mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-08-18 03:46:38 +00:00
f38980ea94
* deps: bump indirect deps to clear critical/high Dependabot alerts Bumps the vulnerable indirect dependencies flagged as critical or high severity in Dependabot: - golang.org/x/crypto v0.39.0 -> v0.54.0 (7 critical + 2 high: SSH agent constraint/key-constraint bypass, @revoked auth bypass, FIDO/U2F presence check bypass, VerifiedPublicKeyCallback permission skip, infinite loop on large channel writes, client-induced server deadlock, RSA/DSA DoS, byte arithmetic underflow panic) - google.golang.org/grpc v1.68.1 -> v1.83.0 (critical: authz bypass via missing leading slash in :path; high: xDS RBAC and HTTP/2 issues) - github.com/containerd/containerd v1.7.27 -> v1.7.34 (high: LABEL -> restart-monitor binary:// host-root RCE, runAsNonRoot evasion, local privesc via wide CRI directory permissions) - oras.land/oras-go/v2 v2.6.0 -> v2.6.2 (high: CVE-2026-50163 hardlink extract-dir escape, credential forwarding via unvalidated Location header) - github.com/moby/spdystream v0.5.0 -> v0.5.1 (high: DoS on CRI) Transitively pulls up x/net, x/sync, x/sys, x/term, x/text, x/time, x/oauth2, protobuf, filepath-securejoin, selinux and go-logr via go mod tidy. The go directive moves 1.24.0 -> 1.25.0 (required by the upgraded modules); the explicit toolchain pin is dropped. CI resolves Go from go.mod, so no workflow changes are needed. go build ./... and go test ./... pass. * ci: move golangci-lint to v2, fix resulting lint issues golangci-lint-action@v3 pins `latest` to v1.64.8, which is built with go1.24 and refuses to run now that go.mod targets 1.25.0: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.0) Move the job to golangci-lint-action@v7 + v2.8.0 and add a .golangci.yml mirroring the hub repo's v2 config: govet, staticcheck, ineffassign and unused, plus gofmt/goimports as formatters. Fixes for the issues that surfaced: - ST1005: lowercase error strings, drop trailing '!' in connect/hub.go - SA4011: kubernetes/watch.go had a `break` inside a `select` default that broke the select rather than the loop, i.e. a no-op; removed - QF1008: drop the embedded ChartPathOptions selector in helm.go - QF1003: tagged switch on r.URL.Path in mcp_test.go - QF1004: strings.Replace(..., -1) -> strings.ReplaceAll - gofmt -s and goimports with a local prefix across the tree errcheck is not in the enabled set, matching hub. * cmd: clarify --time parse error in pcap dump The error neither named the offending flag/value nor separated the wrapped error from the message. Reported by Copilot on #1952. --------- Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
499 lines
24 KiB
Go
499 lines
24 KiB
Go
package configStructs
|
|
|
|
import (
|
|
"fmt"
|
|
"regexp"
|
|
|
|
v1 "k8s.io/api/core/v1"
|
|
networking "k8s.io/api/networking/v1"
|
|
)
|
|
|
|
const (
|
|
DockerRegistryLabel = "docker-registry"
|
|
DockerTagLabel = "docker-tag"
|
|
DockerImagePullPolicy = "docker-imagePullPolicy"
|
|
DockerImagePullSecrets = "docker-imagePullSecrets"
|
|
ProxyFrontPortLabel = "proxy-front-port"
|
|
ProxyHubPortLabel = "proxy-hub-port"
|
|
ProxyHostLabel = "proxy-host"
|
|
NamespacesLabel = "namespaces"
