mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-07-13 18:40:02 +00:00
8186b7891b
* Migrate auth.saml.roles to unified auth.roles
Follows the hub-side introduction of the backend-neutral AUTH_ROLES /
AUTH_ROLES_CLAIM / AUTH_DEFAULT_ROLE config (hub commit 51177bcb).
CLI and Helm chart now surface the unified location:
tap.auth.roles — map of role -> permissions (shared SAML/OIDC)
tap.auth.rolesClaim — token/assertion claim name carrying roles
tap.auth.defaultRole — fallback role for authenticated users with
no matching role in their token
Helm ConfigMap template emits AUTH_ROLES / AUTH_ROLES_CLAIM /
AUTH_DEFAULT_ROLE and no longer emits AUTH_SAML_ROLES or
AUTH_SAML_ROLE_ATTRIBUTE. Hub's back-compat fallback still reads those
keys from any existing ConfigMap that hasn't been helm-upgraded.
Legacy struct fields (SamlConfig.Roles, SamlConfig.RoleAttribute) stay
in place so existing values.yaml files with auth.saml.roles still parse
without errors, but the CLI and the chart ignore them. Follow-up release
can remove the struct fields once telemetry confirms migration.
Breaking for users with customized auth.saml.roles in their values.yaml
— the customization is masked by the new default auth.roles.admin and
must be migrated to auth.roles for the custom permissions to take
effect. Documented in the chart README and release notes.
Part of authz-refactoring (Step 2 of hub-oidc-rbac.md, CLI side).
* Remove legacy
* Align CLI + Helm chart with hub AUTH_TYPE rename
Follows hub commit 11564fef. The canonical AUTH_TYPE is now `oidc` for
generic OIDC; `dex` is a permanent alias; `descope` is a new explicit
label. This change surfaces the new vocabulary in the CLI config struct
and the Helm chart, and renames the nested `auth.dexOidc` values.yaml
field to `auth.oidc` for consistency.
Helm chart:
- 12-config-map.yaml: AUTH_OIDC_* keys now read `.Values.tap.auth.oidc.*`
instead of `auth.dexOidc.*`. The cloud-license override that forced
AUTH_TYPE=default unless the admin picked `dex` now accepts `oidc` too.
- 13-secret.yaml: OIDC_CLIENT_ID / OIDC_CLIENT_SECRET read from
`auth.oidc.*` (was `auth.dexOidc.*`).
- 06-front-deployment.yaml: REACT_APP_AUTH_ENABLED / REACT_APP_AUTH_TYPE
conditionals accept both `oidc` and `dex` where they previously only
matched `dex`.
- values.yaml: comment on `tap.auth.type` lists valid values and flags
the breaking change.
- README.md: `tap.auth.type` row lists valid values. All `dexOidc`
references renamed to `oidc`. Sample values.yaml blocks now show
`type: oidc` as the canonical form.
CLI:
- config/configStructs/tapConfig.go: AuthConfig.Type documented with the
full list of valid values and the migration hint.
Breaking changes (repeated in release notes):
1. `tap.auth.type: oidc` now routes to the generic OIDC middleware
(previously Descope). Switch to `tap.auth.type: descope` or `default`
if you were using `oidc` for Descope.
2. `tap.auth.dexOidc.*` values are no longer read. Rename to
`tap.auth.oidc.*`. No fallback.
3. `tap.auth.type: dex` continues to work — permanent alias of `oidc`.
Part of authz-refactoring (Step 4 of hub-oidc-rbac.md, CLI/Helm side).
* default kfl
* Authz Refactoring: Step 8: namespaces-list role filter
Align with hub PR kubeshark/hub#756. Per-role auth.roles[].filter (KFL)
is replaced by auth.roles[].namespaces (comma-separated list with "*",
literal, and glob semantics). Standalone tap.auth.defaultFilter knob
removed.
helm-chart/values.yaml
- admin role example uses namespaces: "*" instead of filter: "".
- Comment block explains the new namespaces semantics.
