Volodymyr Stoiko 793e5d1efa 🔒 apply tap.auth.defaultRole when authentication is disabled ...

An ungated deployment had no authorization at all: every caller was
admin, and the only way to restrict anyone was to stand up an identity
provider. So a read-only dashboard needed a login it had no use for.

defaultRole now answers 'what may an unidentified caller do' as well as
'what may an authenticated caller with no recognized group do'. Setting
it to kubeshark-viewer gives a read-only deployment with no login and no
auth backend.

Its default becomes kubeshark-admin, so an ungated install behaves as it
always has, and the hub falls back to admin when the value is unset or
unrecognized rather than to strict-deny — nobody configuring a role must
not brick an install.

Adds install-notes coverage, since the notes are where an operator
learns which of the two ungated postures they got, and fills the
remaining gaps in the auth suites: dex and descope validation, incomplete
settings while auth is off, and worker token projection under licensing
and demo mode.

2026-08-17 07:38:14 +00:00

..

configConfig.go

✨ Use the Helm chart in tap command to install Kubeshark (#1362)

2023-06-06 12:16:03 +03:00

logsConfig.go

✨ Add --grep flag to logs command

2024-05-23 01:20:55 +03:00

scriptingConfig.go

deps: bump indirect deps to clear critical/high Dependabot alerts (#1952)

2026-08-04 08:35:41 -07:00

tapConfig.go

🔒 apply tap.auth.defaultRole when authentication is disabled

2026-08-17 07:38:14 +00:00