|
|
ExcludedNamespacesLabel = "excludedNamespaces"
|
|
ReleaseNamespaceLabel = "release-namespace"
|
|
PersistentStorageLabel = "persistentStorage"
|
|
PersistentStorageStaticLabel = "persistentStorageStatic"
|
|
EfsFileSytemIdAndPathLabel = "efsFileSytemIdAndPath"
|
|
StorageLimitLabel = "storageLimit"
|
|
StorageClassLabel = "storageClass"
|
|
DryRunLabel = "dryRun"
|
|
PcapLabel = "pcap"
|
|
ServiceMeshLabel = "serviceMesh"
|
|
TlsLabel = "tls"
|
|
IgnoreTaintedLabel = "ignoreTainted"
|
|
IngressEnabledLabel = "ingress-enabled"
|
|
TelemetryEnabledLabel = "telemetry-enabled"
|
|
ResourceGuardEnabledLabel = "resource-guard-enabled"
|
|
PprofPortLabel = "pprof-port"
|
|
PprofViewLabel = "pprof-view"
|
|
DebugLabel = "debug"
|
|
ContainerPort = 8080
|
|
ContainerPortStr = "8080"
|
|
PcapDest = "dest"
|
|
PcapMaxSize = "maxSize"
|
|
PcapMaxTime = "maxTime"
|
|
PcapTimeInterval = "timeInterval"
|
|
PcapKubeconfig = "kubeconfig"
|
|
PcapDumpEnabled = "enabled"
|
|
PcapTime = "time"
|
|
WatchdogEnabled = "watchdogEnabled"
|
|
HelmChartPathLabel = "release-helmChartPath"
|
|
)
|
|
|
|
type ResourceLimitsHub struct {
|
|
CPU string `yaml:"cpu" json:"cpu" default:"0"`
|
|
Memory string `yaml:"memory" json:"memory" default:"5Gi"`
|
|
}
|
|
|
|
type ResourceLimitsWorker struct {
|
|
CPU string `yaml:"cpu" json:"cpu" default:"0"`
|
|
Memory string `yaml:"memory" json:"memory" default:"3Gi"`
|
|
}
|
|
|
|
type ResourceRequests struct {
|
|
CPU string `yaml:"cpu" json:"cpu" default:"50m"`
|
|
Memory string `yaml:"memory" json:"memory" default:"50Mi"`
|
|
}
|
|
|
|
type ResourceRequirementsHub struct {
|
|
Limits ResourceLimitsHub `yaml:"limits" json:"limits"`
|
|
Requests ResourceRequests `yaml:"requests" json:"requests"`
|
|
}
|
|
|
|
type ResourceRequirementsWorker struct {
|
|
Limits ResourceLimitsHub `yaml:"limits" json:"limits"`
|
|
Requests ResourceRequests `yaml:"requests" json:"requests"`
|
|
}
|
|
|
|
type WorkerConfig struct {
|
|
SrvPort uint16 `yaml:"srvPort" json:"srvPort" default:"48999"`
|
|
}
|
|
|
|
type HubConfig struct {
|
|
SrvPort uint16 `yaml:"srvPort" json:"srvPort" default:"8898"`
|
|
}
|
|
|
|
type FrontConfig struct {
|
|
Port uint16 `yaml:"port" json:"port" default:"8899"`
|
|
}
|
|
|
|
type ProxyConfig struct {
|
|
Worker WorkerConfig `yaml:"worker" json:"worker"`
|
|
Hub HubConfig `yaml:"hub" json:"hub"`
|
|
Front FrontConfig `yaml:"front" json:"front"`
|
|
Host string `yaml:"host" json:"host" default:"127.0.0.1"`
|
|
}
|
|
|
|
type OverrideImageConfig struct {
|
|
Worker string `yaml:"worker" json:"worker"`
|
|
Hub string `yaml:"hub" json:"hub"`
|
|
Front string `yaml:"front" json:"front"`
|
|
}
|
|
type OverrideTagConfig struct {
|
|
Worker string `yaml:"worker" json:"worker"`
|
|
Hub string `yaml:"hub" json:"hub"`
|
|
Front string `yaml:"front" json:"front"`
|
|
}
|
|
|
|
type DockerConfig struct {
|
|
Registry string `yaml:"registry" json:"registry" default:"docker.io/kubeshark"`
|
|
Tag string `yaml:"tag" json:"tag" default:""`
|
|
TagLocked bool `yaml:"tagLocked" json:"tagLocked" default:"true"`
|
|
ImagePullPolicy string `yaml:"imagePullPolicy" json:"imagePullPolicy" default:"Always"`
|
|
