Skip to content

Commit c07cf30

Browse files
alongiralongir
authored
✨ Update the Helm chart to v53.1.0 (#2)
1 parent a4a2df5 commit c07cf30

10 files changed

Lines changed: 316 additions & 44 deletions

‎charts/chart/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v2
22
name: kubeshark
3-
version: "52.12.0"
3+
version: "53.1.0"
44
description: The API Traffic Analyzer for Kubernetes
55
home: https://kubeshark.com
66
keywords:

‎charts/chart/README.md‎

Lines changed: 11 additions & 5 deletions
Large diffs are not rendered by default.

‎charts/chart/docs/snapshots_cloud_storage.md‎

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,226 @@
1+
# Cloud Storage for Snapshots
2+
3+
Kubeshark can upload and download snapshots to cloud object storage, enabling cross-cluster sharing, backup/restore, and long-term retention.
4+
5+
Supported providers: **Amazon S3** (`s3`) and **Azure Blob Storage** (`azblob`).
6+
7+
## Helm Values
8+
9+
```yaml
10+
tap:
11+
snapshots:
12+
cloud:
13+
provider: "" # "s3" or "azblob" (empty = disabled)
14+
configMaps: [] # names of pre-existing ConfigMaps with cloud config env vars
15+
secrets: [] # names of pre-existing Secrets with cloud credentials
16+
```
17+
18+
- `provider` selects which cloud backend to use. Leave empty to disable cloud storage.
19+
- `configMaps` and `secrets` are lists of names of existing ConfigMap/Secret resources. They are mounted as `envFrom` on the hub pod, injecting all their keys as environment variables.
20+
21+
---
22+
23+
## Amazon S3
24+
25+
### Environment Variables
26+
27+
| Variable | Required | Description |
28+
|----------|----------|-------------|
29+
| `SNAPSHOT_AWS_BUCKET` | Yes | S3 bucket name |
30+
| `SNAPSHOT_AWS_REGION` | No | AWS region (uses SDK default if empty) |
31+
| `SNAPSHOT_AWS_ACCESS_KEY` | No | Static access key ID (empty = use default credential chain) |
32+
| `SNAPSHOT_AWS_SECRET_KEY` | No | Static secret access key |
33+
| `SNAPSHOT_AWS_ROLE_ARN` | No | IAM role ARN to assume via STS (for cross-account access) |
34+
| `SNAPSHOT_AWS_EXTERNAL_ID` | No | External ID for the STS AssumeRole call |
35+
| `SNAPSHOT_CLOUD_PREFIX` | No | Key prefix in the bucket (e.g. `snapshots/`) |
36+
37+
### Authentication Methods
38+
39+
Credentials are resolved in this order:
40+
41+
1. **Static credentials** -- If `SNAPSHOT_AWS_ACCESS_KEY` is set, static credentials are used directly.
42+
2. **STS AssumeRole** -- If `SNAPSHOT_AWS_ROLE_ARN` is also set, the static (or default) credentials are used to assume the given IAM role. This is useful for cross-account S3 access.
43+
3. **AWS default credential chain** -- When no static credentials are provided, the SDK default chain is used:
44+
- **IRSA** (EKS service account token) -- recommended for production on EKS
45+
- EC2 instance profile
46+
- Standard AWS environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, etc.)
47+
- Shared credentials file (`~/.aws/credentials`)
48+
49+
The provider validates bucket access on startup via `HeadBucket`. If the bucket is inaccessible, the hub will fail to start.
50+
51+
### Example: IRSA (recommended for EKS)
52+
53+
Create a ConfigMap with bucket configuration:
54+
55+
```yaml
56+
apiVersion: v1
57+
kind: ConfigMap
58+
metadata:
59+
name: kubeshark-s3-config
60+
data:
61+
SNAPSHOT_AWS_BUCKET: my-kubeshark-snapshots
62+
SNAPSHOT_AWS_REGION: us-east-1
63+
```
64+
65+
Set Helm values:
66+
67+
```yaml
68+
tap:
69+
snapshots:
70+
cloud:
71+
provider: "s3"
72+
configMaps:
73+
- kubeshark-s3-config
74+
```
75+
76+
The hub pod's service account must be annotated for IRSA with an IAM role that has S3 access to the bucket.
77+
78+
### Example: Static Credentials
79+
80+
Create a Secret with credentials:
81+
82+
```yaml
83+
apiVersion: v1
84+
kind: Secret
85+
metadata:
86+
name: kubeshark-s3-creds
87+
type: Opaque
88+
stringData:
89+
SNAPSHOT_AWS_ACCESS_KEY: AKIA...
