mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-09-08 01:07:18 +00:00
Volodymyr Stoiko
793e5d1efa
An ungated deployment had no authorization at all: every caller was admin, and the only way to restrict anyone was to stand up an identity provider. So a read-only dashboard needed a login it had no use for. defaultRole now answers 'what may an unidentified caller do' as well as 'what may an authenticated caller with no recognized group do'. Setting it to kubeshark-viewer gives a read-only deployment with no login and no auth backend. Its default becomes kubeshark-admin, so an ungated install behaves as it always has, and the hub falls back to admin when the value is unset or unrecognized rather than to strict-deny — nobody configuring a role must not brick an install. Adds install-notes coverage, since the notes are where an operator learns which of the two ungated postures they got, and fills the remaining gaps in the auth suites: dex and descope validation, incomplete settings while auth is off, and worker token projection under licensing and demo mode.
70 lines
3.4 KiB
Plaintext
70 lines
3.4 KiB
Plaintext
Thank you for installing {{ title .Chart.Name }}.
|
|
|
|
Registry: {{ .Values.tap.docker.registry }}
|
|
Tag: {{ not (eq .Values.tap.docker.tag "") | ternary .Values.tap.docker.tag (printf "v%s" .Chart.Version) }}
|
|
{{- if .Values.tap.docker.overrideTag.worker }}
|
|
Overridden worker tag: {{ .Values.tap.docker.overrideTag.worker }}
|
|
{{- end }}
|
|
{{- if .Values.tap.docker.overrideTag.hub }}
|
|
Overridden hub tag: {{ .Values.tap.docker.overrideTag.hub }}
|
|
{{- end }}
|
|
{{- if .Values.tap.docker.overrideTag.front }}
|
|
Overridden front tag: {{ .Values.tap.docker.overrideTag.front }}
|
|
{{- end }}
|
|
{{- if .Values.tap.docker.overrideImage.worker }}
|
|
Overridden worker image: {{ .Values.tap.docker.overrideImage.worker }}
|
|
{{- end }}
|
|
{{- if .Values.tap.docker.overrideImage.hub }}
|
|
Overridden hub image: {{ .Values.tap.docker.overrideImage.hub }}
|
|
{{- end }}
|
|
{{- if .Values.tap.docker.overrideImage.front }}
|
|
Overridden front image: {{ .Values.tap.docker.overrideImage.front }}
|
|
{{- end }}
|
|
|
|
Your deployment has been successful. The release is named `{{ .Release.Name }}` and it has been deployed in the `{{ .Release.Namespace }}` namespace.
|
|
|
|
Notices:
|
|
{{- if not .Values.tap.auth.enabled }}
|
|
- API AUTHENTICATION IS DISABLED (tap.auth.enabled=false, the default).
|
|
- Callers are not identified, and every one of them gets the role
|
|
`{{ default "kubeshark-admin" .Values.tap.auth.defaultRole }}`.
|
|
{{- if not (eq (default "kubeshark-admin" .Values.tap.auth.defaultRole) "kubeshark-admin") }}
|
|
- That role is enforced, so anyone reaching the Hub is limited to it.
|
|
{{- else }}
|
|
- Anyone able to reach the Hub can read captured traffic and change settings.
|
|
- For a read-only deployment with no login, set `tap.auth.defaultRole=kubeshark-viewer`.
|
|
{{- end }}
|
|
- To identify callers, set `tap.auth.enabled=true` with a `tap.auth.type` of `saml` or `oidc`.
|
|
- See https://docs.kubeshark.com/en/roles
|
|
{{- else }}
|
|
- API authentication is enabled (tap.auth.type={{ .Values.tap.auth.type }}).
|
|
- Callers with no recognized role resolve to `{{ default "no role, deny-all" .Values.tap.auth.defaultRole }}`.
|
|
{{- end }}
|
|
{{- if .Values.supportChatEnabled}}
|
|
- Support chat using Intercom is enabled. It can be disabled using `--set supportChatEnabled=false`
|
|
{{- end }}
|
|
{{- if eq .Values.license ""}}
|
|
- No license key was detected.
|
|
- Authenticate through the dashboard to activate a complementary COMMUNITY license.
|
|
- If you have an Enterprise license, download the license key from https://console.kubeshark.com/
|
|
- An Enterprise license-key can be added as 'license: <license>' in helm values or as `--set license=<license>` or as `LICENSE` via mounted secret (`tap.secrets`).
|
|
- Contact us to get an Enterprise license: https://kubeshark.com/contact-us.
|
|
{{- end }}
|
|
{{ if .Values.tap.ingress.enabled }}
|
|
|
|
You can now access the application through the following URL:
|
|
http{{ if .Values.tap.ingress.tls }}s{{ end }}://{{ .Values.tap.ingress.host }}{{ default "" (((.Values.tap).routing).front).basePath }}/
|
|
|
|
{{- else }}
|
|
To access the application, follow these steps:
|
|
|
|
1. Perform port forwarding with the following commands:
|
|
|
|
kubectl port-forward -n {{ .Release.Namespace }} service/kubeshark-front 8899:80
|
|
you could also run: `kubeshark proxy` (which simply manages the port-forward connection)
|
|
|
|
2. Once port forwarding is done, you can access the application by visiting the following URL in your web browser:
|
|
http://127.0.0.1:8899{{ default "" (((.Values.tap).routing).front).basePath }}/
|
|
|
|
{{- end }}
|