ImagePullSecrets []string `yaml:"imagePullSecrets" json:"imagePullSecrets"`
|
|
OverrideImage OverrideImageConfig `yaml:"overrideImage" json:"overrideImage"`
|
|
OverrideTag OverrideTagConfig `yaml:"overrideTag" json:"overrideTag"`
|
|
}
|
|
|
|
type DnsConfig struct {
|
|
Nameservers []string `yaml:"nameservers" json:"nameservers" default:"[]"`
|
|
Searches []string `yaml:"searches" json:"searches" default:"[]"`
|
|
Options []DnsConfigOption `yaml:"options" json:"options" default:"[]"`
|
|
}
|
|
|
|
type DnsConfigOption struct {
|
|
Name string `yaml:"name" json:"name"`
|
|
Value string `yaml:"value" json:"value"`
|
|
}
|
|
|
|
type ResourcesConfig struct {
|
|
Hub ResourceRequirementsHub `yaml:"hub" json:"hub"`
|
|
Sniffer ResourceRequirementsWorker `yaml:"sniffer" json:"sniffer"`
|
|
Tracer ResourceRequirementsWorker `yaml:"tracer" json:"tracer"`
|
|
}
|
|
|
|
type ProbesConfig struct {
|
|
Hub ProbeConfig `yaml:"hub" json:"hub"`
|
|
Sniffer ProbeConfig `yaml:"sniffer" json:"sniffer"`
|
|
}
|
|
|
|
type NodeSelectorTermsConfig struct {
|
|
Hub []v1.NodeSelectorTerm `yaml:"hub" json:"hub" default:"[]"`
|
|
Workers []v1.NodeSelectorTerm `yaml:"workers" json:"workers" default:"[]"`
|
|
Front []v1.NodeSelectorTerm `yaml:"front" json:"front" default:"[]"`
|
|
Dex []v1.NodeSelectorTerm `yaml:"dex" json:"dex" default:"[]"`
|
|
}
|
|
|
|
type TolerationsConfig struct {
|
|
Hub []v1.Toleration `yaml:"hub" json:"hub" default:"[]"`
|
|
Workers []v1.Toleration `yaml:"workers" json:"workers" default:"[]"`
|
|
Front []v1.Toleration `yaml:"front" json:"front" default:"[]"`
|
|
}
|
|
|
|
type ProbeConfig struct {
|
|
InitialDelaySeconds int `yaml:"initialDelaySeconds" json:"initialDelaySeconds" default:"5"`
|
|
PeriodSeconds int `yaml:"periodSeconds" json:"periodSeconds" default:"5"`
|
|
SuccessThreshold int `yaml:"successThreshold" json:"successThreshold" default:"1"`
|
|
FailureThreshold int `yaml:"failureThreshold" json:"failureThreshold" default:"3"`
|
|
}
|
|
|
|
type SamlConfig struct {
|
|
IdpMetadataUrl string `yaml:"idpMetadataUrl" json:"idpMetadataUrl"`
|
|
X509crt string `yaml:"x509crt" json:"x509crt"`
|
|
X509key string `yaml:"x509key" json:"x509key"`
|
|
}
|
|
|
|
type AuthConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
// Type selects the authentication backend. Valid values:
|
|
// saml — SAML 2.0 SSO
|
|
// oidc — generic OIDC (Dex, Okta, Auth0, Keycloak, Azure AD, …)
|
|
// dex — permanent alias of oidc (kept for back-compat)
|
|
// descope — Descope SDK
|
|
// default — also routes to Descope (kept, not deprecated)
|
|
//
|
|
// NOTE: prior releases routed `oidc` to Descope. If you were using `oidc`
|
|
// to mean Descope, switch to `descope` (or `default`). The rename is a
|
|
// breaking change documented in the release notes.
|
|
Type string `yaml:"type" json:"type" default:"saml"`
|
|
RolesClaim string `yaml:"rolesClaim" json:"rolesClaim"`
|
|
// DefaultRole is applied when the authenticated user's SSO claim has no
|
|
// recognized group. Must be one of the four built-in roles
|
|
// (kubeshark-admin / kubeshark-realtime / kubeshark-snapshot /
|
|
// kubeshark-viewer), the name of an operator-defined role under
|
|
// `tap.auth.roles`, or empty for strict-deny.
