mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-07-17 01:54:32 +00:00
ad9dfbf5f9
* Add install skill for Kubeshark deployment guidance New skill that helps users install and configure Kubeshark with a clear CLI vs Helm decision tree, opinionated production defaults, and platform-specific storage class recommendations. * Add user-invocable flag to install skill frontmatter * Add backup/overwrite check guidance for ~/.kubeshark/ config files --------- Co-authored-by: Alon Girmonsky <alongir@Alons-Mac-Studio.local>
10 KiB
10 KiB
Kubeshark Helm Values Reference
Complete reference for all Kubeshark Helm chart values. Use this when building
custom values.yaml files or --set flags.
Docker Images
tap:
docker:
registry: docker.io/kubeshark # Docker registry
tag: "" # Image tag (empty = chart appVersion)
tagLocked: true # Lock to specific tag
imagePullPolicy: Always # Always, IfNotPresent, Never
imagePullSecrets: [] # Registry pull secrets
overrideImage: # Override individual component images
worker: ""
hub: ""
front: ""
overrideTag: # Override individual component tags
worker: ""
hub: ""
front: ""
Proxy / Port-Forward
tap:
proxy:
worker:
srvPort: 48999
hub:
srvPort: 8898
front:
port: 8899 # Local port for port-forward
host: 127.0.0.1 # Bind address
Pod Targeting
tap:
regex: .* # Pod name regex filter
namespaces: [] # Target namespaces (empty = all)
excludedNamespaces: [] # Namespaces to exclude
bpfOverride: "" # Custom BPF filter override
Capture & Dissection
tap:
capture:
dissection:
enabled: true # Enable L7 dissection
stopAfter: 5m # Auto-stop dissection after duration
captureSelf: false # Capture Kubeshark's own traffic
raw:
enabled: true # Enable raw packet capture (needed for snapshots)
storageSize: 1Gi # FIFO buffer size per node
dbMaxSize: 500Mi # Max L7 database size per node
delayedDissection:
cpu: "1" # CPU for delayed dissection jobs
memory: 4Gi # Memory for delayed dissection jobs
storageSize: "" # Storage for delayed dissection
storageClass: "" # Storage class for delayed dissection
Snapshots
tap:
snapshots:
local:
storageClass: "" # Storage class for local snapshots
storageSize: 20Gi # PVC size for local snapshots
cloud:
provider: "" # s3, gcs, or azblob
prefix: "" # Path prefix in bucket
configMaps: [] # Additional ConfigMaps to mount
secrets: [] # Additional Secrets to mount
s3:
bucket: ""
region: ""
accessKey: ""
secretKey: ""
roleArn: "" # IAM role ARN (IRSA)
externalId: "" # STS external ID
azblob:
storageAccount: ""
container: ""
storageKey: ""
gcs:
bucket: ""
project: ""
credentialsJson: "" # Service account JSON
Helm Release
tap:
release:
repo: https://helm.kubeshark.com # Helm chart repository
name: kubeshark # Release name
namespace: default # Release namespace
helmChartPath: "" # Path to local chart (overrides repo)
Storage
tap:
persistentStorage: false # Enable PVC for worker data
persistentStorageStatic: false # Static provisioning
persistentStoragePvcVolumeMode: FileSystem # FileSystem or Block
efsFileSytemIdAndPath: "" # EFS file system ID (EKS)
secrets: [] # Additional secrets to mount
storageLimit: 10Gi # Max storage per node
storageClass: standard # Default storage class
Resources
tap:
resources:
hub:
limits:
cpu: "0" # 0 = no limit
memory: 5Gi
requests:
cpu: 50m
memory: 50Mi
sniffer:
limits:
cpu: "0"
memory: 5Gi
requests:
cpu: 50m
memory: 50Mi
tracer:
limits:
cpu: "0"
memory: 5Gi
requests:
cpu: 50m
memory: 50Mi
Health Probes
tap:
probes:
hub:
initialDelaySeconds: 5
periodSeconds: 5
successThreshold: 1
failureThreshold: 3
sniffer:
initialDelaySeconds: 5
periodSeconds: 5
successThreshold: 1
failureThreshold: 3
TLS & Service Mesh
tap:
serviceMesh: true # Capture mTLS traffic (service mesh)
tls: true # Capture OpenSSL/Go TLS traffic
disableTlsLog: true # Suppress TLS debug logging
packetCapture: best # Capture method: best, af_packet, pcap
Labels, Annotations & Scheduling
tap:
labels: {} # Additional labels for all pods
annotations: {} # Additional annotations for all pods
nodeSelectorTerms:
hub: # Hub pod node selector
- matchExpressions:
- key: kubernetes.io/os
operator: In
values: [linux]
workers: # Worker DaemonSet node selector
- matchExpressions:
- key: kubernetes.io/os
operator: In
values: [linux]
front: # Frontend pod node selector
- matchExpressions:
- key: kubernetes.io/os
operator: In
values: [linux]
tolerations:
hub: []
workers:
- operator: Exists
effect: NoExecute # Workers tolerate NoExecute by default
front: []
priorityClass: "" # PriorityClassName for pods
Authentication
tap:
auth:
enabled: false
type: saml # Only SAML supported currently
roles:
admin:
filter: "" # KFL filter restricting visible traffic
canDownloadPCAP: true
canUseScripting: true
scriptingPermissions:
canSave: true
canActivate: true
canDelete: true
canUpdateTargetedPods: true
canStopTrafficCapturing: true
canControlDissection: true
showAdminConsoleLink: true
rolesClaim: role # SAML attribute for role mapping
defaultRole: "" # Role for users without a role claim
defaultFilter: "" # Default KFL filter for all users
saml:
idpMetadataUrl: "" # SAML IdP metadata URL
x509crt: "" # SP certificate
x509key: "" # SP private key
Ingress
tap:
ingress:
enabled: false
className: "" # nginx, alb, traefik, etc.
