mirror of
https://github.com/kubeshark/kubeshark.git
synced 2025-08-12 05:43:34 +00:00
upd readme
This commit is contained in:
parent
660fa1c3c1
commit
da061f3419
@ -112,7 +112,7 @@ Example for overriding image names:
|
|||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
docker:
|
docker:
|
||||||
overrideImage:
|
overrideImage:
|
||||||
worker: docker.io/kubeshark/worker:v52.3.87
|
worker: docker.io/kubeshark/worker:v52.3.87
|
||||||
front: docker.io/kubeshark/front:v52.3.87
|
front: docker.io/kubeshark/front:v52.3.87
|
||||||
hub: docker.io/kubeshark/hub:v52.3.87
|
hub: docker.io/kubeshark/hub:v52.3.87
|
||||||
@ -180,6 +180,7 @@ Example for overriding image names:
|
|||||||
| `tap.nodeSelectorTerms.workers` | Node selector terms for workers components | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
| `tap.nodeSelectorTerms.workers` | Node selector terms for workers components | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
||||||
| `tap.nodeSelectorTerms.hub` | Node selector terms for hub component | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
| `tap.nodeSelectorTerms.hub` | Node selector terms for hub component | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
||||||
| `tap.nodeSelectorTerms.front` | Node selector terms for front-end component | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
| `tap.nodeSelectorTerms.front` | Node selector terms for front-end component | `[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]` |
|
||||||
|
| `tap.priorityClass` | Priority class name for Kubeshark components | `""` |
|
||||||
| `tap.tolerations.workers` | Tolerations for workers components | `[ {"operator": "Exists", "effect": "NoExecute"}` |
|
| `tap.tolerations.workers` | Tolerations for workers components | `[ {"operator": "Exists", "effect": "NoExecute"}` |
|
||||||
| `tap.tolerations.hub` | Tolerations for hub component | `[]` |
|
| `tap.tolerations.hub` | Tolerations for hub component | `[]` |
|
||||||
| `tap.tolerations.front` | Tolerations for front-end component | `[]` |
|
| `tap.tolerations.front` | Tolerations for front-end component | `[]` |
|
||||||
@ -302,7 +303,7 @@ tap:
|
|||||||
|
|
||||||
[**Click here to see full docs**](https://docs.kubeshark.co/en/saml#installing-with-oidc-enabled-dex-idp).
|
[**Click here to see full docs**](https://docs.kubeshark.co/en/saml#installing-with-oidc-enabled-dex-idp).
|
||||||
|
|
||||||
Choose this option, if **you already have a running instance** of Dex in your cluster &
|
Choose this option, if **you already have a running instance** of Dex in your cluster &
|
||||||
you want to set up Dex OIDC authentication for Kubeshark users.
|
you want to set up Dex OIDC authentication for Kubeshark users.
|
||||||
|
|
||||||
Kubeshark supports authentication using [Dex - A Federated OpenID Connect Provider](https://dexidp.io/).
|
Kubeshark supports authentication using [Dex - A Federated OpenID Connect Provider](https://dexidp.io/).
|
||||||
@ -344,7 +345,7 @@ Add these helm values to set up OIDC authentication powered by your Dex IdP:
|
|||||||
```yaml
|
```yaml
|
||||||
# values.yaml
|
# values.yaml
|
||||||
|
|
||||||
tap:
|
tap:
|
||||||
auth:
|
auth:
|
||||||
enabled: true
|
enabled: true
|
||||||
type: dex
|
type: dex
|
||||||
@ -374,7 +375,7 @@ Once you run `helm install kubeshark kubeshark/kubeshark -f ./values.yaml`, Kube
|
|||||||
|
|
||||||
# Installing your own Dex IdP along with Kubeshark
|
# Installing your own Dex IdP along with Kubeshark
|
||||||
|
|
||||||
Choose this option, if **you need to deploy an instance of Dex IdP** along with Kubeshark &
|
Choose this option, if **you need to deploy an instance of Dex IdP** along with Kubeshark &
|
||||||
set up Dex OIDC authentication for Kubeshark users.
|
set up Dex OIDC authentication for Kubeshark users.
|
||||||
|
|
||||||
Depending on Ingress enabled/disabled, your Dex configuration might differ.
|
Depending on Ingress enabled/disabled, your Dex configuration might differ.
|
||||||
@ -410,10 +411,10 @@ The following Dex settings will have these values:
|
|||||||
|
|
||||||
Please, make sure to prepare the following things first.
|
Please, make sure to prepare the following things first.
