mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-08-18 20:07:56 +00:00
Volodymyr StoikoandGitHub
ed9ce1b561
* helm: gate worker hub token on the same condition as hub AUTH_ENABLED (#1954) The hub's AUTH_ENABLED is derived from cloudLicenseEnabled/demoModeEnabled/ tap.auth.enabled, but the worker DaemonSet gated HUB_INTERNAL_TOKEN_PATH, its volumeMount and the projected serviceAccountToken on tap.auth.enabled alone. With demoModeEnabled: true (or the default cloudLicenseEnabled: true) and tap.auth.enabled unset, the hub required a bearer token the workers never got, so every worker -> hub call returned 401: tracer target refresh and name resolution history silently stopped while capture kept working. Extract the condition into a kubeshark.authEnabled helper and consume it from both 12-config-map.yaml and 09-worker-daemon-set.yaml so the two cannot drift. AUTH_ENABLED renders identically to before for all combinations of cloudLicenseEnabled/license/demoModeEnabled/tap.auth.enabled/tap.auth.type. * helm: mount the hub internal token in the tracer container too (#1954) The tracer polls the hub's /pods/all and /pods/targeted on every sync cycle, but only the sniffer container received HUB_INTERNAL_TOKEN_PATH and the token mount, so with auth enabled the tracer's requests were rejected and TLS hooking never picked up newly started pods. Wire the same env var and projected-token mount into the tracer container. Requires the matching tracer2 change that sends the Bearer header.