- defaultFilter: "" entry + accompanying comment block deleted.
helm-chart/templates/12-config-map.yaml
- AUTH_DEFAULT_FILTER ConfigMap entry removed (hub no longer reads it).
helm-chart/README.md
- tap.auth.defaultFilter row removed.
- tap.auth.roles default value example updated: filter: "" → namespaces: "*";
description gains the per-role namespaces semantics legend.
458 lines
22 KiB
Go
458 lines
22 KiB
Go
package configStructs
|
|
|
|
import (
|
|
"fmt"
|
|
"regexp"
|
|
|
|
v1 "k8s.io/api/core/v1"
|
|
networking "k8s.io/api/networking/v1"
|
|
)
|
|
|
|
const (
|
|
DockerRegistryLabel = "docker-registry"
|
|
DockerTagLabel = "docker-tag"
|
|
DockerImagePullPolicy = "docker-imagePullPolicy"
|
|
DockerImagePullSecrets = "docker-imagePullSecrets"
|
|
ProxyFrontPortLabel = "proxy-front-port"
|
|
ProxyHubPortLabel = "proxy-hub-port"
|
|
ProxyHostLabel = "proxy-host"
|
|
NamespacesLabel = "namespaces"
|
|
ExcludedNamespacesLabel = "excludedNamespaces"
|
|
ReleaseNamespaceLabel = "release-namespace"
|
|
PersistentStorageLabel = "persistentStorage"
|
|
PersistentStorageStaticLabel = "persistentStorageStatic"
|
|
EfsFileSytemIdAndPathLabel = "efsFileSytemIdAndPath"
|
|
StorageLimitLabel = "storageLimit"
|
|
StorageClassLabel = "storageClass"
|
|
DryRunLabel = "dryRun"
|
|
PcapLabel = "pcap"
|
|
ServiceMeshLabel = "serviceMesh"
|
|
TlsLabel = "tls"
|
|
IgnoreTaintedLabel = "ignoreTainted"
|
|
IngressEnabledLabel = "ingress-enabled"
|
|
TelemetryEnabledLabel = "telemetry-enabled"
|
|
ResourceGuardEnabledLabel = "resource-guard-enabled"
|
|
PprofPortLabel = "pprof-port"
|
|
PprofViewLabel = "pprof-view"
|
|
DebugLabel = "debug"
|
|
ContainerPort = 8080
|
|
ContainerPortStr = "8080"
|
|
PcapDest = "dest"
|
|
PcapMaxSize = "maxSize"
|
|
PcapMaxTime = "maxTime"
|
|
PcapTimeInterval = "timeInterval"
|
|
PcapKubeconfig = "kubeconfig"
|
|
PcapDumpEnabled = "enabled"
|
|
PcapTime = "time"
|
|
WatchdogEnabled = "watchdogEnabled"
|
|
HelmChartPathLabel = "release-helmChartPath"
|
|
)
|
|
|
|
type ResourceLimitsHub struct {
|
|
CPU string `yaml:"cpu" json:"cpu" default:"0"`
|
|
Memory string `yaml:"memory" json:"memory" default:"5Gi"`
|
|
}
|
|
|
|
type ResourceLimitsWorker struct {
|
|
CPU string `yaml:"cpu" json:"cpu" default:"0"`
|
|
Memory string `yaml:"memory" json:"memory" default:"3Gi"`
|
|
}
|
|
|
|
type ResourceRequests struct {
|
|
CPU string `yaml:"cpu" json:"cpu" default:"50m"`
|
|
Memory string `yaml:"memory" json:"memory" default:"50Mi"`
|
|
}
|
|
|
|
type ResourceRequirementsHub struct {
|
|
Limits ResourceLimitsHub `yaml:"limits" json:"limits"`
|
|
Requests ResourceRequests `yaml:"requests" json:"requests"`
