🔨 Add tracer as a separate container to worker DaemonSet (#1428)

* 🔨 Add `tracer` as a separate container to worker `DaemonSet`

* 🔥 Delete some of the unused connector methods

* 🔨 Set `POD_NAME` and `POD_NAMESPACE` environment variables in worker `DeamonSet`

* 🔨 Set `POD_NAME` and `POD_NAMESPACE` environment variables in hub `Deployment`

* Fix the labels

* Fix the self config role

* Restrict it to specific resource names

* Run `make generate-manifests`

helm-chart/templates/02-cluster-role.yaml

@@ -34,18 +34,19 @@ metadata:
   {{- if .Values.tap.annotations }}
     {{- toYaml .Values.tap.annotations | nindent 4 }}
   {{- end }}
-  name: kubeshark-self-secrets-role
+  name: kubeshark-self-config-role
   namespace: {{ .Release.Namespace }}
 rules:
   - apiGroups:
-      - "v1"
       - ""
+      - v1
     resourceNames:
       - kubeshark-secret
+      - kubeshark-config-map
     resources:
       - secrets
+      - configmaps
     verbs:
       - get
       - watch
       - update
-      - patch

helm-chart/templates/03-cluster-role-binding.yaml

@@ -22,19 +22,19 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: kubeshark-self-secrets-role-binding
   labels:
     {{- include "kubeshark.labels" . | nindent 4 }}
   annotations:
   {{- if .Values.tap.annotations }}
     {{- toYaml .Values.tap.annotations | nindent 4 }}
   {{- end }}
+  name: kubeshark-self-config-role-binding
   namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubeshark-self-config-role
 subjects:
   - kind: ServiceAccount
     name: {{ include "kubeshark.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: Role
-  name: kubeshark-self-secrets-role
-  apiGroup: rbac.authorization.k8s.io

helm-chart/templates/04-hub-deployment.yaml

@@ -1,8 +1,7 @@
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "kubeshark.fullname" . }}-hub
-  namespace: {{ .Release.Namespace }}
   labels:
     app.kubeshark.co/app: hub
     {{- include "kubeshark.labels" . | nindent 4 }}
@@ -10,16 +9,19 @@ metadata:
   {{- if .Values.tap.annotations }}
     {{- toYaml .Values.tap.annotations | nindent 4 }}
   {{- end }}
+  name: {{ include "kubeshark.fullname" . }}-hub
+  namespace: {{ .Release.Namespace }}
 spec:
   replicas: 1  # Set the desired number of replicas
   selector:
     matchLabels:
       app.kubeshark.co/app: hub
+      {{- include "kubeshark.labels" . | nindent 6 }}
   template:
     metadata:
       labels:
         app.kubeshark.co/app: hub
-        sidecar.istio.io/inject: "false"
+        {{- include "kubeshark.labels" . | nindent 8 }}
     spec:
       dnsPolicy: ClusterFirstWithHostNet
       serviceAccountName: {{ include "kubeshark.serviceAccountName" . }}
@@ -28,6 +30,15 @@ spec:
           command:
             - ./hub
             {{ .Values.tap.debug | ternary "- -debug" "" }}
+          env:
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
           envFrom:
             - configMapRef:
                 name: kubeshark-config-map

helm-chart/templates/06-front-deployment.yaml

@@ -1,8 +1,6 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "kubeshark.fullname" . }}-front
-  namespace: {{ .Release.Namespace }}
   labels:
     app.kubeshark.co/app: front
     {{- include "kubeshark.labels" . | nindent 4 }}
@@ -10,15 +8,19 @@ metadata:
   {{- if .Values.tap.annotations }}
     {{- toYaml .Values.tap.annotations | nindent 4 }}
   {{- end }}
+  name: {{ include "kubeshark.fullname" . }}-front
+  namespace: {{ .Release.Namespace }}
 spec:
   replicas: 1  # Set the desired number of replicas
   selector:
     matchLabels:
       app.kubeshark.co/app: front
+      {{- include "kubeshark.labels" . | nindent 6 }}
   template:
     metadata:
       labels:
         app.kubeshark.co/app: front
+        {{- include "kubeshark.labels" . | nindent 8 }}
     spec:
       containers:
         - env:

helm-chart/templates/09-worker-daemon-set.yaml

@@ -33,13 +33,21 @@ spec:
             - -port
             - '{{ .Values.tap.proxy.worker.srvport }}'
             - -servicemesh
-            {{ .Values.tap.tls | ternary "- -tls" "" }}
             - -procfs
             - /hostproc
             {{ .Values.tap.debug | ternary "- -debug" "" }}
           image: '{{ .Values.tap.docker.registry }}/worker:{{ .Values.tap.docker.tag }}'
           imagePullPolicy: {{ .Values.tap.docker.imagepullpolicy }}
-          name: kubeshark-worker-daemon-set
+          name: sniffer
+          env:
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
           envFrom:
             - secretRef:
                 name: kubeshark-secret
@@ -67,7 +75,6 @@ spec:
                 - SYS_ADMIN
                 - SYS_PTRACE
                 - DAC_OVERRIDE
-                - SYS_RESOURCE
                 - SYS_MODULE
               drop:
                 - ALL
@@ -92,10 +99,60 @@ spec:
             - mountPath: /sys
               name: sys
               readOnly: true
-{{- if .Values.tap.persistentstorage }}
+          {{- if .Values.tap.persistentstorage }}
             - mountPath: /app/data
               name: kubeshark-persistent-volume
-{{- end }}
+          {{- end }}
+      {{- if .Values.tap.tls }}
+        - command:
+            - ./tracer
+            - -procfs
+            - /hostproc
+            {{ .Values.tap.debug | ternary "- -debug" "" }}
+          image: '{{ .Values.tap.docker.registry }}/worker:{{ .Values.tap.docker.tag }}'
+          imagePullPolicy: {{ .Values.tap.docker.imagepullpolicy }}
+          name: tracer
+          env:
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+          envFrom:
+            - secretRef:
+                name: kubeshark-secret
+          resources:
+            limits:
+              cpu: {{ .Values.tap.resources.worker.limits.cpu }}
+              memory: {{ .Values.tap.resources.worker.limits.memory }}
+            requests:
+              cpu: {{ .Values.tap.resources.worker.requests.cpu }}
+              memory: {{ .Values.tap.resources.worker.requests.memory }}
+          securityContext:
+            capabilities:
+              add:
+                - SYS_ADMIN
+                - SYS_PTRACE
+                - DAC_OVERRIDE
+                - SYS_RESOURCE
+                - SYS_MODULE
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /hostproc
+              name: proc
+              readOnly: true
+            - mountPath: /sys
+              name: sys
+              readOnly: true
+          {{- if .Values.tap.persistentstorage }}
+            - mountPath: /app/data
+              name: kubeshark-persistent-volume
+          {{- end }}
+      {{- end }}
       dnsPolicy: ClusterFirstWithHostNet
       hostNetwork: true
       serviceAccountName: {{ include "kubeshark.serviceAccountName" . }}

helm-chart/templates/12-config-map.yaml

@@ -10,7 +10,7 @@ data:
     POD_REGEX: '{{ .Values.tap.regex }}'
     NAMESPACES: '{{ gt (len .Values.tap.namespaces) 0 | ternary (join "," .Values.tap.namespaces) "" }}'
     SCRIPTING_ENV: '{{ .Values.scripting.env | toJson }}'
-    SCRIPTING_SCRIPTS: '[]'
+    SCRIPTING_SCRIPTS: '{}'
     AUTH_ENABLED: '{{ .Values.tap.auth.enabled | ternary "true" "" }}'
     AUTH_APPROVED_EMAILS: '{{ gt (len .Values.tap.auth.approvedemails) 0 | ternary (join "," .Values.tap.auth.approvedemails) "" }}'
     AUTH_APPROVED_DOMAINS: '{{ gt (len .Values.tap.auth.approveddomains) 0 | ternary (join "," .Values.tap.auth.approveddomains) "" }}'