mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-07-14 19:13:54 +00:00
28079745c7
Conflicts were in the helm chart's auth config, where master's permissions
refactor (fcceed23) reordered the AUTH_* config-map keys and replaced the
inline tap.auth.roles tree with roles/rolesClaim/defaultRole/groupMapping —
directly alongside gated-auth's new CLI ServiceAccount-token auth. Neither
side removed the other's work, so both are kept.
Also promote tap.auth.cli to a real config field. It had been hand-written
into helm-chart/values.yaml, which is generated by `make generate-helm-values`
(bin/kubeshark__ config > helm-chart/values.yaml). The next regeneration would
have silently dropped the key, leaving 22-cli-auth.yaml unable to render the
ServiceAccount. Add CliAuthConfig/CliAuthSubject to AuthConfig and regenerate
values.yaml from source, so the block now round-trips.
Subject fields carry omitempty so User/Group entries don't emit an empty
namespace and ServiceAccount entries don't emit an empty apiGroup, keeping
the rendered RoleBinding idiomatic.
values.yaml is generated and cannot hold comments, so the tap.auth.cli docs
live in helm-chart/README.md alongside the other tap.auth.* rows. Drop the
internal plan phase labels from the CLI and utils comments; phases exist only
in local planning docs.
318 lines
5.5 KiB
YAML
318 lines
5.5 KiB
YAML
tap:
|
|
docker:
|
|
registry: docker.io/kubeshark
|
|
tag: ""
|
|
tagLocked: true
|
|
imagePullPolicy: Always
|
|
imagePullSecrets: []
|
|
overrideImage:
|
|
worker: ""
|
|
hub: ""
|
|
front: ""
|
|
overrideTag:
|
|
worker: ""
|
|
hub: ""
|
|
front: ""
|
|
proxy:
|
|
worker:
|
|
srvPort: 48999
|
|
hub:
|
|
srvPort: 8898
|
|
front:
|
|
port: 8899
|
|
host: 127.0.0.1
|
|
regex: .*
|
|
namespaces: []
|
|
excludedNamespaces: []
|
|
bpfOverride: ""
|
|
capture:
|
|
dissection:
|
|
enabled: true
|
|
stopAfter: 5m
|
|
captureSelf: false
|
|
raw:
|
|
enabled: true
|
|
storageSize: 1Gi
|
|
dbMaxSize: 500Mi
|
|
delayedDissection:
|
|
cpu: "1"
|
|
memory: 4Gi
|
|
storageSize: ""
|
|
storageClass: ""
|
|
snapshots:
|
|
local:
|
|
storageClass: ""
|
|
storageSize: 20Gi
|
|
cloud:
|
|
provider: ""
|
|
prefix: ""
|
|
configMaps: []
|
|
secrets: []
|
|
s3:
|
|
bucket: ""
|
|
region: ""
|
|
accessKey: ""
|
|
secretKey: ""
|
|
roleArn: ""
|
|
externalId: ""
|
|
azblob:
|
|
storageAccount: ""
|
|
container: ""
|
|
storageKey: ""
|
|
gcs:
|
|
bucket: ""
|
|
project: ""
|
|
credentialsJson: ""
|
|
release:
|
|
repo: https://helm.kubeshark.com
|
|
name: kubeshark
|
|
namespace: default
|
|
helmChartPath: ""
|
|
persistentStorage: false
|
|
persistentStorageStatic: false
|
|
persistentStoragePvcVolumeMode: FileSystem
|
|
efsFileSytemIdAndPath: ""
|
|
secrets: []
|
|
storageLimit: 10Gi
|
|
storageClass: standard
|
|
dryRun: false
|
|
dns:
|
|
nameservers: []
|
|
searches: []
|
|
options: []
|
|
resources:
|
|
hub:
|
|
limits:
|
|
cpu: "0"
|
|
memory: 5Gi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 50Mi
|
|
sniffer:
|
|
limits:
|
|
cpu: "0"
|
|
memory: 5Gi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 50Mi
|
|
tracer:
|
|
limits:
|
|
cpu: "0"
|
|
memory: 5Gi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 50Mi
|
|
probes:
|
|
hub:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
successThreshold: 1
|
|
failureThreshold: 3
|
|
sniffer:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
successThreshold: 1
|
|
failureThreshold: 3
|
|
serviceMesh: true
|
|
tls: true
|
|
disableTlsLog: true
|
|
