Add support to KUBECONFIG env var about kubeshark

[ksudhir007]

Thanks @fandujar I started playing around with mizu few mins back. I don't have permission on ALL resources on the cluster but I am limited to a specific namespace. I was wondering what permission would it need to run mizu ?

I see below error even when I specify the namespace using -n option

$ ./mizu tap "shopping-cart-*" -A -n ksudhir007
Tapping pods in all namespaces
warning: could not ensure mizu rbac resources exist serviceaccounts "mizu-service-account" is forbidden: User "ksudhir007" cannot get resource "serviceaccounts" in API group "" in the namespace "default"
Error creating mizu tapper daemonset: daemonsets.apps "mizu-tapper-daemon-set" is forbidden: User "ksudhir007" cannot patch resource "daemonsets" in API group "apps" in the namespace "default"

Removing mizu resources
Error removing DaemonSet mizu-tapper-daemon-set in namespace default: daemonsets.apps "mizu-tapper-daemon-set" is forbidden: User "ksudhir007" cannot list resource "daemonsets" in API group "apps" in the namespace "default" (daemonsets.apps "mizu-tapper-daemon-set" is forbidden: User "ksudhir007" cannot list resource "daemonsets" in API group "apps" in the namespace "default",daemonsets.apps "mizu-tapper-daemon-set" is forbidden: User "ksudhir007" cannot list resource "daemonsets" in API group "apps" in the namespace "default")

Happy to update the documentation once I find the answer.

[ksudhir007]

Opened pull request #114

[RamiBerm]

Thanks @fandujar I started playing around with mizu few mins back. I don't have permission on ALL resources on the cluster but I am limited to a specific namespace. I was wondering what permission would it need to run mizu ?

I see below error even when I specify the namespace using -n option

$ ./mizu tap "shopping-cart-*" -A -n ksudhir007
Tapping pods in all namespaces
warning: could not ensure mizu rbac resources exist serviceaccounts "mizu-service-account" is forbidden: User "ksudhir007" cannot get resource "serviceaccounts" in API group "" in the namespace "default"
Error creating mizu tapper daemonset: daemonsets.apps "mizu-tapper-daemon-set" is forbidden: User "ksudhir007" cannot patch resource "daemonsets" in API group "apps" in the namespace "default"

Removing mizu resources
Error removing DaemonSet mizu-tapper-daemon-set in namespace default: daemonsets.apps "mizu-tapper-daemon-set" is forbidden: User "ksudhir007" cannot list resource "daemonsets" in API group "apps" in the namespace "default" (daemonsets.apps "mizu-tapper-daemon-set" is forbidden: User "ksudhir007" cannot list resource "daemonsets" in API group "apps" in the namespace "default",daemonsets.apps "mizu-tapper-daemon-set" is forbidden: User "ksudhir007" cannot list resource "daemonsets" in API group "apps" in the namespace "default")

Happy to update the documentation once I find the answer.

The minimum permissions needed are (currently for the default namespace, will be configurable later on):

- apiGroups:
  - ""
  - apps
  resources:
  - pods
  - services
  verbs:
  - list
  - get
  - create
  - delete
- apiGroups:
  - ""
  - apps
  resources:
  - daemonsets
  verbs:
  - list
  - get
  - create
  - patch
  - delete

You won't be able to run mizu at all without these resources.

For traffic ip to k8s service name resolving to work you'll need these optional permissions:

- apiGroups:
  - ""
  - apps
  - "rbac.authorization.k8s.io"
  resources:
  - clusterroles
  - clusterrolebindings
  - serviceaccounts
  verbs:
  - get
  - create
  - delete

This will allow mizu to create the necessary rbac resources that give mizu permissions to watch the cluster's pods, services and endpoints in order to resolve traffic ips.

[ksudhir007]

Thanks @RamiBerm - this issue can be closed - both pull requests are merged.