docker registry to pull from | `docker.io/kubeshark` |
|
| `tap.docker.registry` | Docker registry to pull from | `docker.io/kubeshark` |
|
||||||
| `tap.docker.tag` | Tag of the Docker images | `latest` |
|
| `tap.docker.tag` | Tag of the Docker images | `latest` |
|
||||||
| `tap.docker.tagLocked` | Lock the Docker image tags to prevent automatic upgrades to the latest branch image version. | `true` |
|
| `tap.docker.tagLocked` | Lock the Docker image tags to prevent automatic upgrades to the latest branch image version. | `true` |
|
||||||
| `tap.docker.tagLocked` | If `false` - use latest minor tag | `true` |
|
| `tap.docker.tagLocked` | If `false` - use latest minor tag | `true` |
|
||||||
| `tap.docker.imagePullPolicy` | Kubernetes image pull policy | `Always` |
|
| `tap.docker.imagePullPolicy` | Kubernetes image pull policy | `Always` |
|
||||||
| `tap.docker.imagePullSecrets` | Kubernetes secrets to pull the images | `[]` |
|
| `tap.docker.imagePullSecrets` | Kubernetes secrets to pull the images | `[]` |
|
||||||
| `tap.docker.overrideImage` | Can be used to directly override image names | `""` |
|
| `tap.docker.overrideImage` | Can be used to directly override image names | `""` |
|
||||||
| `tap.docker.overrideTag` | Can be used to override image tags | `""` |
|
| `tap.docker.overrideTag` | Can be used to override image tags | `""` |
|
||||||
| `tap.proxy.hub.srvPort` | Hub server port. Change if already occupied. | `8898` |
|
| `tap.proxy.hub.srvPort` | Hub server port. Change if already occupied. | `8898` |
|
||||||
| `tap.proxy.worker.srvPort` | Worker server port. Change if already occupied. | `48999` |
|
| `tap.proxy.worker.srvPort` | Worker server port. Change if already occupied.| `48999` |
|
||||||
| `tap.proxy.front.port` | Front service port. Change if already occupied. | `8899` |
|
| `tap.proxy.front.port` | Front service port. Change if already occupied.| `8899` |
|
||||||
| `tap.proxy.host` | Change to 0.0.0.0 top open up to the world. | `127.0.0.1` |
|
| `tap.proxy.host` | Change to 0.0.0.0 top open up to the world. | `127.0.0.1` |
|
||||||
| `tap.regex` | Target (process traffic from) pods that match regex | `.*` |
|
| `tap.regex` | Target (process traffic from) pods that match regex | `.*` |
|
||||||
| `tap.namespaces` | Target pods in namespaces | `[]` |
|
| `tap.namespaces` | Target pods in namespaces | `[]` |
|
||||||
| `tap.excludedNamespaces` | Exclude pods in namespaces | `[]` |
|
| `tap.excludedNamespaces` | Exclude pods in namespaces | `[]` |
|
||||||
| `tap.bpfOverride` | When using AF_PACKET as a traffic capture backend, override any existing pod targeting rules and set explicit BPF expression (e.g. `net 0.0.0.0/0`). | `[]` |
|
| `tap.bpfOverride` | When using AF_PACKET as a traffic capture backend, override any existing pod targeting rules and set explicit BPF expression (e.g. `net 0.0.0.0/0`). | `[]` |
|
||||||
| `tap.capture.stopped` | Set to `false` to have traffic processing start automatically. When set to `true`, traffic processing is stopped by default, resulting in almost no resource consumption (e.g. Kubeshark is dormant). This property can be dynamically control via the dashboard. | `false` |
|
| `tap.capture.dissection.enabled` | Set to `true` to have L7 protocol dissection start automatically. When set to `false`, dissection is disabled by default. This property can be dynamically controlled via the dashboard. | `true` |
|
||||||
| `tap.capture.stopAfter` | Set to a duration (e.g. `30s`) to have traffic processing stop after no websocket activity between worker and hub. | `30s` |
|
| `tap.capture.dissection.stopAfter` | Set to a duration (e.g. `30s`) to have L7 dissection stop after no activity. | `5m` |
|
||||||
| `tap.capture.raw.enabled` | Enable raw capture of packets and syscalls to disk for offline analysis | `true` |
|
| `tap.capture.raw.enabled` | Enable raw capture of packets and syscalls to disk for offline analysis | `true` |
|
||||||
| `tap.capture.raw.storageSize` | Maximum storage size for raw capture files (supports K8s quantity format: `1Gi`, `500Mi`, etc.) | `1Gi` |
|
| `tap.capture.raw.storageSize` | Maximum storage size for raw capture files (supports K8s quantity format: `1Gi`, `500Mi`, etc.) | `1Gi` |
|
||||||
