Local
The qtap-config.yaml
file is used to configure Qtap, an eBPF probe that captures application traffic before encryption without requiring certificate management. This file defines global settings and specific endpoint capture rules.
Configuration File Structure
The qtap-config.yaml
file consists of three main sections:
Global Qtap Settings
Protocol Specific Settings
Endpoint-specific Capture Rules
Here's an example of the basic structure:
Global Settings
These settings apply across the entire Qtap configuration.
direction
: Determines which traffic direction to capture. Options are:all
: Capture all trafficingress
: Capture only incoming trafficegress
: Capture only outgoing trafficegress-external
: Capture only outgoing traffic to external networksegress-internal
: Capture only outgoing traffic within internal networks
audit_logs
: Specifies where to publish audit logs. Options are:stdout
: Print to standard outputpulse
: Send to a pulse service (if configured)none
: Disable audit logging
audit_include_dns
: When set totrue
, includes DNS information in audit logs. Whenfalse
, DNS information is excluded.ignore_loopback
: When set totrue
, ignores traffic on the loopback interface. Whenfalse
, captures loopback traffic.
HTTP Data Stream Settings
These settings control how HTTP data streams are handled globally.
stack
: Specifies the default middleware stack to use for HTTP traffic. Usenone
for no middleware.
Endpoint-specific Capture Rules
Controls specific settings for individual domains, overriding the global and protocol settings.
domain
: The specific domain to which the rule applieshttp
: HTTP-specific settings for this domainstack
: Overrides the globalstack
setting for this domain
Complete Configuration Example
Here's a complete example of a qtap-config.yaml
file:
In this configuration:
Only outgoing traffic to external networks is captured
Audit logs are sent to stdout
DNS information is not included in audit logs
Loopback traffic is not ignored
No middleware stack is used by default
Traffic to
api.github.com
uses the 'complete' middleware stack
Last updated