90+
SNAPSHOT_AWS_SECRET_KEY: wJal...
91+
```
92+
93+
Create a ConfigMap with bucket configuration:
94+
95+
```yaml
96+
apiVersion: v1
97+
kind: ConfigMap
98+
metadata:
99+
name: kubeshark-s3-config
100+
data:
101+
SNAPSHOT_AWS_BUCKET: my-kubeshark-snapshots
102+
SNAPSHOT_AWS_REGION: us-east-1
103+
```
104+
105+
Set Helm values:
106+
107+
```yaml
108+
tap:
109+
snapshots:
110+
cloud:
111+
provider: "s3"
112+
configMaps:
113+
- kubeshark-s3-config
114+
secrets:
115+
- kubeshark-s3-creds
116+
```
117+
118+
### Example: Cross-Account Access via AssumeRole
119+
120+
Add the role ARN to your ConfigMap:
121+
122+
```yaml
123+
apiVersion: v1
124+
kind: ConfigMap
125+
metadata:
126+
name: kubeshark-s3-config
127+
data:
128+
SNAPSHOT_AWS_BUCKET: other-account-bucket
129+
SNAPSHOT_AWS_REGION: eu-west-1
130+
SNAPSHOT_AWS_ROLE_ARN: arn:aws:iam::123456789012:role/KubesharkCrossAccountRole
131+
SNAPSHOT_AWS_EXTERNAL_ID: my-external-id # optional, if required by the trust policy
132+
```
133+
134+
The hub will first authenticate using its own credentials (IRSA, static, or default chain), then assume the specified role to access the bucket.
135+
136+
---
137+
138+
## Azure Blob Storage
139+
140+
### Environment Variables
141+
142+
| Variable | Required | Description |
143+
|----------|----------|-------------|
144+
| `SNAPSHOT_AZBLOB_STORAGE_ACCOUNT` | Yes | Azure storage account name |
145+
| `SNAPSHOT_AZBLOB_CONTAINER` | Yes | Blob container name |
146+
| `SNAPSHOT_AZBLOB_STORAGE_KEY` | No | Storage account access key (empty = use DefaultAzureCredential) |
147+
| `SNAPSHOT_CLOUD_PREFIX` | No | Key prefix in the container (e.g. `snapshots/`) |
148+
149+
### Authentication Methods
150+
151+
Credentials are resolved in this order:
152+
153+
1. **Shared Key** -- If `SNAPSHOT_AZBLOB_STORAGE_KEY` is set, the storage account key is used directly.
154+
2. **DefaultAzureCredential** -- When no storage key is provided, the Azure SDK default credential chain is used:
155+
- **Workload Identity** (AKS pod identity) -- recommended for production on AKS
156+
- Managed Identity (system or user-assigned)
157+
- Azure CLI credentials
158+
- Environment variables (`AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_CLIENT_SECRET`)
159+
160+
The provider validates container access on startup via `GetProperties`. If the container is inaccessible, the hub will fail to start.
161+
162+
### Example: Workload Identity (recommended for AKS)
163+
164+
Create a ConfigMap with storage configuration:
165+
166+
```yaml
167+
apiVersion: v1
168+
kind: ConfigMap
169+
metadata:
170+
name: kubeshark-azblob-config
171+
data:
172+
SNAPSHOT_AZBLOB_STORAGE_ACCOUNT: mykubesharksa
173+
SNAPSHOT_AZBLOB_CONTAINER: snapshots
174+
```
175+
176+
Set Helm values:
177+
178+
```yaml
179+
tap:
180+
snapshots:
181+
cloud:
182+
provider: "azblob"
183+
configMaps:
184+
- kubeshark-azblob-config
185+
```
186+
187+
The hub pod's service account must be configured for AKS Workload Identity with a managed identity that has the **Storage Blob Data Contributor** role on the container.
188+
189+
### Example: Storage Account Key
190+
191+
Create a Secret with the storage key:
192+
193+
```yaml
194+
apiVersion: v1
195+
kind: Secret
196+
metadata:
197+
name: kubeshark-azblob-creds
198+
type: Opaque
199+
stringData:
200+
SNAPSHOT_AZBLOB_STORAGE_KEY: "base64-encoded-storage-key..."
201+
```
202+
203+
Create a ConfigMap with storage configuration:
204+
205+
```yaml
206+
apiVersion: v1
207+
kind: ConfigMap
208+
metadata:
209+
name: kubeshark-azblob-config
210+
data:
211+
SNAPSHOT_AZBLOB_STORAGE_ACCOUNT: mykubesharksa
212+
SNAPSHOT_AZBLOB_CONTAINER: snapshots
213+
```
214+
215+
Set Helm values:
216+
217+
```yaml
218+
tap:
219+
snapshots:
220+
cloud:
221+
provider: "azblob"
222+
configMaps:
223+
- kubeshark-azblob-config
224+
secrets:
225+
- kubeshark-azblob-creds
226+
```