|
|
}
|
|
|
|
type ResourceRequirementsWorker struct {
|
|
Limits ResourceLimitsHub `yaml:"limits" json:"limits"`
|
|
Requests ResourceRequests `yaml:"requests" json:"requests"`
|
|
}
|
|
|
|
type WorkerConfig struct {
|
|
SrvPort uint16 `yaml:"srvPort" json:"srvPort" default:"48999"`
|
|
}
|
|
|
|
type HubConfig struct {
|
|
SrvPort uint16 `yaml:"srvPort" json:"srvPort" default:"8898"`
|
|
}
|
|
|
|
type FrontConfig struct {
|
|
Port uint16 `yaml:"port" json:"port" default:"8899"`
|
|
}
|
|
|
|
type ProxyConfig struct {
|
|
Worker WorkerConfig `yaml:"worker" json:"worker"`
|
|
Hub HubConfig `yaml:"hub" json:"hub"`
|
|
Front FrontConfig `yaml:"front" json:"front"`
|
|
Host string `yaml:"host" json:"host" default:"127.0.0.1"`
|
|
}
|
|
|
|
type OverrideImageConfig struct {
|
|
Worker string `yaml:"worker" json:"worker"`
|
|
Hub string `yaml:"hub" json:"hub"`
|
|
Front string `yaml:"front" json:"front"`
|
|
}
|
|
type OverrideTagConfig struct {
|
|
Worker string `yaml:"worker" json:"worker"`
|
|
Hub string `yaml:"hub" json:"hub"`
|
|
Front string `yaml:"front" json:"front"`
|
|
}
|
|
|
|
type DockerConfig struct {
|
|
Registry string `yaml:"registry" json:"registry" default:"docker.io/kubeshark"`
|
|
Tag string `yaml:"tag" json:"tag" default:""`
|
|
TagLocked bool `yaml:"tagLocked" json:"tagLocked" default:"true"`
|
|
ImagePullPolicy string `yaml:"imagePullPolicy" json:"imagePullPolicy" default:"Always"`
|
|
ImagePullSecrets []string `yaml:"imagePullSecrets" json:"imagePullSecrets"`
|
|
OverrideImage OverrideImageConfig `yaml:"overrideImage" json:"overrideImage"`
|
|
OverrideTag OverrideTagConfig `yaml:"overrideTag" json:"overrideTag"`
|
|
}
|
|
|
|
type DnsConfig struct {
|
|
Nameservers []string `yaml:"nameservers" json:"nameservers" default:"[]"`
|
|
Searches []string `yaml:"searches" json:"searches" default:"[]"`
|
|
Options []DnsConfigOption `yaml:"options" json:"options" default:"[]"`
|
|
}
|
|
|
|
type DnsConfigOption struct {
|
|
Name string `yaml:"name" json:"name"`
|
|
Value string `yaml:"value" json:"value"`
|
|
}
|
|
|
|
type ResourcesConfig struct {
|
|
Hub ResourceRequirementsHub `yaml:"hub" json:"hub"`
|
|
Sniffer ResourceRequirementsWorker `yaml:"sniffer" json:"sniffer"`
|
|
Tracer ResourceRequirementsWorker `yaml:"tracer" json:"tracer"`
|
|
}
|
|
|
|
type ProbesConfig struct {
|
|
Hub ProbeConfig `yaml:"hub" json:"hub"`
|
|
Sniffer ProbeConfig `yaml:"sniffer" json:"sniffer"`
|
|
}
|
|
|
|
type NodeSelectorTermsConfig struct {
|
|
Hub []v1.NodeSelectorTerm `yaml:"hub" json:"hub" default:"[]"`
|
|
Workers []v1.NodeSelectorTerm `yaml:"workers" json:"workers" default:"[]"`
|
|