| `tap.capture.dbMaxSize` | Maximum size for capture database (e.g., `4Gi`, `2000Mi`). When empty, automatically uses 80% of allocated storage (`tap.storageLimit`). | `""` |
|
| `tap.capture.dbMaxSize` | Maximum size for capture database (e.g., `4Gi`, `2000Mi`). When empty, automatically uses 80% of allocated storage (`tap.storageLimit`). | `""` |
|
||||||
| `tap.snapshots.storageClass` | Storage class for snapshots volume. When empty, uses `emptyDir`. When set, creates a PVC with this storage class | `""` |
|
| `tap.snapshots.storageClass` | Storage class for snapshots volume. When empty, uses `emptyDir`. When set, creates a PVC with this storage class | `""` |
|
||||||
| `tap.snapshots.storageSize` | Storage size for snapshots volume (supports K8s quantity format: `1Gi`, `500Mi`, etc.) | `10Gi` |
|
| `tap.snapshots.storageSize` | Storage size for snapshots volume (supports K8s quantity format: `1Gi`, `500Mi`, etc.) | `10Gi` |
|
||||||
| `tap.release.repo` | URL of the Helm chart repository | `https://helm.kubeshark.com` |
|
| `tap.release.repo` | URL of the Helm chart repository | `https://helm.kubeshark.com` |
|
||||||
| `tap.release.name` | Helm release name | `kubeshark` |
|
| `tap.release.name` | Helm release name | `kubeshark` |
|
||||||
| `tap.release.namespace` | Helm release namespace | `default` |
|
| `tap.release.namespace` | Helm release namespace | `default` |
|
||||||
| `tap.persistentStorage` | Use `persistentVolumeClaim` instead of `emptyDir` | `false` |
|
| `tap.persistentStorage` | Use `persistentVolumeClaim` instead of `emptyDir` | `false` |
|
||||||
| `tap.persistentStorageStatic` | Use static persistent volume provisioning (explicitly defined `PersistentVolume` ) | `false` |
|
| `tap.persistentStorageStatic` | Use static persistent volume provisioning (explicitly defined `PersistentVolume` ) | `false` |
|
||||||
| `tap.persistentStoragePvcVolumeMode` | Set the pvc volume mode (Filesystem\|Block) | `Filesystem` |
|
| `tap.persistentStoragePvcVolumeMode` | Set the pvc volume mode (Filesystem\|Block) | `Filesystem` |
|
||||||
| `tap.efsFileSytemIdAndPath` | [EFS file system ID and, optionally, subpath and/or access point](https://github.com/kubernetes-sigs/aws-efs-csi-driver/blob/master/examples/kubernetes/access_points/README.md) `<FileSystemId>:<Path>:<AccessPointId>` | "" |
|
| `tap.efsFileSytemIdAndPath` | [EFS file system ID and, optionally, subpath and/or access point](https://github.com/kubernetes-sigs/aws-efs-csi-driver/blob/master/examples/kubernetes/access_points/README.md) `<FileSystemId>:<Path>:<AccessPointId>` | "" |
|
||||||
| `tap.storageLimit` | Limit of either the `emptyDir` or `persistentVolumeClaim` | `5Gi` |
|
| `tap.storageLimit` | Limit of either the `emptyDir` or `persistentVolumeClaim` | `5Gi` |
|
||||||
| `tap.storageClass` | Storage class of the `PersistentVolumeClaim` | `standard` |
|
| `tap.storageClass` | Storage class of the `PersistentVolumeClaim` | `standard` |
|
||||||
| `tap.dryRun` | Preview of all pods matching the regex, without tapping them | `false` |
|
| `tap.dryRun` | Preview of all pods matching the regex, without tapping them | `false` |
|
||||||
| `tap.dnsConfig.nameservers` | Nameservers to use for DNS resolution | `[]` |
|
| `tap.dnsConfig.nameservers` | Nameservers to use for DNS resolution | `[]` |
|
||||||
| `tap.dnsConfig.searches` | Search domains to use for DNS resolution | `[]` |
|
| `tap.dnsConfig.searches` | Search domains to use for DNS resolution | `[]` |
|
||||||
| `tap.dnsConfig.options` | DNS options to use for DNS resolution | `[]` |
|
| `tap.dnsConfig.options` | DNS options to use for DNS resolution | `[]` |
|
||||||
| `tap.resources.hub.limits.cpu` | CPU limit for hub | `""` (no limit) |
|
| `tap.resources.hub.limits.cpu` | CPU limit for hub | `""` (no limit) |
|
||||||
| `tap.resources.hub.limits.memory` | Memory limit for hub | `5Gi` |
|
| `tap.resources.hub.limits.memory` | Memory limit for hub | `5Gi` |
|
||||||
| `tap.resources.hub.requests.cpu` | CPU request for hub | `50m` |
|
| `tap.resources.hub.requests.cpu` | CPU request for hub | `50m` |
|
||||||
| `tap.resources.hub.requests.memory` | Memory request for hub | `50Mi` |
|
| `tap.resources.hub.requests.memory` | Memory request for hub | `50Mi` |
|
||||||
| `tap.resources.sniffer.limits.cpu` | CPU limit for sniffer | `""` (no limit) |
|
| `tap.resources.sniffer.limits.cpu` | CPU limit for sniffer | `""` (no limit) |