packetCapture: best
|
|
labels: {}
|
|
annotations: {}
|
|
nodeSelectorTerms:
|
|
hub:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/os
|
|
operator: In
|
|
values:
|
|
- linux
|
|
workers:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/os
|
|
operator: In
|
|
values:
|
|
- linux
|
|
front:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/os
|
|
operator: In
|
|
values:
|
|
- linux
|
|
dex:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/os
|
|
operator: In
|
|
values:
|
|
- linux
|
|
tolerations:
|
|
hub: []
|
|
workers:
|
|
- operator: Exists
|
|
effect: NoExecute
|
|
front: []
|
|
auth:
|
|
enabled: false
|
|
type: saml
|
|
rolesClaim: groups
|
|
defaultRole: kubeshark-viewer
|
|
groupMapping: {}
|
|
roles: {}
|
|
cli:
|
|
enabled: false
|
|
subjects: []
|
|
saml:
|
|
idpMetadataUrl: ""
|
|
x509crt: ""
|
|
x509key: ""
|
|
ingress:
|
|
enabled: false
|
|
className: ""
|
|
host: ks.svc.cluster.local
|
|
path: /
|
|
tls: []
|
|
annotations: {}
|
|
priorityClass: ""
|
|
routing:
|
|
front:
|
|
basePath: ""
|
|
ipv6: true
|
|
debug: false
|
|
dashboard:
|
|
streamingType: connect-rpc
|
|
completeStreamingEnabled: true
|
|
clusterWideMapEnabled: false
|
|
entriesLimit: "300000"
|
|
telemetry:
|
|
enabled: true
|
|
resourceGuard:
|
|
enabled: false
|
|
watchdog:
|
|
enabled: false
|
|
gitops:
|
|
enabled: false
|
|
sentry:
|
|
enabled: false
|
|
environment: production
|
|
defaultFilter: ""
|
|
globalFilter: ""
|
|
enabledDissectors:
|
|
- amqp
|
|
- dns
|
|
- http
|
|
- icmp
|
|
- kafka
|
|
- mongodb
|
|
- mysql
|
|
- postgresql
|
|
- redis
|
|
- ws
|
|
- tlsx
|
|
- ldap
|
|
- radius
|
|
- diameter
|
|
- udp-flow
|
|
- tcp-flow
|
|
- udp-conn
|
|
- tcp-conn
|
|
portMapping:
|
|
http:
|
|
- 80
|
|
- 443
|
|
- 8080
|
|
amqp:
|
|
- 5671
|
|
- 5672
|
|
kafka:
|
|
- 9092
|
|
mongodb:
|
|
- 27017
|
|
mysql:
|
|
- 3306
|
|
postgresql:
|
|
- 5432
|
|
redis:
|
|
- 6379
|
|
ldap:
|
|
- 389
|
|
diameter:
|
|
- 3868
|
|
customMacros:
|
|
https: tls and (http or http2)
|
|
metrics:
|
|
port: 49100
|
|
pprof:
|
|
enabled: false
|
|
port: 8000
|
|
view: flamegraph
|
|
misc:
|
|
jsonTTL: 5m
|
|
pcapTTL: "0"
|
|
pcapErrorTTL: "0"
|
|
trafficSampleRate: 100
|
|
tcpStreamChannelTimeoutMs: 10000
|
|
tcpStreamChannelTimeoutShow: false
|
|
resolutionStrategy: auto
|
|
duplicateTimeframe: 200ms
|
|
detectDuplicates: false
|
|
staleTimeoutSeconds: 30
|
|
tcpFlowTimeout: 1200
|
|
udpFlowTimeout: 1200
|
|
securityContext:
|
|
privileged: true
|
|
appArmorProfile:
|
|
type: ""
|
|
localhostProfile: ""
|
|
seLinuxOptions:
|
|
level: ""
|
|
role: ""
|
|
type: ""
|
|
user: ""
|
|
capabilities:
|
|
networkCapture:
|
|
- NET_RAW
|
|
- NET_ADMIN
|
|
serviceMeshCapture:
|
|
- SYS_ADMIN
|
|
- SYS_PTRACE
|
|
- DAC_OVERRIDE
|
|
ebpfCapture:
|
|
- SYS_ADMIN
|
|
- SYS_PTRACE
|
|
- SYS_RESOURCE
|
|
- IPC_LOCK
|
|
mountBpf: true
|
|
hostNetwork: true
|
|
logs:
|
|
file: ""
|
|
grep: ""
|
|
pcapdump:
|
|
enabled: false
|
|
timeInterval: 1m
|
|
maxTime: 1h
|
|
maxSize: 500MB
|
|
time: time
|
|
debug: false
|
|
dest: ""
|
|
kube:
|
|
configPath: ""
|
|
context: ""
|
|
dumpLogs: false
|
|
headless: false
|
|
license: ""
|
|
cloudApiUrl: https://api.kubeshark.com
|
|
cloudLicenseEnabled: true
|
|
demoModeEnabled: false
|
|
supportChatEnabled: false
|
|
betaEnabled: false
|
|
internetConnectivity: true
|
|
scripting:
|
|
enabled: false
|
|
env: {}
|
|
source: ""
|
|
sources: []
|
|
watchScripts: true
|
|
active: []
|
|
console: true
|
|
timezone: ""
|
|
logLevel: warning
|