🔖 Bump the Helm chart version to 52.0.0

* EFS persistent volume

docs/14

EFS static and dynamic provision added to default

* Update helm-chart/values.yaml

Co-authored-by: M. Mert Yildiran <mehmetmertyildiran@gmail.com>

* Update helm-chart/templates/08-persistent-volume-claim.yaml

Co-authored-by: M. Mert Yildiran <mehmetmertyildiran@gmail.com>

* Update config/configStructs/tapConfig.go

Fix format

Co-authored-by: M. Mert Yildiran <mehmetmertyildiran@gmail.com>

* Fix format config/configStructs/tapConfig.go

Co-authored-by: M. Mert Yildiran <mehmetmertyildiran@gmail.com>

* Improve formatting

---------

Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
Co-authored-by: M. Mert Yildiran <mehmetmertyildiran@gmail.com>

cmd/tap.go

@@ -50,6 +50,8 @@ func init() {
 	tapCmd.Flags().StringSliceP(configStructs.NamespacesLabel, "n", defaultTapConfig.Namespaces, "Namespaces selector")
 	tapCmd.Flags().StringP(configStructs.ReleaseNamespaceLabel, "s", defaultTapConfig.Release.Namespace, "Release namespace of Kubeshark")
 	tapCmd.Flags().Bool(configStructs.PersistentStorageLabel, defaultTapConfig.PersistentStorage, "Enable persistent storage (PersistentVolumeClaim)")
+	tapCmd.Flags().Bool(configStructs.PersistentStorageStaticLabel, defaultTapConfig.PersistentStorageStatic, "Persistent storage static provision")
+	tapCmd.Flags().String(configStructs.EfsFileSytemIdAndPathLabel, defaultTapConfig.EfsFileSytemIdAndPath, "EFS file system ID")
 	tapCmd.Flags().String(configStructs.StorageLimitLabel, defaultTapConfig.StorageLimit, "Override the default storage limit (per node)")
 	tapCmd.Flags().String(configStructs.StorageClassLabel, defaultTapConfig.StorageClass, "Override the default storage class of the PersistentVolumeClaim (per node)")
 	tapCmd.Flags().Bool(configStructs.DryRunLabel, defaultTapConfig.DryRun, "Preview of all pods matching the regex, without tapping them")

config/configStructs/tapConfig.go

@@ -9,28 +9,30 @@ import (
 )
 
 const (
-	DockerRegistryLabel    = "docker-registry"
-	DockerTagLabel         = "docker-tag"
-	DockerImagePullPolicy  = "docker-imagePullPolicy"
-	DockerImagePullSecrets = "docker-imagePullSecrets"
-	ProxyFrontPortLabel    = "proxy-front-port"
-	ProxyHubPortLabel      = "proxy-hub-port"
-	ProxyHostLabel         = "proxy-host"
-	NamespacesLabel        = "namespaces"
-	ReleaseNamespaceLabel  = "release-namespace"
-	PersistentStorageLabel = "persistentStorage"
-	StorageLimitLabel      = "storageLimit"
-	StorageClassLabel      = "storageClass"
-	DryRunLabel            = "dryRun"
-	PcapLabel              = "pcap"
-	ServiceMeshLabel       = "serviceMesh"
-	TlsLabel               = "tls"
-	IgnoreTaintedLabel     = "ignoreTainted"
-	IngressEnabledLabel    = "ingress-enabled"
-	TelemetryEnabledLabel  = "telemetry-enabled"
-	DebugLabel             = "debug"
-	ContainerPort          = 80
-	ContainerPortStr       = "80"
+	DockerRegistryLabel          = "docker-registry"
+	DockerTagLabel               = "docker-tag"
+	DockerImagePullPolicy        = "docker-imagePullPolicy"
+	DockerImagePullSecrets       = "docker-imagePullSecrets"
+	ProxyFrontPortLabel          = "proxy-front-port"
+	ProxyHubPortLabel            = "proxy-hub-port"
+	ProxyHostLabel               = "proxy-host"
+	NamespacesLabel              = "namespaces"
+	ReleaseNamespaceLabel        = "release-namespace"
+	PersistentStorageLabel       = "persistentStorage"
+	PersistentStorageStaticLabel = "persistentStorageStatic"
+	EfsFileSytemIdAndPathLabel   = "efsFileSytemIdAndPath"
+	StorageLimitLabel            = "storageLimit"
+	StorageClassLabel            = "storageClass"
+	DryRunLabel                  = "dryRun"
+	PcapLabel                    = "pcap"
+	ServiceMeshLabel             = "serviceMesh"
+	TlsLabel                     = "tls"
+	IgnoreTaintedLabel           = "ignoreTainted"
+	IngressEnabledLabel          = "ingress-enabled"
+	TelemetryEnabledLabel        = "telemetry-enabled"
+	DebugLabel                   = "debug"
+	ContainerPort                = 80
+	ContainerPortStr             = "80"
 )
 