|
|
DefaultRole string `yaml:"defaultRole" json:"defaultRole"`
|
|
// GroupMapping translates SSO group names into role names (built-in or
|
|
// operator-defined). Optional — groups whose name already matches a
|
|
// built-in role are identity-matched and don't need an entry here.
|
|
// Operator-defined role names MUST appear here to participate in
|
|
// resolution (identity-match is built-in-only).
|
|
GroupMapping map[string]string `yaml:"groupMapping" json:"groupMapping"`
|
|
// Roles is the operator-defined role catalogue, keyed by role name.
|
|
// Each role has its own capability set + namespace scope. Names with
|
|
// the `kubeshark-` prefix are reserved for built-ins and will be
|
|
// rejected at hub startup. Unknown capability strings are dropped
|
|
// with a warning; empty / "*" namespace specs mean deny-all-data and
|
|
// allow-all respectively.
|
|
Roles map[string]RoleConfig `yaml:"roles" json:"roles"`
|
|
Cli CliAuthConfig `yaml:"cli" json:"cli"`
|
|
Saml SamlConfig `yaml:"saml" json:"saml"`
|
|
}
|
|
|
|
// CliAuthConfig gates ServiceAccount-token auth for the CLI. When enabled, the
|
|
// chart creates a `kubeshark-cli` ServiceAccount plus a Role permitting
|
|
// `create` on its token, and the hub allowlists it via the
|
|
// AUTH_CLI_SERVICE_ACCOUNTS env var. The CLI mints a short-lived token for
|
|
// that SA to authenticate to a gated hub. Map `kubeshark-cli` to a role via
|
|
// GroupMapping (or DefaultRole); without a mapping it falls back to
|
|
// DefaultRole.
|
|
type CliAuthConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
// Subjects are the RBAC subjects permitted to mint the kubeshark-cli
|
|
// token — i.e. who may use the CLI against a gated hub. Rendered verbatim
|
|
// into the kubeshark-cli-token-minter RoleBinding; empty means the Role is
|
|
// created but bound to nobody.
|
|
Subjects []CliAuthSubject `yaml:"subjects" json:"subjects"`
|
|
}
|
|
|
|
// CliAuthSubject is one entry under tap.auth.cli.subjects, mirroring
|
|
// rbacv1.Subject: Kind is User, Group or ServiceAccount; ApiGroup is
|
|
// rbac.authorization.k8s.io for User and Group and must be empty for
|
|
// ServiceAccount; Namespace applies to ServiceAccount only. The empty-able
|
|
// fields are omitted when unset so the rendered RoleBinding stays valid for
|
|
// every kind.
|
|
type CliAuthSubject struct {
|
|
Kind string `yaml:"kind" json:"kind"`
|
|
Name string `yaml:"name" json:"name"`
|
|
ApiGroup string `yaml:"apiGroup,omitempty" json:"apiGroup,omitempty"`
|
|
Namespace string `yaml:"namespace,omitempty" json:"namespace,omitempty"`
|
|
}
|
|
|
|
// RoleConfig is an operator-defined role declared under tap.auth.roles.
|
|
// Capabilities is the closed vocabulary documented in the hub project
|
|
// (snapshot:read / snapshot:write / snapshot:dissection / dissection:live /
|
|
// dissection:control / pods:target:write / settings:write); unknown
|
|
// capability strings are warn-dropped at hub startup. Namespaces is a
|
|
// comma-separated list with `*` (allow-all) and glob (`foo-*`, `*-bar`,
|
|
// `*mid*`) support; empty string means deny-all-data.