host: ks.svc.cluster.local
path: /
tls: [] # TLS configuration
annotations: {} # Ingress annotations
Protocol Dissectors
tap:
enabledDissectors:
- amqp
- dns
- http
- icmp
- kafka
- mongodb
- mysql
- postgresql
- redis
- ws
- ldap
- radius
- diameter
- udp-flow
- tcp-flow
- udp-conn
- tcp-conn
portMapping: # Default port-to-protocol mappings
http: [80, 443, 8080]
amqp: [5671, 5672]
kafka: [9092]
mongodb: [27017]
mysql: [3306]
postgresql: [5432]
redis: [6379]
ldap: [389]
diameter: [3868]
customMacros:
https: "tls and (http or http2)"
Networking & Security
tap:
hostNetwork: true # Use host network (required for capture)
ipv6: true # Enable IPv6 support
mountBpf: true # Mount BPF filesystem
securityContext:
privileged: true
appArmorProfile:
type: ""
localhostProfile: ""
seLinuxOptions:
level: ""
role: ""
type: ""
user: ""
capabilities:
networkCapture: [NET_RAW, NET_ADMIN]
serviceMeshCapture: [SYS_ADMIN, SYS_PTRACE, DAC_OVERRIDE]
ebpfCapture: [SYS_ADMIN, SYS_PTRACE, SYS_RESOURCE, IPC_LOCK]
Dashboard
tap:
dashboard:
streamingType: connect-rpc
completeStreamingEnabled: true
clusterWideMapEnabled: false
entriesLimit: "300000"
routing:
front:
basePath: "" # Base path for reverse proxy
Scripting
scripting:
enabled: false
env: {} # Environment variables for scripts
source: "" # Git repo for scripts
sources: [] # Multiple script sources
watchScripts: true # Watch for script changes
active: [] # Active scripts
console: true # Enable script console
Misc
tap:
dryRun: false # Preview targeted pods without deploying
debug: false # Enable debug mode
telemetry:
enabled: true # Anonymous usage telemetry
resourceGuard:
enabled: false # Resource usage guard
watchdog:
enabled: false # Watchdog process
gitops:
enabled: false # GitOps mode
defaultFilter: "" # Default KFL display filter
globalFilter: "" # Global KFL filter (cannot be overridden)
dns:
nameservers: [] # Custom DNS nameservers
searches: [] # Custom DNS search domains
options: [] # Custom DNS options
misc:
jsonTTL: 5m # TTL for JSON entries
pcapTTL: "0" # TTL for PCAP files (0 = no TTL)
trafficSampleRate: 100 # Traffic sampling rate (1-100)
resolutionStrategy: auto # IP resolution: auto, dns, k8s
detectDuplicates: false # Detect duplicate packets
staleTimeoutSeconds: 30 # Timeout for stale connections
tcpFlowTimeout: 1200 # TCP flow idle timeout (seconds)
udpFlowTimeout: 1200 # UDP flow idle timeout (seconds)
headless: false # Suppress browser auto-open
license: "" # Kubeshark Pro license key
timezone: "" # Override timezone
logLevel: warning # Log level: debug, info, warning, error
kube:
configPath: "" # Custom kubeconfig path
context: "" # Kubernetes context name