 type ResourceLimits struct {
@@ -53,7 +55,6 @@ type WorkerConfig struct {
 }
 
 type HubConfig struct {
-	Port    uint16 `yaml:"port" json:"port" default:"8898"`
 	SrvPort uint16 `yaml:"srvPort" json:"srvPort" default:"8898"`
 }
 
@@ -106,28 +107,31 @@ type TelemetryConfig struct {
 }
 
 type TapConfig struct {
-	Docker            DockerConfig          `yaml:"docker" json:"docker"`
-	Proxy             ProxyConfig           `yaml:"proxy" json:"proxy"`
-	PodRegexStr       string                `yaml:"regex" json:"regex" default:".*"`
-	Namespaces        []string              `yaml:"namespaces" json:"namespaces" default:"[]"`
-	Release           ReleaseConfig         `yaml:"release" json:"release"`
-	PersistentStorage bool                  `yaml:"persistentStorage" json:"persistentStorage" default:"false"`
-	StorageLimit      string                `yaml:"storageLimit" json:"storageLimit" default:"500Mi"`
-	StorageClass      string                `yaml:"storageClass" json:"storageClass" default:"standard"`
-	DryRun            bool                  `yaml:"dryRun" json:"dryRun" default:"false"`
-	Resources         ResourcesConfig       `yaml:"resources" json:"resources"`
-	ServiceMesh       bool                  `yaml:"serviceMesh" json:"serviceMesh" default:"true"`
-	Tls               bool                  `yaml:"tls" json:"tls" default:"true"`
-	IgnoreTainted     bool                  `yaml:"ignoreTainted" json:"ignoreTainted" default:"false"`
-	Labels            map[string]string     `yaml:"labels" json:"labels" default:"{}"`
-	Annotations       map[string]string     `yaml:"annotations" json:"annotations" default:"{}"`
-	NodeSelectorTerms []v1.NodeSelectorTerm `yaml:"nodeSelectorTerms" json:"nodeSelectorTerms" default:"[]"`
-	Auth              AuthConfig            `yaml:"auth" json:"auth"`
-	Ingress           IngressConfig         `yaml:"ingress" json:"ingress"`
-	IPv6              bool                  `yaml:"ipv6" json:"ipv6" default:"true"`
-	Debug             bool                  `yaml:"debug" json:"debug" default:"false"`
-	NoKernelModule    bool                  `yaml:"noKernelModule" json:"noKernelModule" default:"false"`
-	Telemetry         TelemetryConfig       `yaml:"telemetry" json:"telemetry"`
+	Docker                  DockerConfig          `yaml:"docker" json:"docker"`
+	Proxy                   ProxyConfig           `yaml:"proxy" json:"proxy"`
+	PodRegexStr             string                `yaml:"regex" json:"regex" default:".*"`
+	Namespaces              []string              `yaml:"namespaces" json:"namespaces" default:"[]"`
+	Release                 ReleaseConfig         `yaml:"release" json:"release"`
+	PersistentStorage       bool                  `yaml:"persistentStorage" json:"persistentStorage" default:"false"`
+	PersistentStorageStatic bool                  `yaml:"persistentStorageStatic" json:"persistentStorageStatic" default:"false"`
+	EfsFileSytemIdAndPath   string                `yaml:"efsFileSytemIdAndPath" json:"efsFileSytemIdAndPath" default:""`
+	StorageLimit            string                `yaml:"storageLimit" json:"storageLimit" default:"500Mi"`
+	StorageClass            string                `yaml:"storageClass" json:"storageClass" default:"standard"`
+	DryRun                  bool                  `yaml:"dryRun" json:"dryRun" default:"false"`
+	Resources               ResourcesConfig       `yaml:"resources" json:"resources"`
+	ServiceMesh             bool                  `yaml:"serviceMesh" json:"serviceMesh" default:"true"`
+	Tls                     bool                  `yaml:"tls" json:"tls" default:"true"`
+	IgnoreTainted           bool                  `yaml:"ignoreTainted" json:"ignoreTainted" default:"false"`
+	Labels                  map[string]string     `yaml:"labels" json:"labels" default:"{}"`
+	Annotations             map[string]string     `yaml:"annotations" json:"annotations" default:"{}"`
+	NodeSelectorTerms       []v1.NodeSelectorTerm `yaml:"nodeSelectorTerms" json:"nodeSelectorTerms" default:"[]"`
+	Auth                    AuthConfig            `yaml:"auth" json:"auth"`
+	Ingress                 IngressConfig         `yaml:"ingress" json:"ingress"`
+	IPv6                    bool                  `yaml:"ipv6" json:"ipv6" default:"true"`
+	Debug                   bool                  `yaml:"debug" json:"debug" default:"false"`
+	NoKernelModule          bool                  `yaml:"noKernelModule" json:"noKernelModule" default:"false"`
+	Telemetry               TelemetryConfig       `yaml:"telemetry" json:"telemetry"`
+	DefaultFilter           string                `yaml:"defaultFilter" json:"defaultFilter"`
 }
 
