Kubeshark

Kubeshark is a self-hosted Kubernetes network observability tool for teams that need traffic context across workloads, not just isolated packet captures. It is best suited to SREs and network engineers investigating incidents or reliability issues in Kubernetes clusters. Its standout combination of eBPF-based visibility, TLS inspection, and retrospective PCAP capture comes with meaningful cluster and connectivity limits on the free tier.

Overview

Kubeshark indexes cluster-wide Kubernetes traffic at the kernel level with eBPF, then makes it queryable using Kubernetes identity, API context, and network attributes. That framing is useful when an investigation needs to connect a request or flow to the workload and cluster context around it, rather than sift through raw traffic alone.

It also exposes network data to MCP-compatible AI assistants, including Claude Code, Cursor, and GitHub Copilot. That gives teams a way to bring cluster traffic context into AI-assisted workflows, although the tool remains a Kubernetes-focused observability product rather than a general-purpose network monitor.

Key features

Traffic analysis and capture

Kubeshark supports more than 23 protocols, spanning HTTP, HTTP/2, WebSocket, GraphQL, Kafka, AMQP, Redis, MongoDB, MySQL, PostgreSQL, gRPC, DNS, and lower-level protocols such as TCP, UDP, and SCTP. KFL combines Kubernetes identity, API context, and network attributes for filtering; that can make queries more operationally meaningful than filters based on addresses or ports alone.

Retrospective snapshots can be filtered by time, nodes, workloads, and IPs, then exported as PCAP files. This is a strong incident-response feature: teams can inspect a relevant traffic window without treating packet capture as a purely forward-looking activity. TLS and service-mesh mTLS decryption without keys, certificates, sidecars, or application changes further reduces the setup burden, while sensitive-data redaction and authorization rules matter for teams handling traffic that may contain private information.

Cluster context and operations

An identity-aware service map and performance KPIs cover pods, services, nodes, and namespaces, helping teams relate traffic to cluster components. Snapshots can be stored in Amazon S3, Azure Blob, or Google Cloud Storage for longer retention and sharing across clusters. Kubeshark deploys with Helm and supports self-hosted air-gapped use on Enterprise, a useful distinction for environments that cannot connect to the internet.

Security capabilities include encrypted browser communication, ingress TLS, and SAML authentication for self-hosted deployments; its About page displays a SOC 2 compliance confirmation. Support is usually through a dedicated Slack channel, while Enterprise adds dedicated Slack support, on-demand Zoom calls, and premium onboarding.

Pricing

Kubeshark is freemium, with plans billed monthly where stated. Community costs nothing and covers up to 3 nodes or 60 pods, unlimited API call capacity, and community support, but requires internet connectivity. It is a sensible evaluation option for small clusters, not for larger deployments or air-gapped environments.

Pro starts at $30 a month, billed per month, with unlimited nodes and pods but limited API call capacity; it still requires internet connectivity and includes community support. Micro also costs $30 a month, billed per month, and covers 6 nodes or 120 pods, unlimited capacity and API calls, and unlimited clusters. Its stated dev/test focus makes it a better fit than Pro for bounded development clusters, while Pro’s node and pod allowance suits teams needing broader cluster coverage and able to work within limited API capacity.

Dynamic costs $190 a month, billed per month, for unlimited nodes and pods, limited capacity, unlimited clusters, and 100K daily API calls; each extra 100K calls costs $50. Small is $360 a month, billed per month, and covers 20 nodes or 400 pods with unlimited capacity, unlimited API calls, and unlimited clusters, aimed at small production clusters. Enterprise uses custom pricing, billed per pod per month, and offers unlimited cluster size and consumption, unlimited API call capacity, air-gapped clusters, and dedicated support. The choice therefore hinges not just on cluster size but also on API-call and capacity limits, internet requirements, and support needs.

Platforms

Kubeshark is self-hosted and supports Kubernetes. Its listed platforms are API, Linux, macOS, web, and Windows; supported operating systems are Linux, macOS, and Windows.

Who it's for

Kubeshark is a strong fit for SREs and network engineers who need cluster-wide traffic context for root-cause analysis, incident response, or network reliability work. Its Kubernetes-aware queries, service map, and snapshots are most valuable when teams need to move from a flow to the workload behind it. MCP exposure also makes it relevant to teams incorporating AI assistants or agents into that work.

It is less suitable for a small cluster that cannot maintain internet connectivity on Community, or for production teams whose API-call and capacity needs exceed the lower paid tiers. Air-gapped teams need Enterprise.

Pros and cons

• Pros: Cluster-wide eBPF indexing joins network traffic to Kubernetes and API context, which helps investigations stay tied to workloads.
• Pros: TLS and service-mesh mTLS decryption without keys, certificates, sidecars, or application changes avoids several common deployment dependencies.
• Pros: Retrospective snapshots and PCAP export support incident review, while cloud storage options allow longer retention and cross-cluster sharing.
• Cons: Community is capped at 3 nodes or 60 pods and requires internet connectivity, ruling it out for larger or disconnected deployments.
• Cons: Pro and Dynamic have limited API call capacity or limited capacity, so their unlimited cluster-size wording does not mean unlimited use.
• Cons: Air-gapped operation and dedicated support require custom-priced Enterprise, placing those needs outside the published monthly tiers.

Alternatives

• DeepFlow is worth considering for an open-source Community Edition supporting Linux servers and selected Kubernetes, cloud, and container environments.
• Qpoint may fit teams focused on endpoint discovery and monitoring, attribution, and policy plugins, with its Community plan capped at 25 endpoints.
• Coroot offers a self-hosted Apache 2.0 Community Edition with core features, for readers prioritizing that open-source model.
• Inspektor Gadget is a free open-source tools and framework option for Linux 5.10+ systems with BTF when project gadgets are the priority.
• Odigos may suit teams seeking core OpenTelemetry tracing through its free, open-source Apache 2.0 plan.
• bpftrace is a free Linux tracing tool for readers comfortable with a compatible Linux kernel and BPF support.
• Grafana k6 is an alternative for performance testing, with its Free plan limited to 500 virtual user hours per month.
• groundcover is another freemium option, with a Free plan offering 12-hour data retention, Slack Community, and BYOC.
• For more options in this category, see eBPF Observability Tools.

Verdict

Choose Kubeshark if your team needs Kubernetes-wide traffic inspection that connects flows to workloads, supports TLS and mTLS analysis, and can preserve useful incident snapshots. Its free tier provides a bounded way to start, but the internet requirement, cluster caps, and paid-plan capacity limits deserve close attention. Look elsewhere if you need air-gapped use without Enterprise pricing or a tool focused on a different observability or testing workflow.