Kubeshark is an eBPF-powered network observability platform designed for Kubernetes environments that captures and indexes cluster-wide traffic at the kernel level. Written in Go, it provides SREs and AI agents with real-time visibility into network communications, API interactions, and encrypted traffic without requiring key management or code instrumentation. The platform operates at both Layer 4 and Layer 7, parsing protocols including HTTP, gRPC, GraphQL, Redis, Kafka, and DNS to deliver contextual network data tied directly to Kubernetes workload identity.
The core technical capability centers on eBPF-based packet capture that automatically decrypts TLS and mTLS traffic without sidecars or manual key handling. Users can query this traffic using KFL, a CEL-based query language that combines Kubernetes semantics, API context, and network attributes in a single search. The dashboard provides real-time visualization of network flows, while the workload dependency map displays how services communicate across the cluster, including traffic volume and protocol usage. Traffic snapshots enable point-in-time PCAP downloads scoped by time range, nodes, workloads, and IP addresses, with support for long-term retention in cloud storage including S3, Azure Blob, and Google Cloud Storage.
A distinctive feature is Kubeshark's integration with AI agents through the Model Context Protocol (MCP). This allows AI assistants like Claude and Cursor to query network data and perform root cause analysis through natural language, answering questions such as why a service failed at a specific time or which services exceed error rate thresholds. The project includes open-source AI skills for network RCA and KFL expertise that teach AI agents domain-specific workflows. The platform operates entirely on-premises with air-gapped support and no external dependencies.
The project maintains connections with related Kubernetes ecosystem repositories including kubernetes/website, googlecloudplatform/terraformer, and argoproj/argo-cd through overlapping contributor networks.
Installation is available through multiple channels including Helm, Homebrew, and direct binary download. The platform is licensed under Apache-2.0 and welcomes community contributions. The project maintains active community channels including Discord and Slack, with a live demo available at demo.kubeshark.com and comprehensive documentation at docs.kubeshark.com.