|
||||||
| `tap.resources.sniffer.limits.memory` | Memory limit for sniffer | `3Gi` |
|
| `tap.resources.sniffer.limits.memory` | Memory limit for sniffer | `3Gi` |
|
||||||
| `tap.resources.sniffer.requests.cpu` | CPU request for sniffer | `50m` |
|
| `tap.resources.sniffer.requests.cpu` | CPU request for sniffer | `50m` |
|
||||||
| `tap.resources.sniffer.requests.memory` | Memory request for sniffer | `50Mi` |
|
| `tap.resources.sniffer.requests.memory` | Memory request for sniffer | `50Mi` |
|
||||||
| `tap.resources.tracer.limits.cpu` | CPU limit for tracer | `""` (no limit) |
|
| `tap.resources.tracer.limits.cpu` | CPU limit for tracer | `""` (no limit) |
|
||||||
| `tap.resources.tracer.limits.memory` | Memory limit for tracer | `3Gi` |
|
| `tap.resources.tracer.limits.memory` | Memory limit for tracer | `3Gi` |
|
||||||
| `tap.resources.tracer.requests.cpu` | CPU request for tracer | `50m` |
|
| `tap.resources.tracer.requests.cpu` | CPU request for tracer | `50m` |
|
||||||
| `tap.resources.tracer.requests.memory` | Memory request for tracer | `50Mi` |
|
| `tap.resources.tracer.requests.memory` | Memory request for tracer | `50Mi` |
|
||||||
| `tap.probes.hub.initialDelaySeconds` | Initial delay before probing the hub | `15` |
|
| `tap.probes.hub.initialDelaySeconds` | Initial delay before probing the hub | `15` |
|
||||||
| `tap.probes.hub.periodSeconds` | Period between probes for the hub | `10` |
|
| `tap.probes.hub.periodSeconds` | Period between probes for the hub | `10` |
|
||||||
| `tap.probes.hub.successThreshold` | Number of successful probes before considering the hub healthy | `1` |
|
| `tap.probes.hub.successThreshold` | Number of successful probes before considering the hub healthy | `1` |
|
||||||
| `tap.probes.hub.failureThreshold` | Number of failed probes before considering the hub unhealthy | `3` |
|
| `tap.probes.hub.failureThreshold` | Number of failed probes before considering the hub unhealthy | `3` |
|
||||||
| `tap.probes.sniffer.initialDelaySeconds` | Initial delay before probing the sniffer | `15` |
|
| `tap.probes.sniffer.initialDelaySeconds` | Initial delay before probing the sniffer | `15` |
|
||||||
| `tap.probes.sniffer.periodSeconds` | Period between probes for the sniffer | `10` |
|
| `tap.probes.sniffer.periodSeconds` | Period between probes for the sniffer | `10` |
|
||||||
| `tap.probes.sniffer.successThreshold` | Number of successful probes before considering the sniffer healthy | `1` |
|
| `tap.probes.sniffer.successThreshold` | Number of successful probes before considering the sniffer healthy | `1` |
|
||||||
| `tap.probes.sniffer.failureThreshold` | Number of failed probes before considering the sniffer unhealthy | `3` |
|
| `tap.probes.sniffer.failureThreshold` | Number of failed probes before considering the sniffer unhealthy | `3` |
|
||||||
| `tap.serviceMesh` | Capture traffic from service meshes like Istio, Linkerd, Consul, etc. | `true` |
|
| `tap.serviceMesh` | Capture traffic from service meshes like Istio, Linkerd, Consul, etc. | `true` |
|
||||||
| `tap.tls` | Capture the encrypted/TLS traffic from cryptography libraries like OpenSSL | `true` |
|
| `tap.tls` | Capture the encrypted/TLS traffic from cryptography libraries like OpenSSL | `true` |
|
||||||
| `tap.disableTlsLog` | Suppress logging for TLS/eBPF | `true` |
|
| `tap.disableTlsLog` | Suppress logging for TLS/eBPF | `true` |
|
||||||
| `tap.labels` | Kubernetes labels to apply to all Kubeshark resources | `{}` |
|
| `tap.labels` | Kubernetes labels to apply to all Kubeshark resources | `{}` |
|
||||||
| `tap.annotations` | Kubernetes annotations to apply to all Kubeshark resources | `{}` |
|
| `tap.annotations` | Kubernetes annotations to apply to all Kubeshark resources | `{}` |
|
||||||
| `tap.nodeSelectorTerms.workers` | Node selector terms for workers components | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
| `tap.nodeSelectorTerms.workers` | Node selector terms for workers components | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
||||||
| `tap.nodeSelectorTerms.hub` | Node selector terms for hub component | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
| `tap.nodeSelectorTerms.hub` | Node selector terms for hub component | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
||||||
