github/kubeshark
1
0
Fork 0
mirror of https://github.com/kubeshark/kubeshark.git synced 2025-09-26 04:54:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add raw capture config parameters

Browse Source
This commit is contained in:
Volodymyr Stoiko
2025-09-24 16:53:00 +03:00
parent 349d8b07df
commit 119040284d
4 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
config/configStructs/tapConfig.go
View File

@@ -300,9 +300,15 @@ type SeLinuxOptionsConfig struct {
User string `yaml:"user" json:"user"` User string `yaml:"user" json:"user"`
} }
type RawCaptureConfig struct {
Enabled bool `yaml:"enabled" json:"enabled" default:"false"`
StorageSize string `yaml:"storageSize" json:"storageSize" default:"1GB"`
}
type CaptureConfig struct { type CaptureConfig struct {
Stopped bool `yaml:"stopped" json:"stopped" default:"false"` Stopped bool `yaml:"stopped" json:"stopped" default:"false"`
StopAfter string `yaml:"stopAfter" json:"stopAfter" default:"5m"` StopAfter string `yaml:"stopAfter" json:"stopAfter" default:"5m"`
Raw RawCaptureConfig `yaml:"raw" json:"raw"`
} }
type TapConfig struct { type TapConfig struct {

2
helm-chart/README.md
View File

@@ -140,6 +140,8 @@ Example for overriding image names:
| `tap.bpfOverride` | When using AF_PACKET as a traffic capture backend, override any existing pod targeting rules and set explicit BPF expression (e.g. `net 0.0.0.0/0`). | `[]` | | `tap.bpfOverride` | When using AF_PACKET as a traffic capture backend, override any existing pod targeting rules and set explicit BPF expression (e.g. `net 0.0.0.0/0`). | `[]` |
| `tap.capture.stopped` | Set to `false` to have traffic processing start automatically. When set to `true`, traffic processing is stopped by default, resulting in almost no resource consumption (e.g. Kubeshark is dormant). This property can be dynamically control via the dashboard. | `false` | | `tap.capture.stopped` | Set to `false` to have traffic processing start automatically. When set to `true`, traffic processing is stopped by default, resulting in almost no resource consumption (e.g. Kubeshark is dormant). This property can be dynamically control via the dashboard. | `false` |
| `tap.capture.stopAfter` | Set to a duration (e.g. `30s`) to have traffic processing stop after no websocket activity between worker and hub. | `30s` | | `tap.capture.stopAfter` | Set to a duration (e.g. `30s`) to have traffic processing stop after no websocket activity between worker and hub. | `30s` |
| `tap.capture.raw.enabled` | Enable raw capture of packets and syscalls to disk for offline analysis | `false` |
| `tap.capture.raw.storageSize` | Maximum storage size for raw capture files (supports K8s quantity format: `1Gi`, `500Mi`, etc.) | `1GB` |
| `tap.release.repo` | URL of the Helm chart repository | `https://helm.kubeshark.co` | | `tap.release.repo` | URL of the Helm chart repository | `https://helm.kubeshark.co` |
| `tap.release.name` | Helm release name | `kubeshark` | | `tap.release.name` | Helm release name | `kubeshark` |
| `tap.release.namespace` | Helm release namespace | `default` | | `tap.release.namespace` | Helm release namespace | `default` |

2
helm-chart/templates/12-config-map.yaml
View File

@@ -83,3 +83,5 @@ data:
PCAP_MAX_TIME: '{{ .Values.pcapdump.maxTime }}' PCAP_MAX_TIME: '{{ .Values.pcapdump.maxTime }}'
PCAP_MAX_SIZE: '{{ .Values.pcapdump.maxSize }}' PCAP_MAX_SIZE: '{{ .Values.pcapdump.maxSize }}'
PORT_MAPPING: '{{ toJson .Values.tap.portMapping }}' PORT_MAPPING: '{{ toJson .Values.tap.portMapping }}'
RAW_CAPTURE: '{{ .Values.tap.capture.raw.enabled | ternary "true" "false" }}'
RAW_CAPTURE_STORAGE_SIZE: '{{ .Values.tap.capture.raw.storageSize }}'

4
helm-chart/values.yaml
View File

@@ -29,6 +29,9 @@ tap:
capture: capture:
stopped: false stopped: false
stopAfter: 5m stopAfter: 5m
raw:
enabled: false
storageSize: 1GB
release: release:
repo: https://helm.kubeshark.co repo: https://helm.kubeshark.co
name: kubeshark name: kubeshark
@@ -149,6 +152,7 @@ tap:
ipv6: true ipv6: true
debug: false debug: false
dashboard: dashboard:
streamingType: ""
completeStreamingEnabled: true completeStreamingEnabled: true
telemetry: telemetry:
enabled: true enabled: true