 func (config *TapConfig) PodRegex() *regexp.Regexp {

helm-chart/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: kubeshark
-version: "51.0.39"
+version: "52.0.0"
 description: The API Traffic Analyzer for Kubernetes
 home: https://kubeshark.co
 keywords:

helm-chart/README.md

@@ -41,7 +41,7 @@ Uninstall Kubeshark:
 helm uninstall kubeshark
 ```
 
-## Accesing
+## Accessing
 
 Do the port forwarding:
 
@@ -122,6 +122,8 @@ helm install kubeshark kubeshark/kubeshark \
 | `tap.release.name`                        | Helm release name                          | `kubeshark`                                             |
 | `tap.release.namespace`                   | Helm release namespace                | `default`                                               |
 | `tap.persistentStorage`                   | Use `persistentVolumeClaim` instead of `emptyDir` | `false`                                                |
+| `tap.persistentStorageStatic`             | Use static persistent volume provisioning (explicitly defined `PersistentVolume` ) | `false`                                                      |
+| `tap.efsFileSytemIdAndPath`               | [EFS file system ID and, optionally, subpath and/or access point](https://github.com/kubernetes-sigs/aws-efs-csi-driver/blob/master/examples/kubernetes/access_points/README.md) `<FileSystemId>:<Path>:<AccessPointId>`     | ""                                                           |
 | `tap.storageLimit`                        | Limit of either the `emptyDir` or `persistentVolumeClaim`                  | `500Mi`                                                 |
 | `tap.storageClass`                        | Storage class of the `PersistentVolumeClaim`          | `standard`                                              |
 | `tap.dryRun`                              | Preview of all pods matching the regex, without tapping them                    | `false`                                                 |

helm-chart/templates/06-front-deployment.yaml

@@ -25,11 +25,7 @@ spec:
       containers:
         - env:
             - name: REACT_APP_DEFAULT_FILTER
-              value: ' '
-            - name: REACT_APP_HUB_HOST
-              value: ' '
-            - name: REACT_APP_HUB_PORT
-              value: '{{ .Values.tap.ingress.enabled | ternary "/api" (print ":" .Values.tap.proxy.front.port "/api") }}'
+              value: '{{ not (eq .Values.tap.defaultFilter "") | ternary .Values.tap.defaultFilter " " }}'
             - name: REACT_APP_AUTH_ENABLED
               value: '{{ .Values.tap.auth.enabled }}'
           image: '{{ .Values.tap.docker.registry }}/front:{{ not (eq .Values.tap.docker.tag "") | ternary .Values.tap.docker.tag (printf "v%s" .Chart.Version) }}'

helm-chart/templates/08-persistent-volume-claim.yaml

@@ -1,4 +1,25 @@
 ---
+{{- if .Values.tap.persistentStorageStatic }}
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: kubeshark-persistent-volume
+  namespace: {{ .Release.Namespace }}
+spec:
+  capacity:
+    storage: {{ .Values.tap.storageLimit }}
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: {{ .Values.tap.storageClass }}
+  {{- if .Values.tap.efsFileSytemIdAndPath }}
+  csi:
+    driver: efs.csi.aws.com
+    volumeHandle: {{ .Values.tap.efsFileSytemIdAndPath }}
+  {{ end }}
+---
+{{ end }}
 {{- if .Values.tap.persistentStorage }}
 apiVersion: v1
 kind: PersistentVolumeClaim