Front []v1.NodeSelectorTerm `yaml:"front" json:"front" default:"[]"`
|
|
Dex []v1.NodeSelectorTerm `yaml:"dex" json:"dex" default:"[]"`
|
|
}
|
|
|
|
type TolerationsConfig struct {
|
|
Hub []v1.Toleration `yaml:"hub" json:"hub" default:"[]"`
|
|
Workers []v1.Toleration `yaml:"workers" json:"workers" default:"[]"`
|
|
Front []v1.Toleration `yaml:"front" json:"front" default:"[]"`
|
|
}
|
|
|
|
type ProbeConfig struct {
|
|
InitialDelaySeconds int `yaml:"initialDelaySeconds" json:"initialDelaySeconds" default:"5"`
|
|
PeriodSeconds int `yaml:"periodSeconds" json:"periodSeconds" default:"5"`
|
|
SuccessThreshold int `yaml:"successThreshold" json:"successThreshold" default:"1"`
|
|
FailureThreshold int `yaml:"failureThreshold" json:"failureThreshold" default:"3"`
|
|
}
|
|
|
|
type ScriptingPermissions struct {
|
|
CanSave bool `yaml:"canSave" json:"canSave" default:"true"`
|
|
CanActivate bool `yaml:"canActivate" json:"canActivate" default:"true"`
|
|
CanDelete bool `yaml:"canDelete" json:"canDelete" default:"true"`
|
|
}
|
|
|
|
type Role struct {
|
|
Filter string `yaml:"filter" json:"filter" default:""`
|
|
CanDownloadPCAP bool `yaml:"canDownloadPCAP" json:"canDownloadPCAP" default:"false"`
|
|
CanUseScripting bool `yaml:"canUseScripting" json:"canUseScripting" default:"false"`
|
|
ScriptingPermissions ScriptingPermissions `yaml:"scriptingPermissions" json:"scriptingPermissions"`
|
|
CanUpdateTargetedPods bool `yaml:"canUpdateTargetedPods" json:"canUpdateTargetedPods" default:"false"`
|
|
CanStopTrafficCapturing bool `yaml:"canStopTrafficCapturing" json:"canStopTrafficCapturing" default:"false"`
|
|
CanControlDissection bool `yaml:"canControlDissection" json:"canControlDissection" default:"false"`
|
|
ShowAdminConsoleLink bool `yaml:"showAdminConsoleLink" json:"showAdminConsoleLink" default:"false"`
|
|
}
|
|
|
|
type SamlConfig struct {
|
|
IdpMetadataUrl string `yaml:"idpMetadataUrl" json:"idpMetadataUrl"`
|
|
X509crt string `yaml:"x509crt" json:"x509crt"`
|
|
X509key string `yaml:"x509key" json:"x509key"`
|
|
}
|
|
|
|
type AuthConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
// Type selects the authentication backend. Valid values:
|
|
// saml — SAML 2.0 SSO
|
|
// oidc — generic OIDC (Dex, Okta, Auth0, Keycloak, Azure AD, …)
|
|
// dex — permanent alias of oidc (kept for back-compat)
|
|
// descope — Descope SDK
|
|
// default — also routes to Descope (kept, not deprecated)
|
|
//
|
|
// NOTE: prior releases routed `oidc` to Descope. If you were using `oidc`
|
|
// to mean Descope, switch to `descope` (or `default`). The rename is a
|
|
// breaking change documented in the release notes.
