k8spacket is a Kubernetes observability tool written in Go that captures TCP traffic and TLS connection metadata from within a cluster using eBPF technology and visualizes the collected data through Grafana dashboards. The project enables operators to understand network behavior, identify traffic patterns, and monitor security-related connection details across their Kubernetes infrastructure.
The core functionality revolves around packet sniffing and traffic analysis at the kernel level. Version 2.0.0 represents a significant architectural shift, moving away from the gopacket library to become fully eBPF-based. The implementation leverages the inet_sock_set_state tracepoint to capture TCP connection information and uses traffic control with queueing discipline filters on both ingress and egress paths to collect TLS handshake process details. This approach requires a minimum kernel version of 5.4 with BTF enabled, making it compatible with modern Linux distributions commonly used in Kubernetes deployments.
The visualization capabilities center on Grafana integration, with multiple specialized dashboards providing different perspectives on cluster traffic. The primary k8spacket node graph dashboard displays traffic flows between workloads, shows where traffic routes outside the cluster, and visualizes the complete network of connections across the entire cluster. Users can filter this graph by connection type, bytes transferred, or connection duration. Additional filtering options allow operators to narrow views by namespace or include/exclude specific workload names. The dashboards respond to Grafana's time range controls, enabling focused analysis of traffic patterns over specific time windows such as the last five minutes.
TLS monitoring represents a significant feature set within k8spacket. The tool captures TLS version information, cipher suite details, and server certificate chain data for connections both within and outside the cluster. Version 1.1.0 added the ability to extract server certificate chain information for TLS versions below 1.3. A dedicated TLS metrics dashboard displays this information alongside connection details including TLS client IP and name, TLS server domain, IP, and port, and the supported and negotiated TLS versions and cipher suites. Version 2.0.0 introduced a specialized dashboard for TLS certificate expiration tracking, which shows remaining time until certificates expire and allows operators to adjust the analysis interval. This feature enables straightforward alert configuration based on certificate expiration dates.
The project uses a plugin architecture to extend functionality, with available plugins maintained in a separate repository. Metrics collection integrates with Prometheus for scraping, and the visualization layer depends on Grafana plugins including Node Graph API datasource and JSON API datasource for rendering the network topology and connection data.
The repository shares contributors with istio/istio, jetbrains/compose-multiplatform, and langgenius/dify, indicating connections to broader cloud-native and infrastructure projects.
Installation occurs through a Helm chart, with operators configuring Grafana datasources and adding dashboard configmaps to their monitoring stacks. The tool addresses observability, security monitoring, performance analysis, and traffic troubleshooting use cases within Kubernetes environments.
