mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-07-11 01:19:26 +00:00
a306678c7f
The worker seeds its name-resolution map and capture targets via plain HTTP GETs to the hub (/resolver/history, /pods/targeted, /pods/all). With auth enabled these routes sit behind Auth() and return 401, leaving the worker with an empty resolver map (all traffic shows unresolved). Project a short-lived SA token (audience kubeshark-hub) onto the sniffer container and expose its path via HUB_INTERNAL_TOKEN_PATH so the worker presents it as a Bearer to the hub's internalauth gate. Gated on tap.auth.enabled; auth-disabled clusters are unchanged.