| `tap.nodeSelectorTerms.front` | Node selector terms for front-end component | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
| `tap.nodeSelectorTerms.front` | Node selector terms for front-end component | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
||||||
| `tap.priorityClass` | Priority class name for Kubeshark components | `""` |
|
| `tap.priorityClass` | Priority class name for Kubeshark components | `""` |
|
||||||
| `tap.tolerations.workers` | Tolerations for workers components | `[ {"operator": "Exists", "effect": "NoExecute"}` |
|
| `tap.tolerations.workers` | Tolerations for workers components | `[ {"operator": "Exists", "effect": "NoExecute"}` |
|
||||||
| `tap.tolerations.hub` | Tolerations for hub component | `[]` |
|
| `tap.tolerations.hub` | Tolerations for hub component | `[]` |
|
||||||
| `tap.tolerations.front` | Tolerations for front-end component | `[]` |
|
| `tap.tolerations.front` | Tolerations for front-end component | `[]` |
|
||||||
| `tap.auth.enabled` | Enable authentication | `false` |
|
| `tap.auth.enabled` | Enable authentication | `false` |
|
||||||
| `tap.auth.type` | Authentication type (1 option available: `saml`) | `saml` |
|
| `tap.auth.type` | Authentication type (1 option available: `saml`) | `saml` |
|
||||||
| `tap.auth.approvedEmails` | List of approved email addresses for authentication | `[]` |
|
| `tap.auth.approvedEmails` | List of approved email addresses for authentication | `[]` |
|
||||||
| `tap.auth.approvedDomains` | List of approved email domains for authentication | `[]` |
|
| `tap.auth.approvedDomains` | List of approved email domains for authentication | `[]` |
|
||||||
| `tap.auth.saml.idpMetadataUrl` | SAML IDP metadata URL <br/>(effective, if `tap.auth.type = saml`) | `` |
|
| `tap.auth.saml.idpMetadataUrl` | SAML IDP metadata URL <br/>(effective, if `tap.auth.type = saml`) | `` |
|
||||||
| `tap.auth.saml.x509crt` | A self-signed X.509 `.cert` contents <br/>(effective, if `tap.auth.type = saml`) | `` |
|
| `tap.auth.saml.x509crt` | A self-signed X.509 `.cert` contents <br/>(effective, if `tap.auth.type = saml`) | `` |
|
||||||
| `tap.auth.saml.x509key` | A self-signed X.509 `.key` contents <br/>(effective, if `tap.auth.type = saml`) | `` |
|
| `tap.auth.saml.x509key` | A self-signed X.509 `.key` contents <br/>(effective, if `tap.auth.type = saml`) | `` |
|
||||||
| `tap.auth.saml.roleAttribute` | A SAML attribute name corresponding to user's authorization role <br/>(effective, if `tap.auth.type = saml`) | `role` |
|
| `tap.auth.saml.roleAttribute` | A SAML attribute name corresponding to user's authorization role <br/>(effective, if `tap.auth.type = saml`) | `role` |
|
||||||
| `tap.auth.saml.roles` | A list of SAML authorization roles and their permissions <br/>(effective, if `tap.auth.type = saml`) | `{"admin":{"canDownloadPCAP":true,"canUpdateTargetedPods":true,"canUseScripting":true, "scriptingPermissions":{"canSave":true, "canActivate":true, "canDelete":true}, "canStopTrafficCapturing":true, "filter":"","showAdminConsoleLink":true}}` |
|
| `tap.auth.saml.roles` | A list of SAML authorization roles and their permissions <br/>(effective, if `tap.auth.type = saml`) | `{"admin":{"canDownloadPCAP":true,"canUpdateTargetedPods":true,"canUseScripting":true, "scriptingPermissions":{"canSave":true, "canActivate":true, "canDelete":true}, "canStopTrafficCapturing":true, "canControlDissection":true, "filter":"","showAdminConsoleLink":true}}` |
|
||||||
| `tap.ingress.enabled` | Enable `Ingress` | `false` |
|
| `tap.ingress.enabled` | Enable `Ingress` | `false` |
|
||||||
| `tap.ingress.className` | Ingress class name | `""` |
|
| `tap.ingress.className` | Ingress class name | `""` |
|
||||||
| `tap.ingress.host` | Host of the `Ingress` | `ks.svc.cluster.local` |
|
| `tap.ingress.host` | Host of the `Ingress` | `ks.svc.cluster.local` |
|
||||||
| `tap.ingress.tls` | `Ingress` TLS configuration | `[]` |
|
| `tap.ingress.tls` | `Ingress` TLS configuration | `[]` |
|
||||||
| `tap.ingress.annotations` | `Ingress` annotations | `{}` |
|
| `tap.ingress.annotations` | `Ingress` annotations | `{}` |
|
||||||
| `tap.routing.front.basePath` | Set this value to serve `front` under specific base path. Example: `/custompath` (forward slash must be present) | `""` |
|
