mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-07-13 02:20:15 +00:00
c7fe7f4ce5
The local chart never rendered AUTH_GROUP_MAPPING, so tap.auth.groupMapping was silently dropped — SSO groups and the kubeshark-cli SA fell back to AUTH_DEFAULT_ROLE instead of their mapped roles.
85 lines
5.7 KiB
YAML
85 lines
5.7 KiB
YAML
kind: ConfigMap
|
|
apiVersion: v1
|
|
metadata:
|
|
name: {{ include "kubeshark.configmapName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app.kubeshark.com/app: hub
|
|
{{- include "kubeshark.labels" . | nindent 4 }}
|
|
data:
|
|
POD_REGEX: '{{ .Values.tap.regex }}'
|
|
NAMESPACES: '{{ gt (len .Values.tap.namespaces) 0 | ternary (join "," .Values.tap.namespaces) "" }}'
|
|
EXCLUDED_NAMESPACES: '{{ gt (len .Values.tap.excludedNamespaces) 0 | ternary (join "," .Values.tap.excludedNamespaces) "" }}'
|
|
BPF_OVERRIDE: '{{ .Values.tap.bpfOverride }}'
|
|
DISSECTION_ENABLED: '{{ .Values.tap.capture.dissection.enabled | ternary "true" "false" }}'
|
|
CAPTURE_SELF: '{{ .Values.tap.capture.captureSelf | ternary "true" "false" }}'
|
|
SCRIPTING_SCRIPTS: '{}'
|
|
SCRIPTING_ACTIVE_SCRIPTS: '{{ gt (len .Values.scripting.active) 0 | ternary (join "," .Values.scripting.active) "" }}'
|
|
INGRESS_ENABLED: '{{ .Values.tap.ingress.enabled }}'
|
|
INGRESS_HOST: '{{ .Values.tap.ingress.host }}'
|
|
PROXY_FRONT_PORT: '{{ .Values.tap.proxy.front.port }}'
|
|
AUTH_ENABLED: '{{- if and .Values.cloudLicenseEnabled (not (empty .Values.license)) -}}
|
|
{{ (default false .Values.demoModeEnabled) | ternary true ((and .Values.tap.auth.enabled (or (eq .Values.tap.auth.type "oidc") (eq .Values.tap.auth.type "dex"))) | ternary true false) }}
|
|
{{- else -}}
|
|
{{ .Values.cloudLicenseEnabled | ternary "true" ((default false .Values.demoModeEnabled) | ternary "true" .Values.tap.auth.enabled) }}
|
|
{{- end }}'
|
|
AUTH_TYPE: '{{- if and .Values.cloudLicenseEnabled (not (or (eq .Values.tap.auth.type "oidc") (eq .Values.tap.auth.type "dex"))) -}}
|
|
default
|
|
{{- else -}}
|
|
{{ (default false .Values.demoModeEnabled) | ternary "default" .Values.tap.auth.type }}
|
|
{{- end }}'
|
|
AUTH_SAML_IDP_METADATA_URL: '{{ .Values.tap.auth.saml.idpMetadataUrl }}'
|
|
AUTH_ROLES: '{{ .Values.tap.auth.roles | toJson }}'
|
|
AUTH_CLI_SERVICE_ACCOUNTS: '{{ if (((.Values.tap).auth).cli).enabled }}{{ .Release.Namespace }}:kubeshark-cli{{ end }}'
|
|
AUTH_ROLES_CLAIM: '{{ .Values.tap.auth.rolesClaim }}'
|
|
AUTH_DEFAULT_ROLE: '{{ default "" .Values.tap.auth.defaultRole }}'
|
|
AUTH_GROUP_MAPPING: '{{ .Values.tap.auth.groupMapping | default dict | toJson }}'
|
|
AUTH_OIDC_ISSUER: '{{ default "not set" (((.Values.tap).auth).oidc).issuer }}'
|
|
AUTH_OIDC_REFRESH_TOKEN_LIFETIME: '{{ default "3960h" (((.Values.tap).auth).oidc).refreshTokenLifetime }}'
|
|