|
|
type RoleConfig struct {
|
|
Capabilities []string `yaml:"capabilities" json:"capabilities"`
|
|
Namespaces string `yaml:"namespaces" json:"namespaces"`
|
|
}
|
|
|
|
type IngressConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
ClassName string `yaml:"className" json:"className" default:""`
|
|
Host string `yaml:"host" json:"host" default:"ks.svc.cluster.local"`
|
|
Path string `yaml:"path" json:"path" default:"/"`
|
|
TLS []networking.IngressTLS `yaml:"tls" json:"tls" default:"[]"`
|
|
Annotations map[string]string `yaml:"annotations" json:"annotations" default:"{}"`
|
|
}
|
|
|
|
type RoutingConfig struct {
|
|
Front FrontRoutingConfig `yaml:"front" json:"front"`
|
|
}
|
|
|
|
type DashboardConfig struct {
|
|
StreamingType string `yaml:"streamingType" json:"streamingType" default:"connect-rpc"`
|
|
CompleteStreamingEnabled bool `yaml:"completeStreamingEnabled" json:"completeStreamingEnabled" default:"true"`
|
|
ClusterWideMapEnabled bool `yaml:"clusterWideMapEnabled" json:"clusterWideMapEnabled" default:"false"`
|
|
EntriesLimit string `yaml:"entriesLimit" json:"entriesLimit" default:"300000"`
|
|
}
|
|
|
|
type FrontRoutingConfig struct {
|
|
BasePath string `yaml:"basePath" json:"basePath" default:""`
|
|
}
|
|
|
|
type ReleaseConfig struct {
|
|
Repo string `yaml:"repo" json:"repo" default:"https://helm.kubeshark.com"`
|
|
Name string `yaml:"name" json:"name" default:"kubeshark"`
|
|
Namespace string `yaml:"namespace" json:"namespace" default:"default"`
|
|
HelmChartPath string `yaml:"helmChartPath" json:"helmChartPath" default:""`
|
|
}
|
|
|
|
type TelemetryConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"true"`
|
|
}
|
|
|
|
type ResourceGuardConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
}
|
|
|
|
type SentryConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
Environment string `yaml:"environment" json:"environment" default:"production"`
|
|
}
|
|
|
|
type WatchdogConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
}
|
|
|
|
type GitopsConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
}
|
|
|
|
type CapabilitiesConfig struct {
|
|
NetworkCapture []string `yaml:"networkCapture" json:"networkCapture" default:"[]"`
|
|
ServiceMeshCapture []string `yaml:"serviceMeshCapture" json:"serviceMeshCapture" default:"[]"`
|
|
EBPFCapture []string `yaml:"ebpfCapture" json:"ebpfCapture" default:"[]"`
|
|
}
|
|
|
|
type MetricsConfig struct {
|
|
Port uint16 `yaml:"port" json:"port" default:"49100"`
|
|
}
|
|
|
|
type PprofConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
Port uint16 `yaml:"port" json:"port" default:"8000"`
|
|
View string `yaml:"view" json:"view" default:"flamegraph"`
|
|
}
|
|
|
|
type MiscConfig struct {
|
|
JsonTTL string `yaml:"jsonTTL" json:"jsonTTL" default:"5m"`
|
|
PcapTTL string `yaml:"pcapTTL" json:"pcapTTL" default:"0"`
|
|
PcapErrorTTL string `yaml:"pcapErrorTTL" json:"pcapErrorTTL" default:"0"`
|
|
TrafficSampleRate int `yaml:"trafficSampleRate" json:"trafficSampleRate" default:"100"`
|
|
TcpStreamChannelTimeoutMs int `yaml:"tcpStreamChannelTimeoutMs" json:"tcpStreamChannelTimeoutMs" default:"10000"`
|
|