| `tap.routing.front.basePath` | Set this value to serve `front` under specific base path. Example: `/custompath` (forward slash must be present) | `""` |
|
||||||
| `tap.ipv6` | Enable IPv6 support for the front-end | `true` |
|
| `tap.ipv6` | Enable IPv6 support for the front-end | `true` |
|
||||||
| `tap.debug` | Enable debug mode | `false` |
|
| `tap.debug` | Enable debug mode | `false` |
|
||||||
| `tap.telemetry.enabled` | Enable anonymous usage statistics collection | `true` |
|
| `tap.telemetry.enabled` | Enable anonymous usage statistics collection | `true` |
|
||||||
| `tap.resourceGuard.enabled` | Enable resource guard worker process, which watches RAM/disk usage and enables/disables traffic capture based on available resources | `false` |
|
| `tap.resourceGuard.enabled` | Enable resource guard worker process, which watches RAM/disk usage and enables/disables traffic capture based on available resources | `false` |
|
||||||
| `tap.secrets` | List of secrets to be used as source for environment variables (e.g. `kubeshark-license`) | `[]` |
|
| `tap.secrets` | List of secrets to be used as source for environment variables (e.g. `kubeshark-license`) | `[]` |
|
||||||
| `tap.sentry.enabled` | Enable sending of error logs to Sentry | `true` (only for qualified users) |
|
| `tap.sentry.enabled` | Enable sending of error logs to Sentry | `true` (only for qualified users) |
|
||||||
| `tap.sentry.environment` | Sentry environment to label error logs with | `production` |
|
| `tap.sentry.environment` | Sentry environment to label error logs with | `production` |
|
||||||
| `tap.defaultFilter` | Sets the default dashboard KFL filter (e.g. `http`). By default, this value is set to filter out noisy protocols such as DNS, UDP, ICMP and TCP. The user can easily change this, **temporarily**, in the Dashboard. For a permanent change, you should change this value in the `values.yaml` or `config.yaml` file. | `""` |
|
| `tap.defaultFilter` | Sets the default dashboard KFL filter (e.g. `http`). By default, this value is set to filter out noisy protocols such as DNS, UDP, ICMP and TCP. The user can easily change this, **temporarily**, in the Dashboard. For a permanent change, you should change this value in the `values.yaml` or `config.yaml` file. | `""` |
|
||||||
| `tap.liveConfigMapChangesDisabled` | If set to `true`, all user functionality (scripting, targeting settings, global & default KFL modification, traffic recording, traffic capturing on/off, protocol dissectors) involving dynamic ConfigMap changes from UI will be disabled | `false` |
|
| `tap.liveConfigMapChangesDisabled` | If set to `true`, all user functionality (scripting, targeting settings, global & default KFL modification, traffic recording, traffic capturing on/off, protocol dissectors) involving dynamic ConfigMap changes from UI will be disabled | `false` |
|
||||||
| `tap.globalFilter` | Prepends to any KFL filter and can be used to limit what is visible in the dashboard. For example, `redact("request.headers.Authorization")` will redact the appropriate field. Another example `!dns` will not show any DNS traffic. | `""` |
|
| `tap.globalFilter` | Prepends to any KFL filter and can be used to limit what is visible in the dashboard. For example, `redact("request.headers.Authorization")` will redact the appropriate field. Another example `!dns` will not show any DNS traffic. | `""` |
|
||||||
| `tap.metrics.port` | Pod port used to expose Prometheus metrics | `49100` |
|
| `tap.metrics.port` | Pod port used to expose Prometheus metrics | `49100` |
|
||||||
| `tap.enabledDissectors` | This is an array of strings representing the list of supported protocols. Remove or comment out redundant protocols (e.g., dns). | The default list excludes: `udp` and `tcp` |
|
| `tap.enabledDissectors` | This is an array of strings representing the list of supported protocols. Remove or comment out redundant protocols (e.g., dns).| The default list excludes: `udp` and `tcp` |
|
||||||
| `tap.mountBpf` | BPF filesystem needs to be mounted for eBPF to work properly. This helm value determines whether Kubeshark will attempt to mount the filesystem. This option is not required if filesystem is already mounts. │ `true` |
|
| `tap.mountBpf` | BPF filesystem needs to be mounted for eBPF to work properly. This helm value determines whether Kubeshark will attempt to mount the filesystem. This option is not required if filesystem is already mounts. │ `true`|
