mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-07-13 02:20:15 +00:00
7b5954ea00
* helm: grant hub tokenreviews and pass trusted controllers Adds RBAC for hub to call the authentication.k8s.io/v1 TokenReview endpoint, used by the new internalauth middleware to validate projected ServiceAccountTokens presented by in-cluster gRPC callers. Adds tap.internalAuth.trustedControllers value (empty by default), threaded through to hub's -trusted-controllers flag as a CSV. Listing a controller here lets pods owned by it authenticate to hub via the projected SA token (audience kubeshark-hub). Hub-spawned Jobs are always trusted regardless of this list. Hub matches OwnerReferences by name AND UID, so a name-only forgery does not grant trust. Sub-issue of kubeshark/hub#656. * helm: inline trusted controllers in hub deployment template The chart already knows its own controller names (worker DaemonSet metadata.name is the literal "kubeshark-worker-daemon-set" in 09-worker-daemon-set.yaml). Pasting the same literal into a user-facing tap.internalAuth.trustedControllers value adds a step without buying anything — if the worker DS rename, the deployment template would have to change in lockstep regardless. Drop the values knob, render the flag unconditionally with the literal worker DS name (matching the convention used elsewhere in this chart, e.g. the hub deployment's {{ include "kubeshark.name" . }}-hub). * helm: drop redundant comment on tokenreviews RBAC * helm: drop -trusted-controllers flag (no caller today) The flag was wiring forward-prep for a hypothetical worker->hub gRPC caller from the DaemonSet. Hub-spawned Jobs (dissection-job) are admitted via internalauth.RegisterSpawnedJob, not via this flag. Re-add when an actual DaemonSet-deployed caller materializes. * helm: label worker DS pods for hub internal auth Worker pods don't call hub gRPC today, but pre-labeling the DS pod template means a future worker->hub gRPC caller is one PR (worker-side) away from working — no chart change required. Matches the generic label-driven trust model in hub#783. * helm: rename trust label to kubeshark.io/internal-auth Matches the hub rename. Generic name so the same label can mark pods trusted by future kubeshark services beyond hub.
433 lines
17 KiB
YAML
433 lines
17 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
labels:
|
|
app.kubeshark.com/app: worker
|
|
sidecar.istio.io/inject: "false"
|
|
{{- include "kubeshark.labels" . | nindent 4 }}
|
|
{{- if .Values.tap.annotations }}
|
|
annotations:
|
|
{{- toYaml .Values.tap.annotations | nindent 4 }}
|
|
{{- end }}
|
|
name: kubeshark-worker-daemon-set
|
|
namespace: {{ .Release.Namespace }}
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubeshark.com/app: worker
|
|
{{- include "kubeshark.selectorLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubeshark.com/app: worker
|
|
kubeshark.io/internal-auth: "true"
|
|
{{- include "kubeshark.labels" . | nindent 8 }}
|
|
name: kubeshark-worker-daemon-set
|
|
namespace: kubeshark
|
|
spec:
|
|
{{- if or .Values.tap.mountBpf .Values.tap.persistentStorage}}
|
|
initContainers:
|
|
{{- end }}
|
|
{{- if .Values.tap.mountBpf }}
|
|
- command:
|
|
- /bin/sh
|
|
- -c
|
|
- mkdir -p /sys/fs/bpf && mount | grep -q '/sys/fs/bpf' || mount -t bpf bpf /sys/fs/bpf