|
|
Type string `yaml:"type" json:"type" default:"saml"`
|
|
Roles map[string]Role `yaml:"roles" json:"roles"`
|
|
RolesClaim string `yaml:"rolesClaim" json:"rolesClaim"`
|
|
DefaultRole string `yaml:"defaultRole" json:"defaultRole"`
|
|
DefaultFilter string `yaml:"defaultFilter" json:"defaultFilter"`
|
|
Saml SamlConfig `yaml:"saml" json:"saml"`
|
|
}
|
|
|
|
type IngressConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
ClassName string `yaml:"className" json:"className" default:""`
|
|
Host string `yaml:"host" json:"host" default:"ks.svc.cluster.local"`
|
|
Path string `yaml:"path" json:"path" default:"/"`
|
|
TLS []networking.IngressTLS `yaml:"tls" json:"tls" default:"[]"`
|
|
Annotations map[string]string `yaml:"annotations" json:"annotations" default:"{}"`
|
|
}
|
|
|
|
type RoutingConfig struct {
|
|
Front FrontRoutingConfig `yaml:"front" json:"front"`
|
|
}
|
|
|
|
type DashboardConfig struct {
|
|
StreamingType string `yaml:"streamingType" json:"streamingType" default:"connect-rpc"`
|
|
CompleteStreamingEnabled bool `yaml:"completeStreamingEnabled" json:"completeStreamingEnabled" default:"true"`
|
|
ClusterWideMapEnabled bool `yaml:"clusterWideMapEnabled" json:"clusterWideMapEnabled" default:"false"`
|
|
EntriesLimit string `yaml:"entriesLimit" json:"entriesLimit" default:"300000"`
|
|
}
|
|
|
|
type FrontRoutingConfig struct {
|
|
BasePath string `yaml:"basePath" json:"basePath" default:""`
|
|
}
|
|
|
|
type ReleaseConfig struct {
|
|
Repo string `yaml:"repo" json:"repo" default:"https://helm.kubeshark.com"`
|
|
Name string `yaml:"name" json:"name" default:"kubeshark"`
|
|
Namespace string `yaml:"namespace" json:"namespace" default:"default"`
|
|
HelmChartPath string `yaml:"helmChartPath" json:"helmChartPath" default:""`
|
|
}
|
|
|
|
type TelemetryConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"true"`
|
|
}
|
|
|
|
type ResourceGuardConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
}
|
|
|
|
type SentryConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
Environment string `yaml:"environment" json:"environment" default:"production"`
|
|
}
|
|
|
|
type WatchdogConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
}
|
|
|
|
type GitopsConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
}
|
|
|
|
type CapabilitiesConfig struct {
|
|
NetworkCapture []string `yaml:"networkCapture" json:"networkCapture" default:"[]"`
|
|
ServiceMeshCapture []string `yaml:"serviceMeshCapture" json:"serviceMeshCapture" default:"[]"`
|
|
EBPFCapture []string `yaml:"ebpfCapture" json:"ebpfCapture" default:"[]"`
|
|
}
|
|
|
|
type MetricsConfig struct {
|
|
Port uint16 `yaml:"port" json:"port" default:"49100"`
|
|
}
|
|
|
|
type PprofConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
Port uint16 `yaml:"port" json:"port" default:"8000"`
|
|
View string `yaml:"view" json:"view" default:"flamegraph"`
|
|
}
|
|
|
|
type MiscConfig struct {
|
|
JsonTTL string `yaml:"jsonTTL" json:"jsonTTL" default:"5m"`
|
|
PcapTTL string `yaml:"pcapTTL" json:"pcapTTL" default:"0"`
|
|
PcapErrorTTL string `yaml:"pcapErrorTTL" json:"pcapErrorTTL" default:"0"`
|
|
TrafficSampleRate int `yaml:"trafficSampleRate" json:"trafficSampleRate" default:"100"`