|
||||||
| `tap.hostNetwork` | Enable host network mode for worker DaemonSet pods. When enabled, worker pods use the host's network namespace for direct network access. | `true` |
|
| `tap.hostNetwork` | Enable host network mode for worker DaemonSet pods. When enabled, worker pods use the host's network namespace for direct network access. | `true` |
|
||||||
| `tap.gitops.enabled` | Enable GitOps functionality. This will allow you to use GitOps to manage your Kubeshark configuration. | `false` |
|
| `tap.gitops.enabled` | Enable GitOps functionality. This will allow you to use GitOps to manage your Kubeshark configuration. | `false` |
|
||||||
| `logs.file` | Logs dump path | `""` |
|
| `logs.file` | Logs dump path | `""` |
|
||||||
| `pcapdump.enabled` | Enable recording of all traffic captured according to other parameters. Whatever Kubeshark captures, considering pod targeting rules, will be stored in pcap files ready to be viewed by tools | `false` |
|
| `pcapdump.enabled` | Enable recording of all traffic captured according to other parameters. Whatever Kubeshark captures, considering pod targeting rules, will be stored in pcap files ready to be viewed by tools | `false` |
|
||||||
| `pcapdump.maxTime` | The time window into the past that will be stored. Older traffic will be discarded. | `2h` |
|
| `pcapdump.maxTime` | The time window into the past that will be stored. Older traffic will be discarded. | `2h` |
|
||||||
| `pcapdump.maxSize` | The maximum storage size the PCAP files will consume. Old files that cause to surpass storage consumption will get discarded. | `500MB` |
|
| `pcapdump.maxSize` | The maximum storage size the PCAP files will consume. Old files that cause to surpass storage consumption will get discarded. | `500MB` |
|
||||||
| `kube.configPath` | Path to the `kubeconfig` file (`$HOME/.kube/config`) | `""` |
|
| `kube.configPath` | Path to the `kubeconfig` file (`$HOME/.kube/config`) | `""` |
|
||||||
| `kube.context` | Kubernetes context to use for the deployment | `""` |
|
| `kube.context` | Kubernetes context to use for the deployment | `""` |
|
||||||
| `dumpLogs` | Enable dumping of logs | `false` |
|
| `dumpLogs` | Enable dumping of logs | `false` |
|
||||||
| `headless` | Enable running in headless mode | `false` |
|
| `headless` | Enable running in headless mode | `false` |
|
||||||
| `license` | License key for the Pro/Enterprise edition | `""` |
|
| `license` | License key for the Pro/Enterprise edition | `""` |
|
||||||
| `scripting.enabled` | Enables scripting | `false` |
|
| `scripting.enabled` | Enables scripting | `false` |
|
||||||
| `scripting.env` | Environment variables for the scripting | `{}` |
|
| `scripting.env` | Environment variables for the scripting | `{}` |
|
||||||
| `scripting.source` | Source directory of the scripts | `""` |
|
| `scripting.source` | Source directory of the scripts | `""` |
|
||||||
| `scripting.watchScripts` | Enable watch mode for the scripts in source directory | `true` |
|
| `scripting.watchScripts` | Enable watch mode for the scripts in source directory | `true` |
|
||||||
| `timezone` | IANA time zone applied to time shown in the front-end | `""` (local time zone applies) |
|
| `timezone` | IANA time zone applied to time shown in the front-end | `""` (local time zone applies) |
|
||||||
| `supportChatEnabled` | Enable real-time support chat channel based on Intercom | `false` |
|
| `supportChatEnabled` | Enable real-time support chat channel based on Intercom | `false` |
|
||||||
| `internetConnectivity` | Turns off API requests that are dependent on Internet connectivity such as `telemetry` and `online-support`. | `true` |
|
| `internetConnectivity` | Turns off API requests that are dependent on Internet connectivity such as `telemetry` and `online-support`. | `true` |
|
||||||
|
|
||||||
KernelMapping pairs kernel versions with a
|
KernelMapping pairs kernel versions with a
|
||||||
DriverContainer image. Kernel versions can be matched
|
DriverContainer image. Kernel versions can be matched
|
||||||
|
|||||||
@@ -37,7 +37,7 @@ spec:
|
|||||||
- -loglevel
|
- -loglevel
|
||||||
- '{{ .Values.logLevel | default "warning" }}'
|
- '{{ .Values.logLevel | default "warning" }}'
|
||||||
- -capture-stop-after
|
- -capture-stop-after
