orb8
orb8 is a free, self-hosted toolkit for observing Kubernetes network traffic, with a stated focus on AI/ML clusters.
What orb8 is
orb8 is a free, self-hosted toolkit for observing Kubernetes network traffic, with a stated focus on AI/ML clusters. Its eBPF probes capture IPv4 TCP, UDP, and ICMP flows on ingress and egress, then use the Kubernetes API to associate packet addresses with pod names. The CLI reports agent status, queries aggregated flows, streams network events, and supports namespace and pod filters. A gRPC API exposes QueryFlows, StreamEvents, and GetStatus operations. Deployment uses a Kubernetes DaemonSet with a ServiceAccount and ClusterRole for pod listing and watching. orb8 requires Linux kernel 5.8 or later with BTF enabled. The project says it captures flows without application changes, a sidecar, or a kernel module, and describes its DaemonSet as non-privileged while using specified Linux capabilities. The current implementation is identified as v0.0.6. Documented limits include IPv4-only capture, potentially invisible same-node traffic in some probe setups, and no cluster-wide query aggregation. The roadmap lists additional monitoring and dashboard capabilities.
Good
- Captures TCP, UDP, and ICMP flows
- Maps packet addresses to Kubernetes pods
- Provides CLI and gRPC APIs
- Deploys as a Kubernetes DaemonSet
- Requires no application changes
Watch out
- IPv4 capture only
- Same-node traffic can be invisible
- No cluster-wide aggregation yet
- Requires Linux kernel 5.8+ with BTF
Who it suits
It suits Kubernetes operators who want free, self-hosted network visibility on Linux, especially for AI/ML clusters. Users must be able to deploy a DaemonSet and meet the kernel requirements.
Verdict
orb8 provides focused Kubernetes flow visibility through eBPF, pod mapping, CLI tools, and a gRPC API. Its self-hosted Linux requirements and documented coverage gaps define where it fits.
The facts
Each one read from orb8's own pages, with the date it was checked.
What it does
- API
- The agent exposes a gRPC API with QueryFlows, StreamEvents, and GetStatus operations.checked 8 Oct 2026
- CLI and API
- The CLI can check agent status, query aggregated flows, and stream network events; the gRPC API provides QueryFlows, StreamEvents, and GetStatus.checked 7 Oct 2026
- Current maturity
- The README identifies v0.0.6 as the current implementation and lists network capture, pod enrichment, a gRPC API, CLI commands, and DaemonSet deployment as working.checked 7 Oct 2026
- Deployment
- The agent is deployed as a Kubernetes DaemonSet and requires Linux kernel 5.8 or later with BTF enabled.checked 7 Oct 2026
- Installation
- The project documents installation through Cargo or from source, plus deployment with a Kubernetes manifest.checked 8 Oct 2026
- Known coverage limits
- Documented limitations include IPv4-only capture, invisible same-node pod traffic in some probe configurations, and no cluster-wide aggregation yet.checked 7 Oct 2026
- Kubernetes deployment
- The agent can be deployed as a Kubernetes DaemonSet, with a ServiceAccount and ClusterRole for pod list and watch access.checked 8 Oct 2026
- License
- The repository is licensed under Apache License 2.0.checked 8 Oct 2026
- Limits
- Documented limitations include IPv4-only capture, invisible same-node pod traffic when probes attach only to eth0, and no cluster-wide query aggregation yet.checked 8 Oct 2026
- Live features
- The current release documents aggregated flow queries, real-time event streaming, agent status, and a CLI with namespace and pod filters.checked 8 Oct 2026
- Packet capture
- Its eBPF probes capture IPv4 network flows for TCP, UDP, and ICMP traffic on ingress and egress.checked 7 Oct 2026
- Packet visibility
- It captures IPv4 TCP, UDP, and ICMP network flows and maps packet IPs to Kubernetes pods.checked 8 Oct 2026
- Purpose
- orb8 is an eBPF-powered toolkit for Kubernetes network observability, designed for AI/ML clusters.checked 8 Oct 2026
- Requirements
- The agent requires Linux kernel 5.8 or later with BTF enabled.checked 8 Oct 2026
- Security
- The documented DaemonSet uses specific Linux capabilities and is described as not running in privileged mode.checked 8 Oct 2026
- Security model
- The DaemonSet uses specified Linux capabilities and is described as not running in a privileged container.checked 7 Oct 2026
The company
- Maker
- The GitHub profile for Ignoramuss identifies the account holder as Mayank.checked 8 Oct 2026
Where it runs
- No application changes
- The project says it captures cluster network flows without application changes, a sidecar, or a kernel module.checked 7 Oct 2026
- Pod mapping
- It maps packet IP addresses to Kubernetes pod names through the Kubernetes API.checked 7 Oct 2026
Money
- Planned capabilities
- GPU telemetry, syscall monitoring, Prometheus metrics, and cluster-wide queries are listed as roadmap items.checked 8 Oct 2026
Alternatives to orb8
- 1
Coroot
Free planOpen sourceWebAPILinuxSelf-hosted8.2From $1 a month - 2
Kubeshark
Free planOpen sourceWebAPILinuxmacOS8.1From $0.40 a month - 3
Metoro Kubernetes Profiling
Free planWebAPILinuxSelf-hosted7.5From $20 a month - 4
groundcover
Free planWebLinuxSelf-hosted7.1From $30 a month - 5
DeepFlow
Free planAndroidWebAPILinux6.7Free plan - 6
Pyroscope
Free planWebLinuxmacOSWindows6.7From $19 a month