Configuration

Kubeshark reads configuration elements both from the CLI and from a configuration file that can be located either in $HOME/.kubeshark/config.yaml.

The Config Command

kubeshark config - The config command generates a ​​Kubeshark​​ config file with default values. kubeshark config -r will read the existing config file, if one exists, and will merge its values into a new config file and save to the config file location (~/.kubeshark/config.yaml).

Dashboard IP and Accessibility

For security reasons, the default address of the proxy host for the Kubeshark dashboard is set to 127.0.0.1 that allows opening only local connections.

tap:
    proxy:
        host: 127.0.0.1

Alternatively, use the shell config option:

kubeshark tap --proxy-host 0.0.0.0

Consider changing this address to 0.0.0.0 or any other publicly accessible IP, to allow public address. Keep in mind that the proxy does not terminate TLS, and that on a default installation the dashboard identifies nobody: tap.auth.enabled is false, so every caller is resolved to tap.auth.defaultRole, which defaults to kubeshark-admin. Before exposing this address, either enable authentication or narrow that role — see Roles & Permissions.

When you run Kubeshark on a remote server, make sure ports 8898-8899 are open for external connections.

Kubeshark Resource Assignment Limits

Use to change the amount of resources assigned to Kubeshark.

tap:
    resources:
        hub:
            limits:
                cpu: 750m
                memory: 1Gi
            requests:
                cpu: 50m
                memory: 50Mi
        sniffer:
            limits:
                cpu: 750m
                memory: 1Gi
            requests:
                cpu: 50m
                memory: 50Mi
        tracer:
            limits:
                cpu: 750m
                memory: 1Gi
            requests:
                cpu: 50m
                memory: 50Mi

The components are hub, sniffer and tracer; there is no worker key. See Workload Resources.

Run Kubeshark Headless

By default, the Kubeshark dashboard opens automatically. If you are running Kubeshark on a headless machine and you’d like NOT to open the dashboard, set headless to true.

headless: true

Alternatively, use the shell config option:

kubeshark tap --set headless=true

Public IP and Headless

This is a very popular option that enables running Kubeshark on a public IP and without opening the its dashboard.

tap:
    proxy:
        host: 0.0.0.0
headless: true

Alternatively, use the shell config option:

kubeshark tap --proxy-host 0.0.0.0 --set headless=true

You can now access the Kubeshark dashboard from a remote server.

As stated above, when you run Kubeshark on a remote server, make sure ports 8898-8899 are open for external connections.

Scripts

Information related to Kubeshark’s scripting engine. For example:

scripting:
    env:
      VAR-1: "VALUE"
      VAR-2: 77
    source: "/path/to/script/folder"

Source Folders

scripting:
    source: "/path/to/script/folder"

A path for the scripts folder. If not empty and pre-populated with scripts, all script will run when Kubeshark starts.

Environment Variables

This section includes variable that can be used inside of scripts.

scripting:
    env:
      VAR-1: "VALUE"
      VAR-2: 77