AUTH_OIDC_STATE_PARAM_EXPIRY: '{{ default "10m" (((.Values.tap).auth).oidc).oauth2StateParamExpiry }}'
|
|
AUTH_OIDC_BYPASS_SSL_CA_CHECK: '{{- if and
|
|
(hasKey .Values.tap "auth")
|
|
(hasKey .Values.tap.auth "oidc")
|
|
(hasKey .Values.tap.auth.oidc "bypassSslCaCheck")
|
|
-}}
|
|
{{ eq .Values.tap.auth.oidc.bypassSslCaCheck true | ternary "true" "false" }}
|
|
{{- else -}}
|
|
false
|
|
{{- end }}'
|
|
TELEMETRY_DISABLED: '{{ not .Values.internetConnectivity | ternary "true" (not .Values.tap.telemetry.enabled | ternary "true" "false") }}'
|
|
SCRIPTING_DISABLED: '{{ default false .Values.demoModeEnabled }}'
|
|
TARGETED_PODS_UPDATE_DISABLED: '{{ default false .Values.demoModeEnabled }}'
|
|
PRESET_FILTERS_CHANGING_ENABLED: '{{ not (default false .Values.demoModeEnabled) }}'
|
|
RECORDING_DISABLED: '{{ (default false .Values.demoModeEnabled) | ternary true false }}'
|
|
DISSECTION_CONTROL_ENABLED: '{{- if and (not .Values.demoModeEnabled) (not .Values.tap.capture.dissection.enabled) -}}
|
|
true
|
|
{{- else -}}
|
|
{{ (default false .Values.demoModeEnabled) | ternary false true }}
|
|
{{- end }}'
|
|
GLOBAL_FILTER: {{ include "kubeshark.escapeDoubleQuotes" .Values.tap.globalFilter | quote }}
|
|
DEFAULT_FILTER: {{ include "kubeshark.escapeDoubleQuotes" .Values.tap.defaultFilter | quote }}
|
|
TRAFFIC_SAMPLE_RATE: '{{ .Values.tap.misc.trafficSampleRate }}'
|
|
JSON_TTL: '{{ .Values.tap.misc.jsonTTL }}'
|
|
PCAP_TTL: '{{ .Values.tap.misc.pcapTTL }}'
|
|
PCAP_ERROR_TTL: '{{ .Values.tap.misc.pcapErrorTTL }}'
|
|
TIMEZONE: '{{ not (eq .Values.timezone "") | ternary .Values.timezone " " }}'
|
|
CLOUD_LICENSE_ENABLED: '{{- if and .Values.cloudLicenseEnabled (not (empty .Values.license)) -}}
|
|
false
|
|
{{- else -}}
|
|
{{ .Values.cloudLicenseEnabled }}
|
|
{{- end }}'
|
|
DUPLICATE_TIMEFRAME: '{{ .Values.tap.misc.duplicateTimeframe }}'
|
|
ENABLED_DISSECTORS: '{{ gt (len .Values.tap.enabledDissectors) 0 | ternary (join "," .Values.tap.enabledDissectors) "" }}'
|
|
CUSTOM_MACROS: '{{ toJson .Values.tap.customMacros }}'
|
|
DISSECTORS_UPDATING_ENABLED: '{{ not (default false .Values.demoModeEnabled) }}'
|
|
SNAPSHOTS_UPDATING_ENABLED: '{{ not (default false .Values.demoModeEnabled) }}'
|
|
DEMO_MODE_ENABLED: '{{ default false .Values.demoModeEnabled }}'
|
|
DETECT_DUPLICATES: '{{ .Values.tap.misc.detectDuplicates | ternary "true" "false" }}'
|
|
PCAP_DUMP_ENABLE: '{{ .Values.pcapdump.enabled }}'
|
|
PCAP_TIME_INTERVAL: '{{ .Values.pcapdump.timeInterval }}'
|
|
PCAP_MAX_TIME: '{{ .Values.pcapdump.maxTime }}'
|
|
PCAP_MAX_SIZE: '{{ .Values.pcapdump.maxSize }}'
|
|
PORT_MAPPING: '{{ toJson .Values.tap.portMapping }}'
|
|
RAW_CAPTURE_ENABLED: '{{ .Values.tap.capture.raw.enabled | ternary "true" "false" }}'
|
|
RAW_CAPTURE_STORAGE_SIZE: '{{ .Values.tap.capture.raw.storageSize }}'
|