helm repo add kubeshark https://helm.kubeshark.com

helm install kubeshark kubeshark/kubeshark

git clone [email protected]:kubeshark/kubeshark.git --depth 1
cd kubeshark/helm-chart

git clone [email protected]:kubeshark/kubeshark.git --depth 1 --branch <tag>
cd kubeshark/helm-chart

helm template .

helm install kubeshark .

helm uninstall kubeshark

kubectl port-forward service/kubeshark-front 8899:80

--set license=YOUR_LICENSE_GOES_HERE

helm install kubeshark kubeshark/kubeshark -f values.yaml

tap:
  ingress:
    enabled: true
    className: "alb"
    host: ks.example.com
    tls: []
    annotations:
      alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:7..8:certificate/b...65c
      alb.ingress.kubernetes.io/target-type: ip
      alb.ingress.kubernetes.io/scheme: internet-facing

helm install kubeshark kubeshark/kubeshark \
  --set tap.ipv6=false

  docker:
    overrideImage:
      worker: docker.io/kubeshark/worker:v52.3.87
      front:  docker.io/kubeshark/front:v52.3.87
      hub:    docker.io/kubeshark/hub:v52.3.87

openssl genrsa -out mykey.key 2048
openssl req -new -key mykey.key -out mycsr.csr
openssl x509 -signkey mykey.key -in mycsr.csr -req -days 365 -out mycert.crt

helm install kubeshark kubeshark/kubeshark -f values.yaml

tap:
  auth:
    enabled: true
    type: saml
    saml:
      idpMetadataUrl: "https://ti..th0.com/samlp/metadata/MpWiDCM..qdnDG"
      x509crt: |
        -----BEGIN CERTIFICATE-----
        MIIDlTCCAn0CFFRUzMh+dZvp+FvWd4gRaiBVN8EvMA0GCSqGSIb3DQEBCwUAMIGG
        MSQwIgYJKoZIhvcNAQkBFhV3ZWJtYXN0ZXJAZXhhbXBsZS5jb20wHhcNMjMxMjI4
        ........<redacted: please, generate your own X.509 cert>........
        ZMzM7YscqZwoVhTOhrD4/5nIfOD/hTWG/MBe2Um1V1IYF8aVEllotTKTgsF6ZblA
        miCOgl6lIlZy
        -----END CERTIFICATE-----
      x509key: |
        -----BEGIN PRIVATE KEY-----
        MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDlgDFKsRHj+mok
        euOF0IpwToOEpQGtafB75ytv3psD/tQAzEIug+rkDriVvsfcvafj0qcaTeYvnCoz
        ........<redacted: please, generate your own X.509 key>.........
        sUpBCu0E3nRJM/QB2ui5KhNR7uvPSL+kSsaEq19/mXqsL+mRi9aqy2wMEvUSU/kt
        UaV5sbRtTzYLxpOSQyi8CEFA+A==
        -----END PRIVATE KEY-----

staticClients:
   - id: kubeshark
     secret: create your own client password
     name: Kubeshark
     redirectURIs:
     - https://<your-kubeshark-host>/api/oauth2/callback

# values.yaml

tap:
  auth:
    enabled: true
    type: dex
    dexOidc:
      issuer: <put Dex IdP issuer URL here>
      clientId: kubeshark
      clientSecret: create your own client password
      refreshTokenLifetime: "3960h" # 165 days
      oauth2StateParamExpiry: "10m"
      bypassSslCaCheck: false

tap:
  ingress:
    enabled: true
    className: "alb"
    host: ks.example.com
    tls: []
    annotations:
      alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:7..8:certificate/b...65c
      alb.ingress.kubernetes.io/target-type: ip
      alb.ingress.kubernetes.io/scheme: internet-facing

tap:
  auth:
    enabled: true
    type: dex
    dexOidc:
      issuer: https://<your-ingress-hostname>/dex

      # Client ID/secret must be taken from `tap.auth.dexConfig.staticClients -> id/secret`
      clientId: kubeshark
      clientSecret: create your own client password

      refreshTokenLifetime: "3960h" # 165 days
      oauth2StateParamExpiry: "10m"
      bypassSslCaCheck: false
    dexConfig:
      # This field is REQUIRED!
      #
      # The base path of Dex and the external name of the OpenID Connect service.
      # This is the canonical URL that all clients MUST use to refer to Dex. If a
      # path is provided, Dex's HTTP service will listen at a non-root URL.
      issuer: https://<your-ingress-hostname>/dex

      # Expiration configuration for tokens, signing keys, etc.
      expiry:
        refreshTokens:
          validIfNotUsedFor: "2160h" # 90 days
          absoluteLifetime: "3960h"  # 165 days

      # This field is REQUIRED!
      #
      # The storage configuration determines where Dex stores its state.
      # See the documentation (https://dexidp.io/docs/storage/) for further information.
      storage:
        type: memory

      # This field is REQUIRED!
      #
      # Attention:
      # Do not change this field and its values.
      # This field is required for internal Kubeshark-to-Dex communication.
      #
      # HTTP service configuration
      web:
        http: 0.0.0.0:5556

      # This field is REQUIRED!
      #
      # Attention:
      # Do not change this field and its values.
      # This field is required for internal Kubeshark-to-Dex communication.
      #
      # Telemetry configuration
      telemetry:
        http: 0.0.0.0:5558

      # This field is REQUIRED!
      #
      # Static clients registered in Dex by default.
      staticClients:
        - id: kubeshark
          secret: create your own client password
          name: Kubeshark
          redirectURIs:
          - https://<your-ingress-hostname>/api/oauth2/callback

      # Enable the password database.
      # It's a "virtual" connector (identity provider) that stores
      # login credentials in Dex's store.
      enablePasswordDB: true

      # Connectors are used to authenticate users against upstream identity providers.
      # See the documentation (https://dexidp.io/docs/connectors/) for further information.
      #
      # Attention:
      # When you define a new connector, `config.redirectURI` must be:
      # https://<your-ingress-hostname>/dex/callback
      #
      # Example with Google connector:
      # connectors:
      #  - type: google
      #    id: google
      #    name: Google
      #    config:
      #      clientID: your Google Cloud Auth app client ID
      #      clientSecret: your Google Auth app client ID
      #      redirectURI: https://<your-ingress-hostname>/dex/callback
      connectors: []