mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-09-08 01:07:18 +00:00
Volodymyr Stoiko
ed9ce1b561
* helm: gate worker hub token on the same condition as hub AUTH_ENABLED (#1954) The hub's AUTH_ENABLED is derived from cloudLicenseEnabled/demoModeEnabled/ tap.auth.enabled, but the worker DaemonSet gated HUB_INTERNAL_TOKEN_PATH, its volumeMount and the projected serviceAccountToken on tap.auth.enabled alone. With demoModeEnabled: true (or the default cloudLicenseEnabled: true) and tap.auth.enabled unset, the hub required a bearer token the workers never got, so every worker -> hub call returned 401: tracer target refresh and name resolution history silently stopped while capture kept working. Extract the condition into a kubeshark.authEnabled helper and consume it from both 12-config-map.yaml and 09-worker-daemon-set.yaml so the two cannot drift. AUTH_ENABLED renders identically to before for all combinations of cloudLicenseEnabled/license/demoModeEnabled/tap.auth.enabled/tap.auth.type. * helm: mount the hub internal token in the tracer container too (#1954) The tracer polls the hub's /pods/all and /pods/targeted on every sync cycle, but only the sniffer container received HUB_INTERNAL_TOKEN_PATH and the token mount, so with auth enabled the tracer's requests were rejected and TLS hooking never picked up newly started pods. Wire the same env var and projected-token mount into the tracer container. Requires the matching tracer2 change that sends the Bearer header.
81 lines
5.3 KiB
YAML
81 lines
5.3 KiB
YAML
kind: ConfigMap
|
|
apiVersion: v1
|
|
metadata:
|
|
name: {{ include "kubeshark.configmapName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app.kubeshark.com/app: hub
|
|
{{- include "kubeshark.labels" . | nindent 4 }}
|
|
data:
|
|
POD_REGEX: '{{ .Values.tap.regex }}'
|
|
NAMESPACES: '{{ gt (len .Values.tap.namespaces) 0 | ternary (join "," .Values.tap.namespaces) "" }}'
|
|
EXCLUDED_NAMESPACES: '{{ gt (len .Values.tap.excludedNamespaces) 0 | ternary (join "," .Values.tap.excludedNamespaces) "" }}'
|
|
BPF_OVERRIDE: '{{ .Values.tap.bpfOverride }}'
|
|
DISSECTION_ENABLED: '{{ .Values.tap.capture.dissection.enabled | ternary "true" "false" }}'
|
|
CAPTURE_SELF: '{{ .Values.tap.capture.captureSelf | ternary "true" "false" }}'
|
|
SCRIPTING_SCRIPTS: '{}'
|
|
SCRIPTING_ACTIVE_SCRIPTS: '{{ gt (len .Values.scripting.active) 0 | ternary (join "," .Values.scripting.active) "" }}'
|
|
INGRESS_ENABLED: '{{ .Values.tap.ingress.enabled }}'
|
|
INGRESS_HOST: '{{ .Values.tap.ingress.host }}'
|
|
PROXY_FRONT_PORT: '{{ .Values.tap.proxy.front.port }}'
|
|
AUTH_ENABLED: '{{ include "kubeshark.authEnabled" . }}'
|
|
AUTH_TYPE: '{{- if and .Values.cloudLicenseEnabled (not (or (eq .Values.tap.auth.type "oidc") (eq .Values.tap.auth.type "dex"))) -}}
|
|
default
|
|
{{- else -}}
|
|
{{ (default false .Values.demoModeEnabled) | ternary "default" .Values.tap.auth.type }}
|
|
{{- end }}'
|
|
AUTH_SAML_IDP_METADATA_URL: '{{ .Values.tap.auth.saml.idpMetadataUrl }}'
|
|
AUTH_CLI_SERVICE_ACCOUNTS: '{{ if (((.Values.tap).auth).cli).enabled }}{{ .Release.Namespace }}:kubeshark-cli{{ end }}'
|
|
AUTH_ROLES_CLAIM: '{{ .Values.tap.auth.rolesClaim }}'
|
|