|
||||||
- "{{ if hasKey .Values.tap.capture "stopAfter" }}{{ .Values.tap.capture.stopAfter }}{{ else }}5m{{ end }}"
|
- "{{ if hasKey .Values.tap.capture.dissection "stopAfter" }}{{ .Values.tap.capture.dissection.stopAfter }}{{ else }}5m{{ end }}"
|
||||||
- -snapshot-size-limit
|
- -snapshot-size-limit
|
||||||
- '{{ .Values.tap.snapshots.storageSize }}'
|
- '{{ .Values.tap.snapshots.storageSize }}'
|
||||||
{{- if .Values.tap.delayedDissection.image }}
|
{{- if .Values.tap.delayedDissection.image }}
|
||||||
|
|||||||
@@ -72,11 +72,13 @@ spec:
|
|||||||
value: '{{ eq .Values.tap.packetCapture "af_packet" | ternary "false" "true" }}'
|
value: '{{ eq .Values.tap.packetCapture "af_packet" | ternary "false" "true" }}'
|
||||||
- name: REACT_APP_RECORDING_DISABLED
|
- name: REACT_APP_RECORDING_DISABLED
|
||||||
value: '{{ .Values.tap.liveConfigMapChangesDisabled }}'
|
value: '{{ .Values.tap.liveConfigMapChangesDisabled }}'
|
||||||
- name: REACT_APP_STOP_TRAFFIC_CAPTURING_DISABLED
|
- name: REACT_APP_DISSECTION_ENABLED
|
||||||
value: '{{- if and .Values.tap.liveConfigMapChangesDisabled .Values.tap.capture.stopped -}}
|
value: '{{ .Values.tap.capture.dissection.enabled | ternary "true" "false" }}'
|
||||||
false
|
- name: REACT_APP_DISSECTION_CONTROL_ENABLED
|
||||||
|
value: '{{- if and .Values.tap.liveConfigMapChangesDisabled (not .Values.tap.capture.dissection.enabled) -}}
|
||||||
|
true
|
||||||
{{- else -}}
|
{{- else -}}
|
||||||
{{ .Values.tap.liveConfigMapChangesDisabled | ternary "true" "false" }}
|
{{ not .Values.tap.liveConfigMapChangesDisabled | ternary "true" "false" }}
|
||||||
{{- end -}}'
|
{{- end -}}'
|
||||||
- name: 'REACT_APP_CLOUD_LICENSE_ENABLED'
|
- name: 'REACT_APP_CLOUD_LICENSE_ENABLED'
|
||||||
value: '{{- if or (and .Values.cloudLicenseEnabled (not (empty .Values.license))) (not .Values.internetConnectivity) -}}
|
value: '{{- if or (and .Values.cloudLicenseEnabled (not (empty .Values.license))) (not .Values.internetConnectivity) -}}
|
||||||
|
|||||||
@@ -11,7 +11,7 @@ data:
|
|||||||
NAMESPACES: '{{ gt (len .Values.tap.namespaces) 0 | ternary (join "," .Values.tap.namespaces) "" }}'
|
NAMESPACES: '{{ gt (len .Values.tap.namespaces) 0 | ternary (join "," .Values.tap.namespaces) "" }}'
|
||||||
EXCLUDED_NAMESPACES: '{{ gt (len .Values.tap.excludedNamespaces) 0 | ternary (join "," .Values.tap.excludedNamespaces) "" }}'
|
EXCLUDED_NAMESPACES: '{{ gt (len .Values.tap.excludedNamespaces) 0 | ternary (join "," .Values.tap.excludedNamespaces) "" }}'
|
||||||
BPF_OVERRIDE: '{{ .Values.tap.bpfOverride }}'
|
BPF_OVERRIDE: '{{ .Values.tap.bpfOverride }}'
|
||||||
STOPPED: '{{ .Values.tap.capture.stopped | ternary "true" "false" }}'
|
DISSECTION_ENABLED: '{{ .Values.tap.capture.dissection.enabled | ternary "true" "false" }}'
|
||||||
CAPTURE_SELF: '{{ .Values.tap.capture.captureSelf | ternary "true" "false" }}'
|
CAPTURE_SELF: '{{ .Values.tap.capture.captureSelf | ternary "true" "false" }}'
|
||||||
SCRIPTING_SCRIPTS: '{}'
|
SCRIPTING_SCRIPTS: '{}'
|
||||||
SCRIPTING_ACTIVE_SCRIPTS: '{{ gt (len .Values.scripting.active) 0 | ternary (join "," .Values.scripting.active) "" }}'
|
SCRIPTING_ACTIVE_SCRIPTS: '{{ gt (len .Values.scripting.active) 0 | ternary (join "," .Values.scripting.active) "" }}'
|
||||||
@@ -56,11 +56,11 @@ data:
|
|||||||
TARGETED_PODS_UPDATE_DISABLED: '{{ .Values.tap.liveConfigMapChangesDisabled | ternary "true" "" }}'
|
TARGETED_PODS_UPDATE_DISABLED: '{{ .Values.tap.liveConfigMapChangesDisabled | ternary "true" "" }}'
|
||||||
PRESET_FILTERS_CHANGING_ENABLED: '{{ .Values.tap.liveConfigMapChangesDisabled | ternary "false" "true" }}'
|
PRESET_FILTERS_CHANGING_ENABLED: '{{ .Values.tap.liveConfigMapChangesDisabled | ternary "false" "true" }}'
|
||||||
RECORDING_DISABLED: '{{ .Values.tap.liveConfigMapChangesDisabled | ternary "true" "" }}'
|
RECORDING_DISABLED: '{{ .Values.tap.liveConfigMapChangesDisabled | ternary "true" "" }}'
|
||||||
STOP_TRAFFIC_CAPTURING_DISABLED: '{{- if and .Values.tap.liveConfigMapChangesDisabled .Values.tap.capture.stopped -}}
|
DISSECTION_CONTROL_ENABLED: '{{- if and .Values.tap.liveConfigMapChangesDisabled (not .Values.tap.capture.dissection.enabled) -}}
|
||||||
false
|
true
|
||||||
{{- else -}}
|
{{- else -}}
|
||||||
{{ .Values.tap.liveConfigMapChangesDisabled | ternary "true" "false" }}
|