|
|
{{- if .Values.tap.docker.overrideTag.worker }}
|
|
image: '{{ .Values.tap.docker.registry }}/worker:{{ .Values.tap.docker.overrideTag.worker }}{{ include "kubeshark.dockerTagDebugVersion" . }}'
|
|
{{ else }}
|
|
image: '{{ .Values.tap.docker.registry }}/worker:{{ not (eq .Values.tap.docker.tag "") | ternary .Values.tap.docker.tag (include "kubeshark.defaultVersion" .) }}{{ include "kubeshark.dockerTagDebugVersion" . }}'
|
|
{{- end }}
|
|
imagePullPolicy: {{ .Values.tap.docker.imagePullPolicy }}
|
|
name: mount-bpf
|
|
securityContext:
|
|
privileged: true
|
|
volumeMounts:
|
|
- mountPath: /sys
|
|
name: sys
|
|
mountPropagation: Bidirectional
|
|
{{- end }}
|
|
{{- if .Values.tap.persistentStorage }}
|
|
- command:
|
|
- /bin/sh
|
|
- -c
|
|
- mkdir -p /app/data/$NODE_NAME && rm -rf /app/data/$NODE_NAME/tracer_*
|
|
{{- if .Values.tap.docker.overrideTag.worker }}
|
|
image: '{{ .Values.tap.docker.registry }}/worker:{{ .Values.tap.docker.overrideTag.worker }}{{ include "kubeshark.dockerTagDebugVersion" . }}'
|
|
{{ else }}
|
|
image: '{{ .Values.tap.docker.registry }}/worker:{{ not (eq .Values.tap.docker.tag "") | ternary .Values.tap.docker.tag (include "kubeshark.defaultVersion" .) }}{{ include "kubeshark.dockerTagDebugVersion" . }}'
|
|
{{- end }}
|
|
imagePullPolicy: {{ .Values.tap.docker.imagePullPolicy }}
|
|
name: cleanup-data-dir
|
|
env:
|
|
- name: NODE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
volumeMounts:
|
|
- mountPath: /app/data
|
|
name: data
|
|
{{- end }}
|
|
containers:
|
|
- command:
|
|
- ./worker
|
|
- -i
|
|
- any
|
|
- -port
|
|
- '{{ .Values.tap.proxy.worker.srvPort }}'
|
|
- -metrics-port
|
|
- '{{ .Values.tap.metrics.port }}'
|
|
- -packet-capture
|
|
- '{{ .Values.tap.packetCapture }}'
|
|
- -loglevel
|
|
- '{{ .Values.logLevel | default "warning" }}'
|
|
{{- if not .Values.tap.tls }}
|
|
- -disable-tracer
|
|
{{- end }}
|
|
{{- if .Values.tap.serviceMesh }}
|
|
- -servicemesh
|
|
{{- end }}
|
|
- -procfs
|
|
- /hostproc
|
|
{{- if .Values.tap.resourceGuard.enabled }}
|
|
- -enable-resource-guard
|
|
{{- end }}
|
|
{{- if .Values.tap.watchdog.enabled }}
|
|
- -enable-watchdog
|
|
{{- end }}
|
|
- -resolution-strategy
|
|
- '{{ .Values.tap.misc.resolutionStrategy }}'
|
|
- -staletimeout
|
|
- '{{ .Values.tap.misc.staleTimeoutSeconds }}'
|
|
- -tcp-flow-full-timeout
|
|
- '{{ .Values.tap.misc.tcpFlowTimeout }}'
|
|
- -udp-flow-full-timeout
|
|
- '{{ .Values.tap.misc.udpFlowTimeout }}'
|
|
- -storage-size
|
|
- '{{ .Values.tap.storageLimit }}'
|
|
- -capture-db-max-size
|
|
- '{{ .Values.tap.capture.dbMaxSize }}'
|
|
- -cloud-api-url
|
|
- '{{ .Values.cloudApiUrl }}'
|
|
{{- if .Values.tap.docker.overrideImage.worker }}
|
|
image: '{{ .Values.tap.docker.overrideImage.worker }}'
|
|
{{- else if .Values.tap.docker.overrideTag.worker }}
|
|
image: '{{ .Values.tap.docker.registry }}/worker:{{ .Values.tap.docker.overrideTag.worker }}{{ include "kubeshark.dockerTagDebugVersion" . }}'
|
|
{{ else }}
|
|
image: '{{ .Values.tap.docker.registry }}/worker:{{ not (eq .Values.tap.docker.tag "") | ternary .Values.tap.docker.tag (include "kubeshark.defaultVersion" .) }}{{ include "kubeshark.dockerTagDebugVersion" . }}'
|
|
{{- end }}
|
|
imagePullPolicy: {{ .Values.tap.docker.imagePullPolicy }}