|
|
TcpStreamChannelTimeoutMs int `yaml:"tcpStreamChannelTimeoutMs" json:"tcpStreamChannelTimeoutMs" default:"10000"`
|
|
TcpStreamChannelTimeoutShow bool `yaml:"tcpStreamChannelTimeoutShow" json:"tcpStreamChannelTimeoutShow" default:"false"`
|
|
ResolutionStrategy string `yaml:"resolutionStrategy" json:"resolutionStrategy" default:"auto"`
|
|
DuplicateTimeframe string `yaml:"duplicateTimeframe" json:"duplicateTimeframe" default:"200ms"`
|
|
DetectDuplicates bool `yaml:"detectDuplicates" json:"detectDuplicates" default:"false"`
|
|
StaleTimeoutSeconds int `yaml:"staleTimeoutSeconds" json:"staleTimeoutSeconds" default:"30"`
|
|
TcpFlowTimeout int `yaml:"tcpFlowTimeout" json:"tcpFlowTimeout" default:"1200"`
|
|
UdpFlowTimeout int `yaml:"udpFlowTimeout" json:"udpFlowTimeout" default:"1200"`
|
|
}
|
|
|
|
type PcapDumpConfig struct {
|
|
PcapDumpEnabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
PcapTimeInterval string `yaml:"timeInterval" json:"timeInterval" default:"1m"`
|
|
PcapMaxTime string `yaml:"maxTime" json:"maxTime" default:"1h"`
|
|
PcapMaxSize string `yaml:"maxSize" json:"maxSize" default:"500MB"`
|
|
PcapTime string `yaml:"time" json:"time" default:"time"`
|
|
PcapDebug bool `yaml:"debug" json:"debug" default:"false"`
|
|
PcapDest string `yaml:"dest" json:"dest" default:""`
|
|
}
|
|
|
|
type PortMapping struct {
|
|
HTTP []uint16 `yaml:"http" json:"http"`
|
|
AMQP []uint16 `yaml:"amqp" json:"amqp"`
|
|
KAFKA []uint16 `yaml:"kafka" json:"kafka"`
|
|
MONGODB []uint16 `yaml:"mongodb" json:"mongodb"`
|
|
MYSQL []uint16 `yaml:"mysql" json:"mysql"`
|
|
POSTGRESQL []uint16 `yaml:"postgresql" json:"postgresql"`
|
|
REDIS []uint16 `yaml:"redis" json:"redis"`
|
|
LDAP []uint16 `yaml:"ldap" json:"ldap"`
|
|
DIAMETER []uint16 `yaml:"diameter" json:"diameter"`
|
|
}
|
|
|
|
type SecurityContextConfig struct {
|
|
Privileged bool `yaml:"privileged" json:"privileged" default:"true"`
|
|
AppArmorProfile AppArmorProfileConfig `yaml:"appArmorProfile" json:"appArmorProfile"`
|
|
SeLinuxOptions SeLinuxOptionsConfig `yaml:"seLinuxOptions" json:"seLinuxOptions"`
|
|
Capabilities CapabilitiesConfig `yaml:"capabilities" json:"capabilities"`
|
|
}
|
|
|
|
type AppArmorProfileConfig struct {
|
|
Type string `yaml:"type" json:"type"`
|
|
LocalhostProfile string `yaml:"localhostProfile" json:"localhostProfile"`
|
|
}
|
|
|
|
type SeLinuxOptionsConfig struct {
|
|
Level string `yaml:"level" json:"level"`
|
|
Role string `yaml:"role" json:"role"`
|
|
Type string `yaml:"type" json:"type"`
|
|
User string `yaml:"user" json:"user"`
|
|
}
|
|
|
|
type RawCaptureConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"true"`
|
|
StorageSize string `yaml:"storageSize" json:"storageSize" default:"1Gi"`
|
|
}
|
|
|
|
type SnapshotsLocalConfig struct {
|
|
StorageClass string `yaml:"storageClass" json:"storageClass" default:""`
|
|
StorageSize string `yaml:"storageSize" json:"storageSize" default:"20Gi"`
|
|
}
|
|
|
|
type SnapshotsCloudS3Config struct {
|
|
Bucket string `yaml:"bucket" json:"bucket" default:""`
|
|
Region string `yaml:"region" json:"region" default:""`
|
|
AccessKey string `yaml:"accessKey" json:"accessKey" default:""`
|
|
SecretKey string `yaml:"secretKey" json:"secretKey" default:""`
|
|
RoleArn string `yaml:"roleArn" json:"roleArn" default:""`
|
|
ExternalId string `yaml:"externalId" json:"externalId" default:""`
|
|
}
|
|
|
|
type SnapshotsCloudAzblobConfig struct {
|
|
StorageAccount string `yaml:"storageAccount" json:"storageAccount" default:""`
|
|
Container string `yaml:"container" json:"container" default:""`
|
|
StorageKey string `yaml:"storageKey" json:"storageKey" default:""`
|
|
}
|
|
|
|
type SnapshotsCloudGCSConfig struct {
|
|
Bucket string `yaml:"bucket" json:"bucket" default:""`
|
|
Project string `yaml:"project" json:"project" default:""`
|
|
CredentialsJson string `yaml:"credentialsJson" json:"credentialsJson" default:""`
|
|
}
|
|
|
|
type SnapshotsCloudConfig struct {
|
|
Provider string `yaml:"provider" json:"provider" default:""`
|
|
Prefix string `yaml:"prefix" json:"prefix" default:""`
|
|
ConfigMaps []string `yaml:"configMaps" json:"configMaps" default:"[]"`
|
|
Secrets []string `yaml:"secrets" json:"secrets" default:"[]"`
|
|
S3 SnapshotsCloudS3Config `yaml:"s3" json:"s3"`
|
|
Azblob SnapshotsCloudAzblobConfig `yaml:"azblob" json:"azblob"`
|
|
GCS SnapshotsCloudGCSConfig `yaml:"gcs" json:"gcs"`
|
|
}
|
|
|
|
type SnapshotsConfig struct {
|
|
Local SnapshotsLocalConfig `yaml:"local" json:"local"`
|
|
Cloud SnapshotsCloudConfig `yaml:"cloud" json:"cloud"`
|
|
}
|
|
|
|
type DelayedDissectionConfig struct {
|
|
CPU string `yaml:"cpu" json:"cpu" default:"1"`
|
|
Memory string `yaml:"memory" json:"memory" default:"4Gi"`
|
|
StorageSize string `yaml:"storageSize" json:"storageSize" default:""`
|
|
StorageClass string `yaml:"storageClass" json:"storageClass" default:""`
|
|
}
|
|
|
|
type DissectionConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"true"`
|
|
StopAfter string `yaml:"stopAfter" json:"stopAfter" default:"5m"`
|
|
}
|
|
|
|
type CaptureConfig struct {
|
|
Dissection DissectionConfig `yaml:"dissection" json:"dissection"`
|
|
CaptureSelf bool `yaml:"captureSelf" json:"captureSelf" default:"false"`
|
|
Raw RawCaptureConfig `yaml:"raw" json:"raw"`
|
|
DbMaxSize string `yaml:"dbMaxSize" json:"dbMaxSize" default:"500Mi"`
|
|
}
|
|
|
|
type TapConfig struct {
|
|
Docker DockerConfig `yaml:"docker" json:"docker"`
|
|
Proxy ProxyConfig `yaml:"proxy" json:"proxy"`
|
|
PodRegexStr string `yaml:"regex" json:"regex" default:".*"`
|
|
Namespaces []string `yaml:"namespaces" json:"namespaces" default:"[]"`
|
|
ExcludedNamespaces []string `yaml:"excludedNamespaces" json:"excludedNamespaces" default:"[]"`
|
|
BpfOverride string `yaml:"bpfOverride" json:"bpfOverride" default:""`
|
|
Capture CaptureConfig `yaml:"capture" json:"capture"`
|
|
DelayedDissection DelayedDissectionConfig `yaml:"delayedDissection" json:"delayedDissection"`
|
|
Snapshots SnapshotsConfig `yaml:"snapshots" json:"snapshots"`
|
|
Release ReleaseConfig `yaml:"release" json:"release"`
|
|
PersistentStorage bool `yaml:"persistentStorage" json:"persistentStorage" default:"false"`
|
|
PersistentStorageStatic bool `yaml:"persistentStorageStatic" json:"persistentStorageStatic" default:"false"`
|
|
PersistentStoragePvcVolumeMode string `yaml:"persistentStoragePvcVolumeMode" json:"persistentStoragePvcVolumeMode" default:"FileSystem"`
|
|
EfsFileSytemIdAndPath string `yaml:"efsFileSytemIdAndPath" json:"efsFileSytemIdAndPath" default:""`
|
|
Secrets []string `yaml:"secrets" json:"secrets" default:"[]"`
|
|
StorageLimit string `yaml:"storageLimit" json:"storageLimit" default:"10Gi"`
|
|
StorageClass string `yaml:"storageClass" json:"storageClass" default:"standard"`
|
|
DryRun bool `yaml:"dryRun" json:"dryRun" default:"false"`
|
|
DnsConfig DnsConfig `yaml:"dns" json:"dns"`
|
|
Resources ResourcesConfig `yaml:"resources" json:"resources"`
|
|
Probes ProbesConfig `yaml:"probes" json:"probes"`
|
|
ServiceMesh bool `yaml:"serviceMesh" json:"serviceMesh" default:"true"`
|
|
Tls bool `yaml:"tls" json:"tls" default:"true"`
|
|
DisableTlsLog bool `yaml:"disableTlsLog" json:"disableTlsLog" default:"true"`
|
|
PacketCapture string `yaml:"packetCapture" json:"packetCapture" default:"best"`
|
|
Labels map[string]string `yaml:"labels" json:"labels" default:"{}"`
|
|
Annotations map[string]string `yaml:"annotations" json:"annotations" default:"{}"`
|
|
NodeSelectorTerms NodeSelectorTermsConfig `yaml:"nodeSelectorTerms" json:"nodeSelectorTerms" default:"{}"`
|
|
Tolerations TolerationsConfig `yaml:"tolerations" json:"tolerations" default:"{}"`
|
|
Auth AuthConfig `yaml:"auth" json:"auth"`
|
|
Ingress IngressConfig `yaml:"ingress" json:"ingress"`
|
|
PriorityClass string `yaml:"priorityClass" json:"priorityClass" default:""`
|
|
Routing RoutingConfig `yaml:"routing" json:"routing"`
|
|
IPv6 bool `yaml:"ipv6" json:"ipv6" default:"true"`
|
|
Debug bool `yaml:"debug" json:"debug" default:"false"`
|
|
Dashboard DashboardConfig `yaml:"dashboard" json:"dashboard"`
|
|
Telemetry TelemetryConfig `yaml:"telemetry" json:"telemetry"`
|
|
ResourceGuard ResourceGuardConfig `yaml:"resourceGuard" json:"resourceGuard"`
|
|
Watchdog WatchdogConfig `yaml:"watchdog" json:"watchdog"`
|
|
Gitops GitopsConfig `yaml:"gitops" json:"gitops"`
|
|
Sentry SentryConfig `yaml:"sentry" json:"sentry"`
|
|
DefaultFilter string `yaml:"defaultFilter" json:"defaultFilter" default:""`
|
|
GlobalFilter string `yaml:"globalFilter" json:"globalFilter" default:""`
|
|
EnabledDissectors []string `yaml:"enabledDissectors" json:"enabledDissectors"`
|
|
PortMapping PortMapping `yaml:"portMapping" json:"portMapping"`
|
|
CustomMacros map[string]string `yaml:"customMacros" json:"customMacros" default:"{\"https\":\"tls and (http or http2)\"}"`
|
|
Metrics MetricsConfig `yaml:"metrics" json:"metrics"`
|
|
Pprof PprofConfig `yaml:"pprof" json:"pprof"`
|
|
Misc MiscConfig `yaml:"misc" json:"misc"`
|
|
SecurityContext SecurityContextConfig `yaml:"securityContext" json:"securityContext"`
|
|
MountBpf bool `yaml:"mountBpf" json:"mountBpf" default:"true"`
|
|
HostNetwork bool `yaml:"hostNetwork" json:"hostNetwork" default:"true"`
|
|
}
|
|
|
|
func (config *TapConfig) PodRegex() *regexp.Regexp {
|
|
podRegex, _ := regexp.Compile(config.PodRegexStr)
|
|
return podRegex
|
|
}
|
|
|
|
func (config *TapConfig) Validate() error {
|
|
_, compileErr := regexp.Compile(config.PodRegexStr)
|
|
if compileErr != nil {
|
|
return fmt.Errorf("%s is not a valid regex %s", config.PodRegexStr, compileErr)
|
|
}
|
|
|
|
return nil
|
|
}
|