- Home
- eBPF Observability Tools
- Kubeshark
Kubeshark
What it is
Kubeshark is a Kubernetes network observability tool that indexes cluster-wide traffic at the kernel level with eBPF and makes it searchable using Kubernetes, API, and network context. Its KFL query language filters traffic across those attributes, while an identity-aware service map and performance KPIs cover pods, services, nodes, and namespaces. It can decrypt TLS and service-mesh mTLS traffic without keys, certificates, sidecars, or application changes. Users can capture retrospective traffic snapshots, filter by time, nodes, workloads, and IPs, then export them as PCAP files. Kubeshark supports more than 23 protocols, including HTTP, Kafka, Redis, PostgreSQL, gRPC, and DNS. It can also expose cluster network data through MCP to compatible AI assistants such as Claude Code, Cursor, and GitHub Copilot. Deployment uses Helm in Kubernetes; self-hosted air-gapped operation is available on Enterprise. Community is free for up to 3 nodes or 60 pods and requires internet connectivity. Paid plans start at $30/mo.
For and against
For
- Indexes cluster traffic using eBPF.
- Decrypts TLS and service-mesh mTLS without keys.
- Exports filtered retrospective snapshots as PCAP files.
- Exposes network data to MCP-compatible AI clients.
- Supports more than 23 protocols.
Against
- Community is limited to 3 nodes or 60 pods.
- Community requires internet connectivity.
- Paid plans start at $30/mo.
The verdict
Kubeshark brings Kubernetes context, protocol visibility, TLS decryption, and retrospective PCAP capture into one network observability tool. The free Community tier has node and pod limits, while paid plans start at $30/mo.
Who it suits
Kubeshark is aimed at SREs, network engineers, AI assistants, and agents working on root-cause analysis, incident response, and network reliability. It may suit teams that want Kubernetes-aware traffic queries, snapshots, or service maps.
Plans and prices
Community
Up to 3 nodes or 60 pods · Internet connectivity required · Unlimited API calls · Community support
Read 15 Oct 2026 · kubeshark.com
Enterprise
Unlimited cluster size · Air-gapped clusters · Unlimited consumption · Dedicated support
Read 15 Oct 2026 · kubeshark.com
Micro
6 nodes / 120 pods · Unlimited capacity · Dev/test clusters · Unlimited API calls
Read 15 Oct 2026 · kubeshark.com
Pro
Unlimited environment size · Internet connectivity required · Limited API-call capacity · Community support
Read 15 Oct 2026 · kubeshark.com
Dynamic
Unlimited nodes and pods · Unlimited clusters · 100K daily API calls · $50 per extra 100K calls
Read 15 Oct 2026 · kubeshark.com
Small
20 nodes / 400 pods · Unlimited capacity · Small production clusters · Unlimited API calls
Read 15 Oct 2026 · kubeshark.com
On the record
- AI integration
- An MCP server lets compatible AI clients query traffic, inspect API calls, export PCAPs, create snapshots, and apply filters.docs.kubeshark.com · read 15 Oct 2026
- Air-gapped deployment
- Air-gapped clusters are supported in the Enterprise tier.kubeshark.com · read 15 Oct 2026
- cloud storage
- Kubeshark supports storing traffic snapshots in Amazon S3, Azure Blob, and Google Cloud Storage for long-term retention and cross-cluster sharing.github.com · read 1 Oct 2026
- Company legal name
- The vendor site copyright notice identifies the company as Kubeshark, Inc.kubeshark.com · read 15 Oct 2026
- Company profile
- LinkedIn lists Kubeshark as a privately held computer and network security company founded in 2023, headquartered in San Francisco, with 2-10 employees.linkedin.com · read 15 Oct 2026
- compliance
- Kubeshark's About page displays a SOC 2 compliance confirmation.kubeshark.com · read 1 Oct 2026
- deployment
- Kubeshark can be deployed with Helm in Kubernetes and supports self-hosted air-gapped operation on the Enterprise tier.github.com · read 1 Oct 2026
- Documentation depth
- The documentation covers installation, protocol dissection, TLS inspection, dashboard views, KFL, Helm configuration, SAML, OIDC, roles, AI workflows, performance, troubleshooting, and OpenShift or Istio topics.docs.kubeshark.com · read 15 Oct 2026
- Funding
- The company About page shows funding logos for Zeev Ventures and Engineering Capital.kubeshark.com · read 15 Oct 2026
- GitHub activity
- The public repository page showed about 10.7K stars, 550 forks, and more than 139 issues when opened.github.com · read 15 Oct 2026
- Homebrew availability
- Homebrew distributes Kubeshark as an API traffic analyzer and lists macOS Apple Silicon, macOS Intel, and Linux ARM64 or x86_64 bottles.formulae.brew.sh · read 15 Oct 2026
- Installation methods
- Official installation options include Helm, Homebrew, kubectl manifests, prebuilt CLI binaries, and building from source.docs.kubeshark.com · read 15 Oct 2026
- KFL filtering
- Kubeshark provides a Kubernetes-aware filter language called KFL for capture and display queries.docs.kubeshark.com · read 15 Oct 2026
- Kubernetes context
- Traffic records include workload identity, service relationships, namespace scope, and node distribution.docs.kubeshark.com · read 15 Oct 2026
- License
- The public repository and Homebrew formula identify Kubeshark as Apache License 2.0 software.formulae.brew.sh · read 15 Oct 2026
- Limit: free-tier size
- The free Community tier is limited to three nodes or 60 pods.kubeshark.com · read 15 Oct 2026
- Limit: internet dependency
- Community and Pro plans require internet connectivity, so they do not provide the air-gapped option reserved for Enterprise.kubeshark.com · read 15 Oct 2026
- Limit: open bugs
- The public issue tracker listed open reports for a broken CLI console command, hub startup failures, snapshot PVC deadlocks, and MCP download or query problems.github.com · read 15 Oct 2026