|
|
name: sniffer
|
|
ports:
|
|
- containerPort: {{ .Values.tap.metrics.port }}
|
|
protocol: TCP
|
|
name: metrics
|
|
env:
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: NODE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
- name: TCP_STREAM_CHANNEL_TIMEOUT_MS
|
|
value: '{{ .Values.tap.misc.tcpStreamChannelTimeoutMs }}'
|
|
- name: TCP_STREAM_CHANNEL_TIMEOUT_SHOW
|
|
value: '{{ .Values.tap.misc.tcpStreamChannelTimeoutShow }}'
|
|
- name: PROFILING_ENABLED
|
|
value: '{{ .Values.tap.pprof.enabled }}'
|
|
- name: SENTRY_ENABLED
|
|
value: '{{ (include "sentry.enabled" .) }}'
|
|
- name: SENTRY_ENVIRONMENT
|
|
value: '{{ .Values.tap.sentry.environment }}'
|
|
resources:
|
|
limits:
|
|
{{ if ne (toString .Values.tap.resources.sniffer.limits.cpu) "0" }}
|
|
cpu: {{ .Values.tap.resources.sniffer.limits.cpu }}
|
|
{{ end }}
|
|
{{ if ne (toString .Values.tap.resources.sniffer.limits.memory) "0" }}
|
|
memory: {{ .Values.tap.resources.sniffer.limits.memory }}
|
|
{{ end }}
|
|
requests:
|
|
{{ if ne (toString .Values.tap.resources.sniffer.requests.cpu) "0" }}
|
|
cpu: {{ .Values.tap.resources.sniffer.requests.cpu }}
|
|
{{ end }}
|
|
{{ if ne (toString .Values.tap.resources.sniffer.requests.memory) "0" }}
|
|
memory: {{ .Values.tap.resources.sniffer.requests.memory }}
|
|
{{ end }}
|
|
securityContext:
|
|
privileged: {{ .Values.tap.securityContext.privileged }}
|
|
{{- if not .Values.tap.securityContext.privileged }}
|
|
{{- $aaProfile := .Values.tap.securityContext.appArmorProfile }}
|
|
{{- $selinuxOpts := .Values.tap.securityContext.seLinuxOptions }}
|
|
{{- if or (ne $aaProfile.type "") (ne $aaProfile.localhostProfile "") }}
|
|
appArmorProfile:
|
|
{{- if ne $aaProfile.type "" }}
|
|
type: {{ $aaProfile.type }}
|
|
{{- end }}
|
|
{{- if ne $aaProfile.localhostProfile "" }}
|
|
localhostProfile: {{ $aaProfile.localhostProfile }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if or (ne $selinuxOpts.level "") (ne $selinuxOpts.role "") (ne $selinuxOpts.type "") (ne $selinuxOpts.user "") }}
|
|
seLinuxOptions:
|
|
{{- if ne $selinuxOpts.level "" }}
|
|
level: {{ $selinuxOpts.level }}
|
|
{{- end }}
|
|
{{- if ne $selinuxOpts.role "" }}
|
|
role: {{ $selinuxOpts.role }}
|
|
{{- end }}
|
|
{{- if ne $selinuxOpts.type "" }}
|
|
type: {{ $selinuxOpts.type }}
|
|
{{- end }}
|
|
{{- if ne $selinuxOpts.user "" }}
|
|
user: {{ $selinuxOpts.user }}
|
|
{{- end }}
|
|
{{- end }}
|
|
capabilities:
|
|
add:
|
|
{{- range .Values.tap.securityContext.capabilities.networkCapture }}
|
|
{{ print "- " . }}
|
|
{{- end }}
|
|
{{- if .Values.tap.serviceMesh }}
|
|
{{- range .Values.tap.securityContext.capabilities.serviceMeshCapture }}
|
|
{{ print "- " . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.tap.securityContext.capabilities.ebpfCapture }}
|
|
{{- range .Values.tap.securityContext.capabilities.ebpfCapture }}
|
|
{{ print "- " . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
drop:
|
|
- ALL
|
|
{{- end }}
|
|
readinessProbe:
|
|
periodSeconds: {{ .Values.tap.probes.sniffer.periodSeconds }}
|
|
failureThreshold: {{ .Values.tap.probes.sniffer.failureThreshold }}
|
|
successThreshold: {{ .Values.tap.probes.sniffer.successThreshold }}
|
|
initialDelaySeconds: {{ .Values.tap.probes.sniffer.initialDelaySeconds }}