AUTH_DEFAULT_ROLE: '{{ default "" .Values.tap.auth.defaultRole }}'
|
|
AUTH_GROUP_MAPPING: '{{ default (dict) .Values.tap.auth.groupMapping | toJson }}'
|
|
AUTH_ROLES: '{{ default (dict) .Values.tap.auth.roles | toJson }}'
|
|
AUTH_OIDC_ISSUER: '{{ default "not set" (((.Values.tap).auth).oidc).issuer }}'
|
|
AUTH_OIDC_REFRESH_TOKEN_LIFETIME: '{{ default "3960h" (((.Values.tap).auth).oidc).refreshTokenLifetime }}'
|
|
AUTH_OIDC_STATE_PARAM_EXPIRY: '{{ default "10m" (((.Values.tap).auth).oidc).oauth2StateParamExpiry }}'
|
|
AUTH_OIDC_BYPASS_SSL_CA_CHECK: '{{- if and
|
|
(hasKey .Values.tap "auth")
|
|
(hasKey .Values.tap.auth "oidc")
|
|
(hasKey .Values.tap.auth.oidc "bypassSslCaCheck")
|
|
-}}
|
|
{{ eq .Values.tap.auth.oidc.bypassSslCaCheck true | ternary "true" "false" }}
|
|
{{- else -}}
|
|
false
|
|
{{- end }}'
|
|
TELEMETRY_DISABLED: '{{ not .Values.internetConnectivity | ternary "true" (not .Values.tap.telemetry.enabled | ternary "true" "false") }}'
|
|
SCRIPTING_DISABLED: '{{ default false .Values.demoModeEnabled }}'
|
|
TARGETED_PODS_UPDATE_DISABLED: '{{ default false .Values.demoModeEnabled }}'
|
|
PRESET_FILTERS_CHANGING_ENABLED: '{{ not (default false .Values.demoModeEnabled) }}'
|
|
RECORDING_DISABLED: '{{ (default false .Values.demoModeEnabled) | ternary true false }}'
|
|
DISSECTION_CONTROL_ENABLED: '{{- if and (not .Values.demoModeEnabled) (not .Values.tap.capture.dissection.enabled) -}}
|
|
true
|
|
{{- else -}}
|
|
{{ (default false .Values.demoModeEnabled) | ternary false true }}
|
|
{{- end }}'
|
|
GLOBAL_FILTER: {{ include "kubeshark.escapeDoubleQuotes" .Values.tap.globalFilter | quote }}
|
|
DEFAULT_FILTER: {{ include "kubeshark.escapeDoubleQuotes" .Values.tap.defaultFilter | quote }}
|
|
TRAFFIC_SAMPLE_RATE: '{{ .Values.tap.misc.trafficSampleRate }}'
|
|
JSON_TTL: '{{ .Values.tap.misc.jsonTTL }}'
|
|
PCAP_TTL: '{{ .Values.tap.misc.pcapTTL }}'
|
|
PCAP_ERROR_TTL: '{{ .Values.tap.misc.pcapErrorTTL }}'
|
|
TIMEZONE: '{{ not (eq .Values.timezone "") | ternary .Values.timezone " " }}'
|
|
CLOUD_LICENSE_ENABLED: '{{- if and .Values.cloudLicenseEnabled (not (empty .Values.license)) -}}
|
|
false
|
|
{{- else -}}
|
|
{{ .Values.cloudLicenseEnabled }}
|
|
{{- end }}'
|
|
DUPLICATE_TIMEFRAME: '{{ .Values.tap.misc.duplicateTimeframe }}'
|
|
ENABLED_DISSECTORS: '{{ gt (len .Values.tap.enabledDissectors) 0 | ternary (join "," .Values.tap.enabledDissectors) "" }}'
|
|
CUSTOM_MACROS: '{{ toJson .Values.tap.customMacros }}'
|
|
DISSECTORS_UPDATING_ENABLED: '{{ not (default false .Values.demoModeEnabled) }}'
|
|
SNAPSHOTS_UPDATING_ENABLED: '{{ not (default false .Values.demoModeEnabled) }}'
|
|
DEMO_MODE_ENABLED: '{{ default false .Values.demoModeEnabled }}'
|
|
DETECT_DUPLICATES: '{{ .Values.tap.misc.detectDuplicates | ternary "true" "false" }}'
|
|
PCAP_DUMP_ENABLE: '{{ .Values.pcapdump.enabled }}'
|
|
PCAP_TIME_INTERVAL: '{{ .Values.pcapdump.timeInterval }}'
|
|
PCAP_MAX_TIME: '{{ .Values.pcapdump.maxTime }}'
|
|
PCAP_MAX_SIZE: '{{ .Values.pcapdump.maxSize }}'
|
|
PORT_MAPPING: '{{ toJson .Values.tap.portMapping }}'
|
|
RAW_CAPTURE_ENABLED: '{{ .Values.tap.capture.raw.enabled | ternary "true" "false" }}'
|
|
RAW_CAPTURE_STORAGE_SIZE: '{{ .Values.tap.capture.raw.storageSize }}'
|