TcpStreamChannelTimeoutShow bool `yaml:"tcpStreamChannelTimeoutShow" json:"tcpStreamChannelTimeoutShow" default:"false"`
|
|
ResolutionStrategy string `yaml:"resolutionStrategy" json:"resolutionStrategy" default:"auto"`
|
|
DuplicateTimeframe string `yaml:"duplicateTimeframe" json:"duplicateTimeframe" default:"200ms"`
|
|
DetectDuplicates bool `yaml:"detectDuplicates" json:"detectDuplicates" default:"false"`
|
|
StaleTimeoutSeconds int `yaml:"staleTimeoutSeconds" json:"staleTimeoutSeconds" default:"30"`
|
|
TcpFlowTimeout int `yaml:"tcpFlowTimeout" json:"tcpFlowTimeout" default:"1200"`
|
|
UdpFlowTimeout int `yaml:"udpFlowTimeout" json:"udpFlowTimeout" default:"1200"`
|
|
}
|
|
|
|
type PcapDumpConfig struct {
|
|
PcapDumpEnabled bool `yaml:"enabled" json:"enabled" default:"false"`
|
|
PcapTimeInterval string `yaml:"timeInterval" json:"timeInterval" default:"1m"`
|
|
PcapMaxTime string `yaml:"maxTime" json:"maxTime" default:"1h"`
|
|
PcapMaxSize string `yaml:"maxSize" json:"maxSize" default:"500MB"`
|
|
PcapTime string `yaml:"time" json:"time" default:"time"`
|
|
PcapDebug bool `yaml:"debug" json:"debug" default:"false"`
|
|
PcapDest string `yaml:"dest" json:"dest" default:""`
|
|
}
|
|
|
|
type PortMapping struct {
|
|
HTTP []uint16 `yaml:"http" json:"http"`
|
|
AMQP []uint16 `yaml:"amqp" json:"amqp"`
|
|
KAFKA []uint16 `yaml:"kafka" json:"kafka"`
|
|
MONGODB []uint16 `yaml:"mongodb" json:"mongodb"`
|
|
MYSQL []uint16 `yaml:"mysql" json:"mysql"`
|
|
POSTGRESQL []uint16 `yaml:"postgresql" json:"postgresql"`
|
|
REDIS []uint16 `yaml:"redis" json:"redis"`
|
|
LDAP []uint16 `yaml:"ldap" json:"ldap"`
|
|
DIAMETER []uint16 `yaml:"diameter" json:"diameter"`
|
|
}
|
|
|
|
type SecurityContextConfig struct {
|
|
Privileged bool `yaml:"privileged" json:"privileged" default:"true"`
|
|
AppArmorProfile AppArmorProfileConfig `yaml:"appArmorProfile" json:"appArmorProfile"`
|
|
SeLinuxOptions SeLinuxOptionsConfig `yaml:"seLinuxOptions" json:"seLinuxOptions"`
|
|
Capabilities CapabilitiesConfig `yaml:"capabilities" json:"capabilities"`
|
|
}
|
|
|
|
type AppArmorProfileConfig struct {
|
|
Type string `yaml:"type" json:"type"`
|
|
LocalhostProfile string `yaml:"localhostProfile" json:"localhostProfile"`
|
|
}
|
|
|
|
type SeLinuxOptionsConfig struct {
|
|
Level string `yaml:"level" json:"level"`
|
|
Role string `yaml:"role" json:"role"`
|
|
Type string `yaml:"type" json:"type"`
|
|
User string `yaml:"user" json:"user"`
|
|
}
|
|
|
|
type RawCaptureConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"true"`
|
|
StorageSize string `yaml:"storageSize" json:"storageSize" default:"1Gi"`
|
|
}
|
|
|
|
type SnapshotsLocalConfig struct {
|
|
StorageClass string `yaml:"storageClass" json:"storageClass" default:""`
|
|
StorageSize string `yaml:"storageSize" json:"storageSize" default:"20Gi"`
|
|
}
|
|
|
|
type SnapshotsCloudS3Config struct {
|
|
Bucket string `yaml:"bucket" json:"bucket" default:""`
|
|
Region string `yaml:"region" json:"region" default:""`
|
|
AccessKey string `yaml:"accessKey" json:"accessKey" default:""`
|
|
SecretKey string `yaml:"secretKey" json:"secretKey" default:""`
|
|
RoleArn string `yaml:"roleArn" json:"roleArn" default:""`
|
|
ExternalId string `yaml:"externalId" json:"externalId" default:""`
|
|
}
|
|
|
|
type SnapshotsCloudAzblobConfig struct {
|
|
StorageAccount string `yaml:"storageAccount" json:"storageAccount" default:""`
|
|
Container string `yaml:"container" json:"container" default:""`
|
|
StorageKey string `yaml:"storageKey" json:"storageKey" default:""`
|
|
}
|
|
|
|
type SnapshotsCloudGCSConfig struct {
|
|
Bucket string `yaml:"bucket" json:"bucket" default:""`
|
|
Project string `yaml:"project" json:"project" default:""`
|
|
CredentialsJson string `yaml:"credentialsJson" json:"credentialsJson" default:""`
|
|
}
|
|
|
|
type SnapshotsCloudConfig struct {
|
|
Provider string `yaml:"provider" json:"provider" default:""`
|
|
Prefix string `yaml:"prefix" json:"prefix" default:""`
|
|
ConfigMaps []string `yaml:"configMaps" json:"configMaps" default:"[]"`
|
|
Secrets []string `yaml:"secrets" json:"secrets" default:"[]"`
|
|
S3 SnapshotsCloudS3Config `yaml:"s3" json:"s3"`
|
|
Azblob SnapshotsCloudAzblobConfig `yaml:"azblob" json:"azblob"`
|
|
GCS SnapshotsCloudGCSConfig `yaml:"gcs" json:"gcs"`
|
|
}
|
|
|
|
type SnapshotsConfig struct {
|
|
Local SnapshotsLocalConfig `yaml:"local" json:"local"`
|
|
Cloud SnapshotsCloudConfig `yaml:"cloud" json:"cloud"`
|
|
}
|
|
|
|
type DelayedDissectionConfig struct {
|
|
CPU string `yaml:"cpu" json:"cpu" default:"1"`
|
|
Memory string `yaml:"memory" json:"memory" default:"4Gi"`
|
|
StorageSize string `yaml:"storageSize" json:"storageSize" default:""`
|
|
StorageClass string `yaml:"storageClass" json:"storageClass" default:""`
|
|
}
|
|
|
|
type DissectionConfig struct {
|
|
Enabled bool `yaml:"enabled" json:"enabled" default:"true"`
|
|
StopAfter string `yaml:"stopAfter" json:"stopAfter" default:"5m"`
|
|
}
|
|
|
|
type CaptureConfig struct {
|
|
Dissection DissectionConfig `yaml:"dissection" json:"dissection"`
|
|
CaptureSelf bool `yaml:"captureSelf" json:"captureSelf" default:"false"`
|
|
Raw RawCaptureConfig `yaml:"raw" json:"raw"`
|
|
DbMaxSize string `yaml:"dbMaxSize" json:"dbMaxSize" default:"500Mi"`
|
|
}
|
|
|
|
type TapConfig struct {
|
|
Docker DockerConfig `yaml:"docker" json:"docker"`
|
|
Proxy ProxyConfig `yaml:"proxy" json:"proxy"`
|
|
PodRegexStr string `yaml:"regex" json:"regex" default:".*"`
|
|
Namespaces []string `yaml:"namespaces" json:"namespaces" default:"[]"`
|
|
ExcludedNamespaces []string `yaml:"excludedNamespaces" json:"excludedNamespaces" default:"[]"`
|
|
BpfOverride string `yaml:"bpfOverride" json:"bpfOverride" default:""`
|
|
Capture CaptureConfig `yaml:"capture" json:"capture"`
|
|
DelayedDissection DelayedDissectionConfig `yaml:"delayedDissection" json:"delayedDissection"`
|
|
Snapshots SnapshotsConfig `yaml:"snapshots" json:"snapshots"`
|
|
Release ReleaseConfig `yaml:"release" json:"release"`
|
|
PersistentStorage bool `yaml:"persistentStorage" json:"persistentStorage" default:"false"`
|
|
PersistentStorageStatic bool `yaml:"persistentStorageStatic" json:"persistentStorageStatic" default:"false"`
|
|
PersistentStoragePvcVolumeMode string `yaml:"persistentStoragePvcVolumeMode" json:"persistentStoragePvcVolumeMode" default:"FileSystem"`
|
|
