mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-09-08 01:07:18 +00:00
Volodymyr Stoiko
ed9ce1b561
* helm: gate worker hub token on the same condition as hub AUTH_ENABLED (#1954) The hub's AUTH_ENABLED is derived from cloudLicenseEnabled/demoModeEnabled/ tap.auth.enabled, but the worker DaemonSet gated HUB_INTERNAL_TOKEN_PATH, its volumeMount and the projected serviceAccountToken on tap.auth.enabled alone. With demoModeEnabled: true (or the default cloudLicenseEnabled: true) and tap.auth.enabled unset, the hub required a bearer token the workers never got, so every worker -> hub call returned 401: tracer target refresh and name resolution history silently stopped while capture kept working. Extract the condition into a kubeshark.authEnabled helper and consume it from both 12-config-map.yaml and 09-worker-daemon-set.yaml so the two cannot drift. AUTH_ENABLED renders identically to before for all combinations of cloudLicenseEnabled/license/demoModeEnabled/tap.auth.enabled/tap.auth.type. * helm: mount the hub internal token in the tracer container too (#1954) The tracer polls the hub's /pods/all and /pods/targeted on every sync cycle, but only the sniffer container received HUB_INTERNAL_TOKEN_PATH and the token mount, so with auth enabled the tracer's requests were rejected and TLS hooking never picked up newly started pods. Wire the same env var and projected-token mount into the tracer container. Requires the matching tracer2 change that sends the Bearer header.
127 lines
3.7 KiB
Smarty
127 lines
3.7 KiB
Smarty
{{/*
|
|
Expand the name of the chart.
|
|
*/}}
|
|
{{- define "kubeshark.name" -}}
|
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Create a default fully qualified app name.
|
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
If release name contains chart name it will be used as a full name.
|
|
*/}}
|
|
{{- define "kubeshark.fullname" -}}
|
|
{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Create chart name and version as used by the chart label.
|
|
*/}}
|
|
{{- define "kubeshark.chart" -}}
|
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Common labels
|
|
*/}}
|
|
{{- define "kubeshark.labels" -}}
|
|
helm.sh/chart: {{ include "kubeshark.chart" . }}
|
|
{{ include "kubeshark.selectorLabels" . }}
|
|
app.kubernetes.io/version: {{ .Chart.Version | quote }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
{{- if .Values.tap.labels }}
|
|
{{ toYaml .Values.tap.labels }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Selector labels
|
|
*/}}
|
|
{{- define "kubeshark.selectorLabels" -}}
|
|
app.kubernetes.io/name: {{ include "kubeshark.name" . }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Create the name of the service account to use
|
|
*/}}
|
|
{{- define "kubeshark.serviceAccountName" -}}
|
|
{{- printf "%s-service-account" .Release.Name }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Set configmap and secret names based on gitops.enabled
|
|
*/}}
|
|
{{- define "kubeshark.configmapName" -}}
|
|
kubeshark-config-map{{ if .Values.tap.gitops.enabled }}-default{{ end }}
|
|
{{- end -}}
|
|
|
|
{{- define "kubeshark.secretName" -}}
|
|
kubeshark-secret{{ if .Values.tap.gitops.enabled }}-default{{ end }}
|
|
{{- end -}}
|
|
|
|
|
|
{{/*
|
|
Escape double quotes in a string
|
|
*/}}
|
|
{{- define "kubeshark.escapeDoubleQuotes" -}}
|
|
{{- regexReplaceAll "\"" . "\"" -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Define debug docker tag suffix
|
|
*/}}
|
|
{{- define "kubeshark.dockerTagDebugVersion" -}}
|
|
{{- .Values.tap.pprof.enabled | ternary "-debug" "" }}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Create docker tag default version
|
|
*/}}
|
|
{{- define "kubeshark.defaultVersion" -}}
|
|
{{- $defaultVersion := (printf "v%s" .Chart.Version) -}}
|
|
{{- if .Values.tap.docker.tagLocked }}
|
|
{{- $defaultVersion = regexReplaceAll "^([^.]+\\.[^.]+).*" $defaultVersion "$1" -}}
|
|
{{- end }}
|
|
{{- $defaultVersion }}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Set sentry based on internet connectivity and telemetry
|
|
*/}}
|
|
{{- define "sentry.enabled" -}}
|
|
{{- $sentryEnabledVal := .Values.tap.sentry.enabled -}}
|
|
{{- if not .Values.internetConnectivity -}}
|
|
{{- $sentryEnabledVal = false -}}
|
|
{{- else if not .Values.tap.telemetry.enabled -}}
|
|
{{- $sentryEnabledVal = false -}}
|
|
{{- end -}}
|
|
{{- $sentryEnabledVal -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Dex IdP: retrieve a secret for static client with a specific ID
|
|
*/}}
|
|
{{- define "getDexKubesharkStaticClientSecret" -}}
|
|
{{- $clientId := .clientId -}}
|
|
{{- range .clients }}
|
|
{{- if eq .id $clientId }}
|
|
{{- .secret }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Single source of truth for whether the hub enforces authentication.
|
|
Consumed by the hub ConfigMap (AUTH_ENABLED) and by the worker DaemonSet, which
|
|
must mount an internal hub token whenever the hub requires one. Keeping the two
|
|
in sync prevents workers from being issued no token while the hub demands one.
|
|
*/}}
|
|
{{- define "kubeshark.authEnabled" -}}
|
|
{{- if and .Values.cloudLicenseEnabled (not (empty .Values.license)) -}}
|
|
{{ (default false .Values.demoModeEnabled) | ternary true ((and .Values.tap.auth.enabled (or (eq .Values.tap.auth.type "oidc") (eq .Values.tap.auth.type "dex"))) | ternary true false) }}
|
|
{{- else -}}
|
|
{{ .Values.cloudLicenseEnabled | ternary "true" ((default false .Values.demoModeEnabled) | ternary "true" .Values.tap.auth.enabled) }}
|
|
{{- end -}}
|
|
{{- end -}}
|