|
|
tcpSocket:
|
|
port: {{ .Values.tap.proxy.worker.srvPort }}
|
|
livenessProbe:
|
|
periodSeconds: {{ .Values.tap.probes.sniffer.periodSeconds }}
|
|
failureThreshold: {{ .Values.tap.probes.sniffer.failureThreshold }}
|
|
successThreshold: {{ .Values.tap.probes.sniffer.successThreshold }}
|
|
initialDelaySeconds: {{ .Values.tap.probes.sniffer.initialDelaySeconds }}
|
|
tcpSocket:
|
|
port: {{ .Values.tap.proxy.worker.srvPort }}
|
|
volumeMounts:
|
|
- mountPath: /hostproc
|
|
name: proc
|
|
readOnly: true
|
|
- mountPath: /sys
|
|
name: sys
|
|
readOnly: true
|
|
mountPropagation: HostToContainer
|
|
- mountPath: /app/data
|
|
name: data
|
|
{{- if .Values.tap.persistentStorage }}
|
|
subPathExpr: $(NODE_NAME)
|
|
{{- end }}
|
|
{{- if .Values.tap.tls }}
|
|
- command:
|
|
- ./tracer
|
|
- -procfs
|
|
- /hostproc
|
|
{{- if .Values.tap.disableTlsLog }}
|
|
- -disable-tls-log
|
|
{{- end }}
|
|
{{- if .Values.tap.pprof.enabled }}
|
|
- -port
|
|
- '{{ add .Values.tap.proxy.worker.srvPort 1 }}'
|
|
{{- end }}
|
|
- -loglevel
|
|
- '{{ .Values.logLevel | default "warning" }}'
|
|
{{- if .Values.tap.docker.overrideTag.worker }}
|
|
image: '{{ .Values.tap.docker.registry }}/worker:{{ .Values.tap.docker.overrideTag.worker }}{{ include "kubeshark.dockerTagDebugVersion" . }}'
|
|
{{ else }}
|
|
image: '{{ .Values.tap.docker.registry }}/worker:{{ not (eq .Values.tap.docker.tag "") | ternary .Values.tap.docker.tag (include "kubeshark.defaultVersion" .) }}{{ include "kubeshark.dockerTagDebugVersion" . }}'
|
|
{{- end }}
|
|
imagePullPolicy: {{ .Values.tap.docker.imagePullPolicy }}
|
|
name: tracer
|
|
env:
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: NODE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
- name: PROFILING_ENABLED
|
|
value: '{{ .Values.tap.pprof.enabled }}'
|
|
- name: SENTRY_ENABLED
|
|
value: '{{ (include "sentry.enabled" .) }}'
|
|
- name: SENTRY_ENVIRONMENT
|
|
value: '{{ .Values.tap.sentry.environment }}'
|
|
resources:
|
|
limits:
|
|
{{ if ne (toString .Values.tap.resources.tracer.limits.cpu) "0" }}
|
|
cpu: {{ .Values.tap.resources.tracer.limits.cpu }}
|
|
{{ end }}
|
|
{{ if ne (toString .Values.tap.resources.tracer.limits.memory) "0" }}
|
|
memory: {{ .Values.tap.resources.tracer.limits.memory }}
|
|
{{ end }}
|
|
requests:
|
|
{{ if ne (toString .Values.tap.resources.tracer.requests.cpu) "0" }}
|
|
cpu: {{ .Values.tap.resources.tracer.requests.cpu }}
|
|
{{ end }}
|
|
{{ if ne (toString .Values.tap.resources.tracer.requests.memory) "0" }}
|
|
memory: {{ .Values.tap.resources.tracer.requests.memory }}
|
|
{{ end }}
|
|
securityContext:
|
|
privileged: {{ .Values.tap.securityContext.privileged }}
|
|
{{- if not .Values.tap.securityContext.privileged }}
|
|
{{- $aaProfile := .Values.tap.securityContext.appArmorProfile }}
|
|
{{- $selinuxOpts := .Values.tap.securityContext.seLinuxOptions }}
|
|
{{- if or (ne $aaProfile.type "") (ne $aaProfile.localhostProfile "") }}
|
|
appArmorProfile:
|
|
{{- if ne $aaProfile.type "" }}
|
|
type: {{ $aaProfile.type }}
|
|
{{- end }}
|
|
{{- if ne $aaProfile.localhostProfile "" }}
|
|
localhostProfile: {{ $aaProfile.localhostProfile }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if or (ne $selinuxOpts.level "") (ne $selinuxOpts.role "") (ne $selinuxOpts.type "") (ne $selinuxOpts.user "") }}