|
||||||
|
|
||||||
1. Choose **[Connectors](https://dexidp.io/docs/connectors/)** to enable in Dex IdP.
|
1. Choose **[Connectors](https://dexidp.io/docs/connectors/)** to enable in Dex IdP.
|
||||||
- i.e. how many kind of "Log in with ..." options you'd like to offer your users
|
- i.e. how many kind of "Log in with ..." options you'd like to offer your users
|
||||||
- You will need to specify connectors in `tap.auth.dexConfig.connectors`
|
- You will need to specify connectors in `tap.auth.dexConfig.connectors`
|
||||||
2. Choose type of **[Storage](https://dexidp.io/docs/configuration/storage/)** to use in Dex IdP.
|
2. Choose type of **[Storage](https://dexidp.io/docs/configuration/storage/)** to use in Dex IdP.
|
||||||
- You will need to specify storage settings in `tap.auth.dexConfig.storage`
|
- You will need to specify storage settings in `tap.auth.dexConfig.storage`
|
||||||
- default: `memory`
|
- default: `memory`
|
||||||
3. Decide on the OAuth2 `?state=` param expiration time:
|
3. Decide on the OAuth2 `?state=` param expiration time:
|
||||||
@ -445,28 +446,28 @@ Make sure to:
|
|||||||
|
|
||||||
Helm `values.yaml`:
|
Helm `values.yaml`:
|
||||||
```yaml
|
```yaml
|
||||||
tap:
|
tap:
|
||||||
auth:
|
auth:
|
||||||
enabled: true
|
enabled: true
|
||||||
type: dex
|
type: dex
|
||||||
dexOidc:
|
dexOidc:
|
||||||
issuer: https://<your-ingress-hostname>/dex
|
issuer: https://<your-ingress-hostname>/dex
|
||||||
|
|
||||||
# Client ID/secret must be taken from `tap.auth.dexConfig.staticClients -> id/secret`
|
# Client ID/secret must be taken from `tap.auth.dexConfig.staticClients -> id/secret`
|
||||||
clientId: kubeshark
|
clientId: kubeshark
|
||||||
clientSecret: create your own client password
|
clientSecret: create your own client password
|
||||||
|
|
||||||
refreshTokenLifetime: "3960h" # 165 days
|
refreshTokenLifetime: "3960h" # 165 days
|
||||||
oauth2StateParamExpiry: "10m"
|
oauth2StateParamExpiry: "10m"
|
||||||
bypassSslCaCheck: false
|
bypassSslCaCheck: false
|
||||||
dexConfig:
|
dexConfig:
|
||||||
# This field is REQUIRED!
|
# This field is REQUIRED!
|
||||||
#
|
#
|
||||||
# The base path of Dex and the external name of the OpenID Connect service.
|
# The base path of Dex and the external name of the OpenID Connect service.
|
||||||
# This is the canonical URL that all clients MUST use to refer to Dex. If a
|
# This is the canonical URL that all clients MUST use to refer to Dex. If a
|
||||||
# path is provided, Dex's HTTP service will listen at a non-root URL.
|
# path is provided, Dex's HTTP service will listen at a non-root URL.
|
||||||
issuer: https://<your-ingress-hostname>/dex
|
issuer: https://<your-ingress-hostname>/dex
|
||||||
|
|
||||||
# Expiration configuration for tokens, signing keys, etc.
|
# Expiration configuration for tokens, signing keys, etc.
|
||||||
expiry:
|
expiry:
|
||||||
refreshTokens:
|
refreshTokens:
|
||||||
@ -474,15 +475,15 @@ tap:
|
|||||||
absoluteLifetime: "3960h" # 165 days
|
absoluteLifetime: "3960h" # 165 days
|
||||||
|
|
||||||
# This field is REQUIRED!
|
# This field is REQUIRED!
|
||||||
#
|
#
|
||||||
# The storage configuration determines where Dex stores its state.
|
# The storage configuration determines where Dex stores its state.
|
||||||
# See the documentation (https://dexidp.io/docs/storage/) for further information.
|
# See the documentation (https://dexidp.io/docs/storage/) for further information.
|
||||||
storage:
|
storage:
|
||||||
type: memory
|
type: memory
|
||||||
|
|
||||||
# This field is REQUIRED!
|
# This field is REQUIRED!
|
||||||
#
|
#
|
||||||
# Attention:
|
# Attention:
|
||||||
# Do not change this field and its values.
|
# Do not change this field and its values.
|
||||||
# This field is required for internal Kubeshark-to-Dex communication.
|
# This field is required for internal Kubeshark-to-Dex communication.
|
||||||
#
|
#
|
||||||
@ -492,7 +493,7 @@ tap:
|
|||||||
|
|
||||||
# This field is REQUIRED!
|
# This field is REQUIRED!
|
||||||
#
|
#
|
||||||
# Attention:
|
# Attention:
|
||||||
# Do not change this field and its values.
|
# Do not change this field and its values.
|
||||||
# This field is required for internal Kubeshark-to-Dex communication.
|
# This field is required for internal Kubeshark-to-Dex communication.
|
||||||
#
|
#
|
||||||
@ -518,10 +519,10 @@ tap:
|
|||||||
# Connectors are used to authenticate users against upstream identity providers.
|
# Connectors are used to authenticate users against upstream identity providers.
|
||||||
# See the documentation (https://dexidp.io/docs/connectors/) for further information.
|
# See the documentation (https://dexidp.io/docs/connectors/) for further information.
|
||||||
#
|
#
|
||||||
# Attention:
|
# Attention:
|
||||||
# When you define a new connector, `config.redirectURI` must be:
|
# When you define a new connector, `config.redirectURI` must be:
|
||||||
# https://<your-ingress-hostname>/dex/callback
|
# https://<your-ingress-hostname>/dex/callback
|
||||||
#
|
#
|
||||||
# Example with Google connector:
|
# Example with Google connector:
|
||||||
# connectors:
|
# connectors:
|
||||||
# - type: google
|
# - type: google
|
||||||
|
Loading…
Reference in New Issue
Block a user