helm-chart/templates/09-worker-daemon-set.yaml

@@ -65,13 +65,24 @@ spec:
           securityContext:
             capabilities:
               add:
+                # NET_RAW is required to listen the network traffic
                 - NET_RAW
+                # NET_ADMIN is required to listen the network traffic
                 - NET_ADMIN
-                - SYS_ADMIN
-                - SYS_PTRACE
-                - DAC_OVERRIDE
+                {{- if not .Values.tap.noKernelModule }}
+                # SYS_MODULE is required to install kernel modules
                 - SYS_MODULE
+                {{- end }}
+                {{- if .Values.tap.serviceMesh }}
+                # SYS_ADMIN is required to read /proc/PID/net/ns + to install eBPF programs (kernel < 5.8)
+                - SYS_ADMIN
+                # SYS_PTRACE is required to set netns to other process + to open libssl.so of other process
+                - SYS_PTRACE
+                # DAC_OVERRIDE is required to read /proc/PID/environ
+                - DAC_OVERRIDE
+                # CHECKPOINT_RESTORE is required to readlink /proc/PID/exe (kernel > 5.9)
                 - CHECKPOINT_RESTORE
+                {{- end }}
               drop:
                 - ALL
           readinessProbe:
@@ -120,12 +131,13 @@ spec:
           securityContext:
             capabilities:
               add:
-                - NET_RAW
-                - NET_ADMIN
+                # SYS_ADMIN is required to read /proc/PID/net/ns + to install eBPF programs (kernel < 5.8)
                 - SYS_ADMIN
+                # SYS_PTRACE is required to set netns to other process + to open libssl.so of other process
                 - SYS_PTRACE
-                - DAC_OVERRIDE
+                # SYS_RESOURCE is required to change rlimits for eBPF
                 - SYS_RESOURCE
+                # CHECKPOINT_RESTORE is required to readlink /proc/PID/exe (kernel > 5.9)
                 - CHECKPOINT_RESTORE
               drop:
                 - ALL

helm-chart/values.yaml

@@ -8,7 +8,6 @@ tap:
     worker:
       srvPort: 30001
     hub:
-      port: 8898
       srvPort: 8898
     front:
       port: 8899
@@ -20,6 +19,8 @@ tap:
     name: kubeshark
     namespace: default
   persistentStorage: false
+  persistentStorageStatic: false
+  efsFileSytemIdAndPath: ""
   storageLimit: 500Mi
   storageClass: standard
   dryRun: false
@@ -65,6 +66,7 @@ tap:
   noKernelModule: false
   telemetry:
     enabled: true
+  defaultFilter: ""
 logs:
   file: ""
 kube:

manifests/complete.yaml

@@ -4,10 +4,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
   name: kubeshark-service-account
@@ -21,10 +21,10 @@ metadata:
   namespace: default
   labels:
     app.kubeshark.co/app: hub
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
 stringData:
     LICENSE: ''
@@ -36,10 +36,10 @@ metadata:
   name: kubeshark-nginx-config-map
   namespace: default
   labels:
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
 data:
   default.conf: |
@@ -85,10 +85,10 @@ metadata:
   namespace: default
   labels:
     app.kubeshark.co/app: hub
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
 data:
     POD_REGEX: '.*'
@@ -106,10 +106,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
   name: kubeshark-cluster-role
@@ -134,10 +134,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
   name: kubeshark-cluster-role-binding