{{ not .Values.tap.liveConfigMapChangesDisabled | ternary "true" "false" }}
|
||||||
{{- end }}'
|
{{- end }}'
|
||||||
GLOBAL_FILTER: {{ include "kubeshark.escapeDoubleQuotes" .Values.tap.globalFilter | quote }}
|
GLOBAL_FILTER: {{ include "kubeshark.escapeDoubleQuotes" .Values.tap.globalFilter | quote }}
|
||||||
DEFAULT_FILTER: {{ include "kubeshark.escapeDoubleQuotes" .Values.tap.defaultFilter | quote }}
|
DEFAULT_FILTER: {{ include "kubeshark.escapeDoubleQuotes" .Values.tap.defaultFilter | quote }}
|
||||||
TRAFFIC_SAMPLE_RATE: '{{ .Values.tap.misc.trafficSampleRate }}'
|
TRAFFIC_SAMPLE_RATE: '{{ .Values.tap.misc.trafficSampleRate }}'
|
||||||
@@ -83,5 +83,5 @@ data:
|
|||||||
PCAP_MAX_TIME: '{{ .Values.pcapdump.maxTime }}'
|
PCAP_MAX_TIME: '{{ .Values.pcapdump.maxTime }}'
|
||||||
PCAP_MAX_SIZE: '{{ .Values.pcapdump.maxSize }}'
|
PCAP_MAX_SIZE: '{{ .Values.pcapdump.maxSize }}'
|
||||||
PORT_MAPPING: '{{ toJson .Values.tap.portMapping }}'
|
PORT_MAPPING: '{{ toJson .Values.tap.portMapping }}'
|
||||||
RAW_CAPTURE: '{{ .Values.tap.capture.raw.enabled | ternary "true" "false" }}'
|
RAW_CAPTURE_ENABLED: '{{ .Values.tap.capture.raw.enabled | ternary "true" "false" }}'
|
||||||
RAW_CAPTURE_STORAGE_SIZE: '{{ .Values.tap.capture.raw.storageSize }}'
|
RAW_CAPTURE_STORAGE_SIZE: '{{ .Values.tap.capture.raw.storageSize }}'
|
||||||
|
|||||||
@@ -26,8 +26,9 @@ tap:
|
|||||||
excludedNamespaces: []
|
excludedNamespaces: []
|
||||||
bpfOverride: ""
|
bpfOverride: ""
|
||||||
capture:
|
capture:
|
||||||
stopped: false
|
dissection:
|
||||||
stopAfter: 5m
|
enabled: true
|
||||||
|
stopAfter: 5m
|
||||||
captureSelf: false
|
captureSelf: false
|
||||||
raw:
|
raw:
|
||||||
enabled: true
|
enabled: true
|
||||||
@@ -145,6 +146,7 @@ tap:
|
|||||||
canDelete: true
|
canDelete: true
|
||||||
canUpdateTargetedPods: true
|
canUpdateTargetedPods: true
|
||||||
canStopTrafficCapturing: true
|
canStopTrafficCapturing: true
|
||||||
|
canControlDissection: true
|
||||||
showAdminConsoleLink: true
|
showAdminConsoleLink: true
|
||||||
ingress:
|
ingress:
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|||||||
@@ -256,7 +256,7 @@ data:
|
|||||||
NAMESPACES: ''
|
NAMESPACES: ''
|
||||||
EXCLUDED_NAMESPACES: ''
|
EXCLUDED_NAMESPACES: ''
|
||||||
BPF_OVERRIDE: ''
|
BPF_OVERRIDE: ''
|
||||||
STOPPED: 'false'
|
DISSECTION_ENABLED: 'true'
|
||||||
SCRIPTING_SCRIPTS: '{}'
|
SCRIPTING_SCRIPTS: '{}'
|
||||||
SCRIPTING_ACTIVE_SCRIPTS: ''
|
SCRIPTING_ACTIVE_SCRIPTS: ''
|
||||||
INGRESS_ENABLED: 'false'
|
INGRESS_ENABLED: 'false'
|
||||||
@@ -276,7 +276,7 @@ data:
|
|||||||
TARGETED_PODS_UPDATE_DISABLED: ''
|
TARGETED_PODS_UPDATE_DISABLED: ''
|
||||||
PRESET_FILTERS_CHANGING_ENABLED: 'true'
|
PRESET_FILTERS_CHANGING_ENABLED: 'true'
|
||||||
RECORDING_DISABLED: ''
|
RECORDING_DISABLED: ''
|
||||||
STOP_TRAFFIC_CAPTURING_DISABLED: 'false'
|
DISSECTION_CONTROL_ENABLED: 'true'
|
||||||
GLOBAL_FILTER: ""
|
GLOBAL_FILTER: ""
|
||||||
DEFAULT_FILTER: ""
|
DEFAULT_FILTER: ""
|
||||||
TRAFFIC_SAMPLE_RATE: '100'
|
TRAFFIC_SAMPLE_RATE: '100'
|
||||||
@@ -296,7 +296,7 @@ data:
|
|||||||
PCAP_MAX_TIME: '1h'
|
PCAP_MAX_TIME: '1h'
|
||||||
PCAP_MAX_SIZE: '500MB'
|
PCAP_MAX_SIZE: '500MB'
|
||||||
PORT_MAPPING: '{"amqp":[5671,5672],"diameter":[3868],"http":[80,443,8080],"kafka":[9092],"ldap":[389],"redis":[6379]}'
|
PORT_MAPPING: '{"amqp":[5671,5672],"diameter":[3868],"http":[80,443,8080],"kafka":[9092],"ldap":[389],"redis":[6379]}'
|
||||||
RAW_CAPTURE: 'true'
|
RAW_CAPTURE_ENABLED: 'true'
|
||||||
RAW_CAPTURE_STORAGE_SIZE: '1Gi'
|
RAW_CAPTURE_STORAGE_SIZE: '1Gi'
|
||||||
---
|
---
|
||||||
# Source: kubeshark/templates/02-cluster-role.yaml
|
# Source: kubeshark/templates/02-cluster-role.yaml
|
||||||
@@ -953,8 +953,8 @@ spec:
|
|||||||
value: 'true'
|
value: 'true'
|
||||||
- name: REACT_APP_RECORDING_DISABLED
|
- name: REACT_APP_RECORDING_DISABLED
|
||||||
value: 'false'
|
value: 'false'
|
||||||
- name: REACT_APP_STOP_TRAFFIC_CAPTURING_DISABLED
|
- name: REACT_APP_DISSECTION_CONTROL_ENABLED
|
||||||
value: 'false'
|
value: 'true'
|
||||||
- name: 'REACT_APP_CLOUD_LICENSE_ENABLED'
|
- name: 'REACT_APP_CLOUD_LICENSE_ENABLED'
|
||||||
value: 'true'
|
value: 'true'
|
||||||
- name: 'REACT_APP_AI_ASSISTANT_ENABLED'
|
- name: 'REACT_APP_AI_ASSISTANT_ENABLED'
|
||||||
|
|||||||
Reference in New Issue
Block a user