kubeshark/helm-chart/templates/09-worker-daemon-set.yaml

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app.kubeshark.co/app: worker
    sidecar.istio.io/inject: "false"
    {{- include "kubeshark.labels" . | nindent 4 }}
  annotations:
  {{- if .Values.tap.annotations }}
    {{- toYaml .Values.tap.annotations | nindent 4 }}
  {{- end }}
  name: kubeshark-worker-daemon-set
  namespace: {{ .Release.Namespace }}
spec:
  selector:
    matchLabels:
      app.kubeshark.co/app: worker
      {{- include "kubeshark.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        app.kubeshark.co/app: worker
        {{- include "kubeshark.labels" . | nindent 8 }}
      name: kubeshark-worker-daemon-set
      namespace: kubeshark
    spec:
    {{- if .Values.tap.kernelModule.enabled }}
      initContainers:
      - name: load-pf-ring
        image: {{ .Values.tap.kernelModule.image }}
        imagePullPolicy: {{ .Values.tap.docker.imagePullPolicy }}
        securityContext:
          capabilities:
            add:
              {{- range .Values.tap.capabilities.kernelModule }}
              {{ print "- " . }}
              {{- end }}
            drop:
              - ALL
        volumeMounts:
        - name: lib-modules
          mountPath: /lib/modules
    {{- end }}
      containers:
        - command:
            - ./worker
            - -i
            - any
            - -port
            - '{{ .Values.tap.proxy.worker.srvPort }}'
            - -metrics-port
            - '{{ .Values.tap.metrics.port }}'
            - -packet-capture
            - '{{ .Values.tap.packetCapture }}'
            - -unixsocket
          {{- if .Values.tap.serviceMesh }}
            - -servicemesh
          {{- end }}
            - -procfs
            - /hostproc
          {{- if .Values.tap.kernelModule.enabled }}
            - -kernel-module
          {{- end }}
          {{- if ne .Values.tap.packetCapture "ebpf" }}
            - -disable-ebpf
          {{- end }}
            - -resolution-strategy
            - '{{ .Values.tap.misc.resolutionStrategy }}'
          {{- if .Values.tap.debug }}
            - -debug
          {{- end }}
        {{- if .Values.tap.docker.overrideTag.worker }}
          image: '{{ .Values.tap.docker.registry }}/worker:{{ .Values.tap.docker.overrideTag.worker }}'
        {{ else }}
          image: '{{ .Values.tap.docker.registry }}/worker:{{ not (eq .Values.tap.docker.tag "") | ternary .Values.tap.docker.tag (printf "v%s" .Chart.Version) }}'
        {{- end }}
          imagePullPolicy: {{ .Values.tap.docker.imagePullPolicy }}
          name: sniffer
          ports:
            - containerPort: {{ .Values.tap.metrics.port }}
              protocol: TCP
              name: metrics
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: TCP_STREAM_CHANNEL_TIMEOUT_MS
            value: '{{ .Values.tap.misc.tcpStreamChannelTimeoutMs }}'
          - name: TCP_STREAM_CHANNEL_TIMEOUT_SHOW
            value: '{{ .Values.tap.misc.tcpStreamChannelTimeoutShow }}'
          - name: KUBESHARK_CLOUD_API_URL
            value: 'https://api.kubeshark.co'
          - name: PROFILING_ENABLED
            value: '{{ .Values.tap.misc.profile }}'
          resources:
            limits:
              cpu: {{ .Values.tap.resources.sniffer.limits.cpu }}
              memory: {{ .Values.tap.resources.sniffer.limits.memory }}
            requests:
              cpu: {{ .Values.tap.resources.sniffer.requests.cpu }}
              memory: {{ .Values.tap.resources.sniffer.requests.memory }}
          securityContext:
            capabilities:
              add:
                {{- range .Values.tap.capabilities.networkCapture }}
                {{ print "- " . }}
                {{- end }}
                {{- if .Values.tap.serviceMesh }}
                {{- range .Values.tap.capabilities.serviceMeshCapture }}
                {{ print "- " . }}
                {{- end }}
                {{- end }}
              drop:
                - ALL
          readinessProbe:
            periodSeconds: 1
            failureThreshold: 3
            successThreshold: 1
            initialDelaySeconds: 5
            tcpSocket:
              port: {{ .Values.tap.proxy.worker.srvPort }}
          livenessProbe:
            periodSeconds: 1
            failureThreshold: 3
            successThreshold: 1
            initialDelaySeconds: 5
            tcpSocket:
              port: {{ .Values.tap.proxy.worker.srvPort }}
          volumeMounts:
            - mountPath: /hostproc
              name: proc
              readOnly: true
            - mountPath: /sys
              name: sys
              readOnly: true
            - mountPath: /app/data
              name: data
      {{- if and (eq .Values.tap.kernelModule.enabled true) (eq .Values.tap.kernelModule.unloadOnDestroy true) }}
        - name: unload-pf-ring
          image: {{ .Values.tap.kernelModule.image }}
          command: ["/bin/sh"]
          args: ["-c", "trap 'rmmod pf_ring && sleep 3' SIGTERM; while true; do sleep 1; done"]
          securityContext:
            capabilities:
              add:
                {{- range .Values.tap.capabilities.kernelModule }}
                {{ print "- " . }}
                {{- end }}
              drop:
                - ALL
      {{- end }}
      {{- if .Values.tap.tls }}
        - command:
            - ./tracer
            - -procfs
            - /hostproc
          {{- if ne .Values.tap.packetCapture "ebpf" }}
            - -disable-ebpf
          {{- end }}          
          {{- if .Values.tap.debug }}
            - -debug
          {{- end }}
        {{- if .Values.tap.docker.overrideTag.worker }}
          image: '{{ .Values.tap.docker.registry }}/worker:{{ .Values.tap.docker.overrideTag.worker }}'
        {{ else }}
          image: '{{ .Values.tap.docker.registry }}/worker:{{ not (eq .Values.tap.docker.tag "") | ternary .Values.tap.docker.tag (printf "v%s" .Chart.Version) }}'
        {{- end }}
          imagePullPolicy: {{ .Values.tap.docker.imagePullPolicy }}
          name: tracer
          env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          resources:
            limits:
              cpu: {{ .Values.tap.resources.tracer.limits.cpu }}
              memory: {{ .Values.tap.resources.tracer.limits.memory }}
            requests:
              cpu: {{ .Values.tap.resources.tracer.requests.cpu }}
              memory: {{ .Values.tap.resources.tracer.requests.memory }}
          securityContext:
            capabilities:
              add:
                {{- range .Values.tap.capabilities.ebpfCapture }}
                {{ print "- " . }}
                {{- end }}
                {{- range .Values.tap.capabilities.networkCapture }}
                {{ print "- " . }}
                {{- end }}
              drop:
                - ALL
          volumeMounts:
            - mountPath: /hostproc
              name: proc
              readOnly: true
            - mountPath: /sys
              name: sys
              readOnly: true
            - mountPath: /app/data
              name: data
            - mountPath: /etc/os-release
              name: os-release
              readOnly: true
      {{- end }}
      dnsPolicy: ClusterFirstWithHostNet
      hostNetwork: true
      serviceAccountName: {{ include "kubeshark.serviceAccountName" . }}
      terminationGracePeriodSeconds: 0
      tolerations:
        - effect: NoExecute
          operator: Exists
{{- if not .Values.tap.ignoreTainted }}
        - effect: NoSchedule
          operator: Exists
{{- end }}
{{- if gt (len .Values.tap.nodeSelectorTerms) 0}}
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              {{- toYaml .Values.tap.nodeSelectorTerms | nindent 12 }}
{{- end }}
      volumes:
        - hostPath:
            path: /proc
          name: proc
        - hostPath:
            path: /sys
          name: sys
        - name: lib-modules
          hostPath:
            path: /lib/modules
        - hostPath:
            path: /etc/os-release
          name: os-release
        - name: data
{{- if .Values.tap.persistentStorage }}
          persistentVolumeClaim:
            claimName: kubeshark-persistent-volume-claim
{{- else }}
          emptyDir:
            sizeLimit: {{ .Values.tap.storageLimit }}
{{- end }}