@@ -156,10 +156,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
   name: kubeshark-self-config-role
@@ -184,10 +184,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
   name: kubeshark-self-config-role-binding
@@ -207,10 +207,10 @@ kind: Service
 metadata:
   labels:
     app.kubeshark.co/app: hub
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
   name: kubeshark-hub
@@ -229,10 +229,10 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
   name: kubeshark-front
@@ -253,10 +253,10 @@ metadata:
   labels:
     app.kubeshark.co/app: worker
     sidecar.istio.io/inject: "false"
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
   name: kubeshark-worker-daemon-set
@@ -265,19 +265,19 @@ spec:
   selector:
     matchLabels:
       app.kubeshark.co/app: worker
-      helm.sh/chart: kubeshark-51.0.39
+      helm.sh/chart: kubeshark-52.0.0
       app.kubernetes.io/name: kubeshark
       app.kubernetes.io/instance: kubeshark
-      app.kubernetes.io/version: "51.0.39"
+      app.kubernetes.io/version: "52.0.0"
       app.kubernetes.io/managed-by: Helm
   template:
     metadata:
       labels:
         app.kubeshark.co/app: worker
-        helm.sh/chart: kubeshark-51.0.39
+        helm.sh/chart: kubeshark-52.0.0
         app.kubernetes.io/name: kubeshark
         app.kubernetes.io/instance: kubeshark
-        app.kubernetes.io/version: "51.0.39"
+        app.kubernetes.io/version: "52.0.0"
         app.kubernetes.io/managed-by: Helm
       name: kubeshark-worker-daemon-set
       namespace: kubeshark
@@ -292,7 +292,7 @@ spec:
             - -servicemesh
             - -procfs
             - /hostproc
-          image: 'docker.io/kubeshark/worker:v51.0.39'
+          image: 'docker.io/kubeshark/worker:v52.0.0'
           imagePullPolicy: Always
           name: sniffer
           env:
@@ -314,12 +314,19 @@ spec:
           securityContext:
             capabilities:
               add:
+                # NET_RAW is required to listen the network traffic
                 - NET_RAW
+                # NET_ADMIN is required to listen the network traffic
                 - NET_ADMIN
-                - SYS_ADMIN
-                - SYS_PTRACE
-                - DAC_OVERRIDE
+                # SYS_MODULE is required to install kernel modules
                 - SYS_MODULE
+                # SYS_ADMIN is required to read /proc/PID/net/ns + to install eBPF programs (kernel < 5.8)
+                - SYS_ADMIN
+                # SYS_PTRACE is required to set netns to other process + to open libssl.so of other process
+                - SYS_PTRACE
+                # DAC_OVERRIDE is required to read /proc/PID/environ
+                - DAC_OVERRIDE
+                # CHECKPOINT_RESTORE is required to readlink /proc/PID/exe (kernel > 5.9)
                 - CHECKPOINT_RESTORE
               drop:
                 - ALL
@@ -350,7 +357,7 @@ spec:
             - ./tracer
             - -procfs
             - /hostproc
-          image: 'docker.io/kubeshark/worker:v51.0.39'
+          image: 'docker.io/kubeshark/worker:v52.0.0'
           imagePullPolicy: Always
           name: tracer
           env:
@@ -365,12 +372,13 @@ spec:
           securityContext:
             capabilities:
               add:
-                - NET_RAW
-                - NET_ADMIN
+                # SYS_ADMIN is required to read /proc/PID/net/ns + to install eBPF programs (kernel < 5.8)
                 - SYS_ADMIN