‎charts/chart/templates/04-hub-deployment.yaml‎

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,17 @@ spec:
3737
- -loglevel
3838
- '{{ .Values.logLevel | default "warning" }}'
3939
- -capture-stop-after
40-
- "{{ if hasKey .Values.tap.capture "stopAfter" }}{{ .Values.tap.capture.stopAfter }}{{ else }}5m{{ end }}"
40+
- "{{ if hasKey .Values.tap.capture.dissection "stopAfter" }}{{ .Values.tap.capture.dissection.stopAfter }}{{ else }}5m{{ end }}"
4141
- -snapshot-size-limit
4242
- '{{ .Values.tap.snapshots.storageSize }}'
43-
{{- if .Values.tap.delayedDissection.image }}
4443
- -dissector-image
45-
- '{{ .Values.tap.delayedDissection.image }}'
46-
{{- end }}
44+
{{- if .Values.tap.docker.overrideImage.worker }}
45+
- '{{ .Values.tap.docker.overrideImage.worker }}'
46+
{{- else if .Values.tap.docker.overrideTag.worker }}
47+
- '{{ .Values.tap.docker.registry }}/worker:{{ .Values.tap.docker.overrideTag.worker }}'
48+
{{- else }}
49+
- '{{ .Values.tap.docker.registry }}/worker:{{ not (eq .Values.tap.docker.tag "") | ternary .Values.tap.docker.tag (include "kubeshark.defaultVersion" .) }}'
50+
{{- end }}
4751
{{- if .Values.tap.delayedDissection.cpu }}
4852
- -dissector-cpu
4953
- '{{ .Values.tap.delayedDissection.cpu }}'
@@ -55,12 +59,26 @@ spec:
5559
{{- if .Values.tap.gitops.enabled }}
5660
- -gitops
5761
{{- end }}
58-
{{- if .Values.tap.secrets }}
62+
- -cloud-api-url
63+
- '{{ .Values.cloudApiUrl }}'
64+
{{- if .Values.tap.snapshots.cloud.provider }}
65+
- -cloud-storage-provider
66+
- '{{ .Values.tap.snapshots.cloud.provider }}'
67+
{{- end }}
68+
{{- if or .Values.tap.secrets .Values.tap.snapshots.cloud.configMaps .Values.tap.snapshots.cloud.secrets }}
5969
envFrom:
6070
{{- range .Values.tap.secrets }}
6171
- secretRef:
6272
name: {{ . }}
6373
{{- end }}
74+
{{- range .Values.tap.snapshots.cloud.configMaps }}
75+
- configMapRef:
76+
name: {{ . }}
77+
{{- end }}
78+
{{- range .Values.tap.snapshots.cloud.secrets }}
79+
- secretRef:
80+
name: {{ . }}
81+
{{- end }}
6482
{{- end }}
6583
env:
6684
- name: POD_NAME
@@ -75,8 +93,6 @@ spec:
7593
value: '{{ (include "sentry.enabled" .) }}'
7694
- name: SENTRY_ENVIRONMENT
7795
value: '{{ .Values.tap.sentry.environment }}'
78-
- name: KUBESHARK_CLOUD_API_URL
79-
value: 'https://api.kubeshark.com'
8096
- name: PROFILING_ENABLED
8197
value: '{{ .Values.tap.pprof.enabled }}'
8298
{{- if .Values.tap.docker.overrideImage.hub }}
@@ -184,10 +200,10 @@ spec:
184200
- key: AUTH_SAML_X509_KEY
185201
path: kubeshark.key
186202
- name: snapshots-volume
187-
{{- if .Values.tap.snapshots.storageClass }}
203+
{{- if .Values.tap.snapshots.local.storageClass }}
188204
persistentVolumeClaim:
189205
claimName: {{ include "kubeshark.name" . }}-snapshots-pvc
190206
{{- else }}
191207
emptyDir:
192-
sizeLimit: {{ .Values.tap.snapshots.storageSize }}
208+
sizeLimit: {{ .Values.tap.snapshots.local.storageSize }}
193209
{{- end }}

‎charts/chart/templates/06-front-deployment.yaml‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,12 @@ spec:
4848
value: '{{ not (eq .Values.tap.auth.saml.idpMetadataUrl "") | ternary .Values.tap.auth.saml.idpMetadataUrl " " }}'
4949
- name: REACT_APP_TIMEZONE
5050
value: '{{ not (eq .Values.timezone "") | ternary .Values.timezone " " }}'
51+
- name: REACT_APP_SCRIPTING_HIDDEN
52+
value: '{{- if and .Values.scripting (eq (.Values.scripting.enabled | toString) "false") -}}
53+
true
54+
{{- else -}}
55+
false
56+
{{- end }}'
5157
- name: REACT_APP_SCRIPTING_DISABLED
5258
value: '{{- if .Values.tap.liveConfigMapChangesDisabled -}}
5359
{{- if .Values.demoModeEnabled -}}
@@ -66,20 +72,20 @@ spec:
6672
value: '{{ eq .Values.tap.packetCapture "af_packet" | ternary "false" "true" }}'
6773
- name: REACT_APP_RECORDING_DISABLED
6874
value: '{{ .Values.tap.liveConfigMapChangesDisabled }}'
69-
- name: REACT_APP_STOP_TRAFFIC_CAPTURING_DISABLED
70-
value: '{{- if and .Values.tap.liveConfigMapChangesDisabled .Values.tap.capture.stopped -}}
71-
false
75+
- name: REACT_APP_DISSECTION_ENABLED
76+
value: '{{ .Values.tap.capture.dissection.enabled | ternary "true" "false" }}'
77+
- name: REACT_APP_DISSECTION_CONTROL_ENABLED
78+
value: '{{- if and .Values.tap.liveConfigMapChangesDisabled (not .Values.tap.capture.dissection.enabled) -}}
79+
true
7280
{{- else -}}
73-
{{ .Values.tap.liveConfigMapChangesDisabled | ternary "true" "false" }}
81+
{{ not .Values.tap.liveConfigMapChangesDisabled | ternary "true" "false" }}
7482
{{- end -}}'
7583
- name: 'REACT_APP_CLOUD_LICENSE_ENABLED'
7684
value: '{{- if or (and .Values.cloudLicenseEnabled (not (empty .Values.license))) (not .Values.internetConnectivity) -}}
7785
"false"
7886
{{- else -}}
7987
{{ .Values.cloudLicenseEnabled }}
8088
{{- end }}'
81-
- name: 'REACT_APP_AI_ASSISTANT_ENABLED'
82-
value: '{{ .Values.aiAssistantEnabled | ternary "true" "false" }}'
8389
- name: REACT_APP_SUPPORT_CHAT_ENABLED
8490
value: '{{ and .Values.supportChatEnabled .Values.internetConnectivity | ternary "true" "false" }}'
8591
- name: REACT_APP_BETA_ENABLED

‎charts/chart/templates/09-snapshots-pvc.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
{{- if .Values.tap.snapshots.storageClass }}
2+
{{- if .Values.tap.snapshots.local.storageClass }}
33
apiVersion: v1
44
kind: PersistentVolumeClaim
55
metadata:
@@ -16,7 +16,7 @@ spec:
1616
- ReadWriteOnce
1717
resources:
1818
requests:
19-
storage: {{ .Values.tap.snapshots.storageSize }}
20-
storageClassName: {{ .Values.tap.snapshots.storageClass }}
19+
storage: {{ .Values.tap.snapshots.local.storageSize }}
20+
storageClassName: {{ .Values.tap.snapshots.local.storageClass }}
2121
status: {}
2222
{{- end }}

‎charts/chart/templates/09-worker-daemon-set.yaml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,10 +99,16 @@ spec:
9999
- '{{ .Values.tap.misc.resolutionStrategy }}'
100100
- -staletimeout
101101
- '{{ .Values.tap.misc.staleTimeoutSeconds }}'
102+
- -tcp-flow-full-timeout
103+
- '{{ .Values.tap.misc.tcpFlowTimeout }}'
104+
- -udp-flow-full-timeout
105+
- '{{ .Values.tap.misc.udpFlowTimeout }}'
102106
- -storage-size
103107
- '{{ .Values.tap.storageLimit }}'
104108
- -capture-db-max-size
105109
- '{{ .Values.tap.capture.dbMaxSize }}'
110+
- -cloud-api-url
111+
- '{{ .Values.cloudApiUrl }}'
106112
{{- if .Values.tap.docker.overrideImage.worker }}
107113
image: '{{ .Values.tap.docker.overrideImage.worker }}'
108114
{{- else if .Values.tap.docker.overrideTag.worker }}
@@ -129,8 +135,6 @@ spec:
129135
value: '{{ .Values.tap.misc.tcpStreamChannelTimeoutMs }}'
130136
- name: TCP_STREAM_CHANNEL_TIMEOUT_SHOW
131137
value: '{{ .Values.tap.misc.tcpStreamChannelTimeoutShow }}'
132-
- name: KUBESHARK_CLOUD_API_URL
133-
value: 'https://api.kubeshark.com'
134138
- name: PROFILING_ENABLED
135139
value: '{{ .Values.tap.pprof.enabled }}'
136140
- name: SENTRY_ENABLED
@@ -402,8 +406,8 @@ spec:
402406
- hostPath:
403407
path: /
404408
name: root
405-
- name: data
406409
{{- end }}
410+
- name: data
407411
{{- if .Values.tap.persistentStorage }}
408412
persistentVolumeClaim:
409413
claimName: kubeshark-persistent-volume-claim

0 commit comments

Comments
 (0)