|
|
seLinuxOptions:
|
|
{{- if ne $selinuxOpts.level "" }}
|
|
level: {{ $selinuxOpts.level }}
|
|
{{- end }}
|
|
{{- if ne $selinuxOpts.role "" }}
|
|
role: {{ $selinuxOpts.role }}
|
|
{{- end }}
|
|
{{- if ne $selinuxOpts.type "" }}
|
|
type: {{ $selinuxOpts.type }}
|
|
{{- end }}
|
|
{{- if ne $selinuxOpts.user "" }}
|
|
user: {{ $selinuxOpts.user }}
|
|
{{- end }}
|
|
{{- end }}
|
|
capabilities:
|
|
add:
|
|
{{- range .Values.tap.securityContext.capabilities.ebpfCapture }}
|
|
{{ print "- " . }}
|
|
{{- end }}
|
|
{{- range .Values.tap.securityContext.capabilities.networkCapture }}
|
|
{{ print "- " . }}
|
|
{{- end }}
|
|
drop:
|
|
- ALL
|
|
{{- end }}
|
|
volumeMounts:
|
|
- mountPath: /hostproc
|
|
name: proc
|
|
readOnly: true
|
|
- mountPath: /sys
|
|
name: sys
|
|
readOnly: true
|
|
mountPropagation: HostToContainer
|
|
- mountPath: /app/data
|
|
name: data
|
|
{{- if .Values.tap.persistentStorage }}
|
|
subPathExpr: $(NODE_NAME)
|
|
{{- end }}
|
|
- mountPath: /etc/os-release
|
|
name: os-release
|
|
readOnly: true
|
|
- mountPath: /hostroot
|
|
mountPropagation: HostToContainer
|
|
name: root
|
|
readOnly: true
|
|
{{- end }}
|
|
dnsPolicy: ClusterFirstWithHostNet
|
|
hostNetwork: {{ .Values.tap.hostNetwork }}
|
|
serviceAccountName: {{ include "kubeshark.serviceAccountName" . }}
|
|
{{- if .Values.tap.priorityClass }}
|
|
priorityClassName: {{ .Values.tap.priorityClass | quote }}
|
|
{{- end }}
|
|
{{- if .Values.tap.tolerations.workers }}
|
|
tolerations:
|
|
{{- range .Values.tap.tolerations.workers }}
|
|
- key: {{ .key | quote }}
|
|
operator: {{ .operator | quote }}
|
|
{{- if .value }}
|
|
value: {{ .value | quote }}
|
|
{{- end }}
|
|
{{- if .effect }}
|
|
effect: {{ .effect | quote }}
|
|
{{- end }}
|
|
{{- if .tolerationSeconds }}
|
|
tolerationSeconds: {{ .tolerationSeconds }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if gt (len .Values.tap.nodeSelectorTerms.workers) 0}}
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
{{- toYaml .Values.tap.nodeSelectorTerms.workers | nindent 12 }}
|
|
{{- end }}
|
|
{{- if or .Values.tap.dns.nameservers .Values.tap.dns.searches .Values.tap.dns.options }}
|
|
dnsConfig:
|
|
{{- if .Values.tap.dns.nameservers }}
|
|
nameservers:
|
|
{{- range .Values.tap.dns.nameservers }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.tap.dns.searches }}
|
|
searches:
|
|
{{- range .Values.tap.dns.searches }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.tap.dns.options }}
|
|
options:
|
|
{{- range .Values.tap.dns.options }}
|
|
- name: {{ .name | quote }}
|
|
{{- if .value }}
|
|
value: {{ .value | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
volumes:
|
|
- hostPath:
|
|
path: /proc
|
|
name: proc
|
|
- hostPath:
|
|
path: /sys
|
|
name: sys
|
|
- name: lib-modules
|
|
hostPath:
|
|
path: /lib/modules
|
|
- hostPath:
|
|
path: /etc/os-release
|
|
name: os-release
|
|
{{- if .Values.tap.tls }}
|
|
- hostPath:
|
|
path: /
|
|
name: root
|
|
{{- end }}
|
|
- name: data
|
|
{{- if .Values.tap.persistentStorage }}
|
|
persistentVolumeClaim:
|
|
claimName: kubeshark-persistent-volume-claim
|
|
{{- else }}
|
|
emptyDir:
|
|
sizeLimit: {{ .Values.tap.storageLimit }}
|
|
{{- end }}
|