+                # SYS_PTRACE is required to set netns to other process + to open libssl.so of other process
                 - SYS_PTRACE
-                - DAC_OVERRIDE
+                # SYS_RESOURCE is required to change rlimits for eBPF
                 - SYS_RESOURCE
+                # CHECKPOINT_RESTORE is required to readlink /proc/PID/exe (kernel > 5.9)
                 - CHECKPOINT_RESTORE
               drop:
                 - ALL
@@ -418,10 +426,10 @@ kind: Deployment
 metadata:
   labels:
     app.kubeshark.co/app: hub
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
   name: kubeshark-hub
@@ -431,19 +439,19 @@ spec:
   selector:
     matchLabels:
       app.kubeshark.co/app: hub
-      helm.sh/chart: kubeshark-51.0.39
+      helm.sh/chart: kubeshark-52.0.0
       app.kubernetes.io/name: kubeshark
       app.kubernetes.io/instance: kubeshark
-      app.kubernetes.io/version: "51.0.39"
+      app.kubernetes.io/version: "52.0.0"
       app.kubernetes.io/managed-by: Helm
   template:
     metadata:
       labels:
         app.kubeshark.co/app: hub
-        helm.sh/chart: kubeshark-51.0.39
+        helm.sh/chart: kubeshark-52.0.0
         app.kubernetes.io/name: kubeshark
         app.kubernetes.io/instance: kubeshark
-        app.kubernetes.io/version: "51.0.39"
+        app.kubernetes.io/version: "52.0.0"
         app.kubernetes.io/managed-by: Helm
     spec:
       dnsPolicy: ClusterFirstWithHostNet
@@ -461,7 +469,7 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: metadata.namespace
-          image: 'docker.io/kubeshark/hub:v51.0.39'
+          image: 'docker.io/kubeshark/hub:v52.0.0'
           imagePullPolicy: Always
           readinessProbe:
             periodSeconds: 1
@@ -491,10 +499,10 @@ kind: Deployment
 metadata:
   labels:
     app.kubeshark.co/app: front
-    helm.sh/chart: kubeshark-51.0.39
+    helm.sh/chart: kubeshark-52.0.0
     app.kubernetes.io/name: kubeshark
     app.kubernetes.io/instance: kubeshark
-    app.kubernetes.io/version: "51.0.39"
+    app.kubernetes.io/version: "52.0.0"
     app.kubernetes.io/managed-by: Helm
   annotations:
   name: kubeshark-front
@@ -504,32 +512,28 @@ spec:
   selector:
     matchLabels:
       app.kubeshark.co/app: front
-      helm.sh/chart: kubeshark-51.0.39
+      helm.sh/chart: kubeshark-52.0.0
       app.kubernetes.io/name: kubeshark
       app.kubernetes.io/instance: kubeshark
-      app.kubernetes.io/version: "51.0.39"
+      app.kubernetes.io/version: "52.0.0"
       app.kubernetes.io/managed-by: Helm
   template:
     metadata:
       labels:
         app.kubeshark.co/app: front
-        helm.sh/chart: kubeshark-51.0.39
+        helm.sh/chart: kubeshark-52.0.0
         app.kubernetes.io/name: kubeshark
         app.kubernetes.io/instance: kubeshark
-        app.kubernetes.io/version: "51.0.39"
+        app.kubernetes.io/version: "52.0.0"
         app.kubernetes.io/managed-by: Helm
     spec:
       containers:
         - env:
             - name: REACT_APP_DEFAULT_FILTER
               value: ' '
-            - name: REACT_APP_HUB_HOST
-              value: ' '
-            - name: REACT_APP_HUB_PORT
-              value: ':8899/api'
             - name: REACT_APP_AUTH_ENABLED
               value: 'false'
-          image: 'docker.io/kubeshark/front:v51.0.39'
+          image: 'docker.io/kubeshark/front:v52.0.0'
           imagePullPolicy: Always
           name: kubeshark-front
           livenessProbe: