Merge branch 'master' into dissection-storage

config/configStructs/tapConfig.go

@@ -354,8 +354,10 @@ type SnapshotsConfig struct {
 }
 
 type DelayedDissectionConfig struct {
-	CPU    string `yaml:"cpu" json:"cpu" default:"1"`
+	CPU          string `yaml:"cpu" json:"cpu" default:"1"`
-	Memory string `yaml:"memory" json:"memory" default:"4Gi"`
+	Memory       string `yaml:"memory" json:"memory" default:"4Gi"`
+	StorageSize  string `yaml:"storageSize" json:"storageSize" default:""`
+	StorageClass string `yaml:"storageClass" json:"storageClass" default:""`
 }
 
 type DissectionConfig struct {

helm-chart/README.md

@@ -164,6 +164,8 @@ Example for overriding image names:
 | `tap.snapshots.cloud.gcs.credentialsJson`         | Service account JSON key. When set, the chart auto-creates a Secret with `SNAPSHOT_GCS_CREDENTIALS_JSON`. | `""`                                                                                                                                                                                                                                             |
 | `tap.delayedDissection.cpu`                       | CPU allocation for delayed dissection jobs     | `1`                                                                                                                                                                                                                                              |
 | `tap.delayedDissection.memory`                    | Memory allocation for delayed dissection jobs  | `4Gi`                                                                                                                                                                                                                                            |
+| `tap.delayedDissection.storageSize`               | Storage size for dissection job PVC. When empty, falls back to `tap.snapshots.local.storageSize`. When the resolved value is non-empty, a PVC is created; otherwise an `emptyDir` is used. | `""`                                                                                                                                                                                                                                             |
+| `tap.delayedDissection.storageClass`              | Storage class for dissection job PVC. When empty, falls back to `tap.snapshots.local.storageClass`. | `""`                                                                                                                                                                                                                                             |
 | `tap.release.repo`                        | URL of the Helm chart repository              | `https://helm.kubeshark.com`                                                                                                                                                                                                                        |
 | `tap.release.name`                        | Helm release name                             | `kubeshark`                                                                                                                                                                                                                                      |
 | `tap.release.namespace`                   | Helm release namespace                        | `default`                                                                                                                                                                                                                                        |

helm-chart/templates/02-cluster-role.yaml

@@ -86,6 +86,15 @@ rules:
     verbs:
       - create
       - get
+  - apiGroups:
+      - ""
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - create
+      - get
+      - list
+      - delete
   - apiGroups:
       - batch
     resources:

helm-chart/templates/04-hub-deployment.yaml

@@ -56,6 +56,16 @@ spec:
             - -dissector-memory
             - '{{ .Values.tap.delayedDissection.memory }}'
             {{- end }}
+            {{- $dissectorStorageSize := .Values.tap.delayedDissection.storageSize | default .Values.tap.snapshots.local.storageSize }}
+            {{- if $dissectorStorageSize }}
+            - -dissector-storage-size
+            - '{{ $dissectorStorageSize }}'
+            {{- end }}
+            {{- $dissectorStorageClass := .Values.tap.delayedDissection.storageClass | default .Values.tap.snapshots.local.storageClass }}
+            {{- if $dissectorStorageClass }}
+            - -dissector-storage-class
+            - '{{ $dissectorStorageClass }}'
+            {{- end }}
             {{- if .Values.tap.gitops.enabled }}
             - -gitops
             {{- end }}

helm-chart/tests/dissection_storage_test.yaml

@@ -0,0 +1,127 @@
+suite: dissection storage configuration
+templates:
+  - templates/04-hub-deployment.yaml
+tests:
+  - it: should fallback to snapshot storageSize when dissection storageSize is empty
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-size
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "20Gi"
+
+  - it: should fallback to snapshot storageClass when dissection storageClass is empty
+    set:
+      tap.snapshots.local.storageClass: gp2
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-class
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: gp2
+
+  - it: should not render dissector-storage-class when both dissection and snapshot storageClass are empty
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-class
+
+  - it: should prefer dissection storageSize over snapshot storageSize
+    set:
+      tap.delayedDissection.storageSize: 100Gi
+      tap.snapshots.local.storageSize: 50Gi
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-size
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "100Gi"
+
+  - it: should prefer dissection storageClass over snapshot storageClass
+    set:
+      tap.delayedDissection.storageClass: io2
+      tap.snapshots.local.storageClass: gp2
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-class
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: io2
+
+  - it: should fallback to snapshot config for both storageSize and storageClass
+    set:
+      tap.snapshots.local.storageSize: 30Gi
+      tap.snapshots.local.storageClass: gp3
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-size
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "30Gi"
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-class
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: gp3
+
+  - it: should not render dissector-storage-size when both dissection and snapshot storageSize are empty
+    set:
+      tap.delayedDissection.storageSize: ""
+      tap.snapshots.local.storageSize: ""
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-size
+
+  - it: should render all dissector args together with custom values
+    set:
+      tap.delayedDissection.cpu: "4"
+      tap.delayedDissection.memory: 8Gi
+      tap.delayedDissection.storageSize: 200Gi
+      tap.delayedDissection.storageClass: local-path
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-cpu
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "4"
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-memory
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: 8Gi
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-size
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "200Gi"
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-class
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: local-path
+
+  - it: should still render existing dissector-cpu and dissector-memory args
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-cpu
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "1"
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-memory
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: 4Gi

helm-chart/values.yaml

@@ -37,6 +37,8 @@ tap:
   delayedDissection:
     cpu: "1"
     memory: 4Gi
+    storageSize: ""
+    storageClass: ""
   snapshots:
     local:
       storageClass: ""