EfsFileSytemIdAndPath string `yaml:"efsFileSytemIdAndPath" json:"efsFileSytemIdAndPath" default:""`
|
|
Secrets []string `yaml:"secrets" json:"secrets" default:"[]"`
|
|
StorageLimit string `yaml:"storageLimit" json:"storageLimit" default:"10Gi"`
|
|
StorageClass string `yaml:"storageClass" json:"storageClass" default:"standard"`
|
|
DryRun bool `yaml:"dryRun" json:"dryRun" default:"false"`
|
|
DnsConfig DnsConfig `yaml:"dns" json:"dns"`
|
|
Resources ResourcesConfig `yaml:"resources" json:"resources"`
|
|
Probes ProbesConfig `yaml:"probes" json:"probes"`
|
|
ServiceMesh bool `yaml:"serviceMesh" json:"serviceMesh" default:"true"`
|
|
Tls bool `yaml:"tls" json:"tls" default:"true"`
|
|
DisableTlsLog bool `yaml:"disableTlsLog" json:"disableTlsLog" default:"true"`
|
|
PacketCapture string `yaml:"packetCapture" json:"packetCapture" default:"best"`
|
|
Labels map[string]string `yaml:"labels" json:"labels" default:"{}"`
|
|
Annotations map[string]string `yaml:"annotations" json:"annotations" default:"{}"`
|
|
NodeSelectorTerms NodeSelectorTermsConfig `yaml:"nodeSelectorTerms" json:"nodeSelectorTerms" default:"{}"`
|
|
Tolerations TolerationsConfig `yaml:"tolerations" json:"tolerations" default:"{}"`
|
|
Auth AuthConfig `yaml:"auth" json:"auth"`
|
|
Ingress IngressConfig `yaml:"ingress" json:"ingress"`
|
|
PriorityClass string `yaml:"priorityClass" json:"priorityClass" default:""`
|
|
Routing RoutingConfig `yaml:"routing" json:"routing"`
|
|
IPv6 bool `yaml:"ipv6" json:"ipv6" default:"true"`
|
|
Debug bool `yaml:"debug" json:"debug" default:"false"`
|
|
Dashboard DashboardConfig `yaml:"dashboard" json:"dashboard"`
|
|
Telemetry TelemetryConfig `yaml:"telemetry" json:"telemetry"`
|
|
ResourceGuard ResourceGuardConfig `yaml:"resourceGuard" json:"resourceGuard"`
|
|
Watchdog WatchdogConfig `yaml:"watchdog" json:"watchdog"`
|
|
Gitops GitopsConfig `yaml:"gitops" json:"gitops"`
|
|
Sentry SentryConfig `yaml:"sentry" json:"sentry"`
|
|
DefaultFilter string `yaml:"defaultFilter" json:"defaultFilter" default:""`
|
|
GlobalFilter string `yaml:"globalFilter" json:"globalFilter" default:""`
|
|
EnabledDissectors []string `yaml:"enabledDissectors" json:"enabledDissectors"`
|
|
PortMapping PortMapping `yaml:"portMapping" json:"portMapping"`
|
|
CustomMacros map[string]string `yaml:"customMacros" json:"customMacros" default:"{\"https\":\"tls and (http or http2)\"}"`
|
|
Metrics MetricsConfig `yaml:"metrics" json:"metrics"`
|
|
Pprof PprofConfig `yaml:"pprof" json:"pprof"`
|
|
Misc MiscConfig `yaml:"misc" json:"misc"`
|
|
SecurityContext SecurityContextConfig `yaml:"securityContext" json:"securityContext"`
|
|
MountBpf bool `yaml:"mountBpf" json:"mountBpf" default:"true"`
|
|
HostNetwork bool `yaml:"hostNetwork" json:"hostNetwork" default:"true"`
|
|
}
|
|
|
|
func (config *TapConfig) PodRegex() *regexp.Regexp {
|
|
podRegex, _ := regexp.Compile(config.PodRegexStr)
|
|
return podRegex
|
|
}
|
|
|
|
func (config *TapConfig) Validate() error {
|
|
_, compileErr := regexp.Compile(config.PodRegexStr)
|
|
if compileErr != nil {
|
|
return fmt.Errorf("%s is not a valid regex %s", config.PodRegexStr, compileErr)
|
|
}
|
|
|
|
return nil
|
|
}
|