Retina
Retina is a free, open-source, self-hosted platform for observing network activity in Kubernetes.
What Retina is
Retina is a free, open-source, self-hosted platform for observing network activity in Kubernetes. It uses eBPF plugins to gather telemetry from workloads and attach Kubernetes context. Prometheus metrics cover traffic, dropped packets, DNS, API server latency, and other network signals. Retina can also perform distributed packet captures across nodes running selected pods and upload capture results to storage. It supports Hubble as a control plane and documents connections with Prometheus, Grafana, Azure Monitor, and Azure Log Analytics. The project describes support for cloud and on-premises Kubernetes distributions, multiple CNIs including Azure CNI and AWS VPC, and Linux and Windows environments. Installation uses Helm in an existing cluster, requiring Helm 3.8.0 or later and Linux kernel 5.4.0 as the minimum documented kernel. The CLI runs on Linux, Windows, and macOS for x86_64 and ARM64. Retina is aimed at cluster network and security administrators and DevOps engineers. It uses the MIT License.
Good
- Free and open-source under the MIT License
- eBPF telemetry includes Kubernetes context
- Prometheus metrics cover multiple network signals
- Distributed packet captures can target selected pods
- Supports cloud and on-premises Kubernetes distributions
Watch out
- Requires an existing Kubernetes cluster
- Capture CRD needs Standard control plane and operator
- Performance concerns under sustained high-volume load
- Windows Server 2019 nodes are no longer supported
Who it suits
Retina suits cluster network administrators, security administrators, and DevOps engineers working with Kubernetes visibility, DevOps, SecOps, or compliance tasks. It requires an existing Kubernetes cluster and Helm installation.
Verdict
Retina combines Kubernetes network telemetry, metrics, and packet capture in a self-hosted deployment. Check its capture requirements and documented performance considerations before enabling advanced packetparser metrics on heavily loaded systems.
The facts
Each one read from Retina's own pages, with the date it was checked.
What it does
- Capture limitation
- The Capture CRD requires the Standard control plane and a running Retina operator, while captures can also be triggered with the CLI without the operator.checked 9 Oct 2001
- Cloud and CNI support
- The project says it works with cloud or on-premises Kubernetes distributions and multiple CNIs, including Azure CNI and AWS VPC.checked 9 Oct 2001
- Data collection
- It uses eBPF plugins to collect and enrich network telemetry with Kubernetes context.checked 9 Oct 2001
- Deployment
- Retina is installed into an existing Kubernetes cluster using Helm.checked 9 Oct 2001
- eBPF
- Retina uses eBPF to collect network telemetry from Kubernetes workloads.checked 9 Oct 2001
- Integrations
- Retina integrates with Cilium Hubble for additional network insights, including flow logs and DNS information.checked 9 Oct 2001
- Intended users
- Retina is aimed at cluster network administrators, cluster security administrators, and DevOps engineers working on DevOps, SecOps, and compliance use cases.checked 9 Oct 2001
- License
- The repository uses the MIT License, which grants permission to use, copy, modify, distribute, sublicense, and sell copies of the software subject to its terms.checked 9 Oct 2001
- Metrics
- It provides Prometheus metrics for traffic, dropped packets, DNS, and API server latency, among other network signals.checked 9 Oct 2001
- Metrics destinations
- Retina telemetry can be exported to Prometheus and Azure Monitor and visualized with tools such as Grafana and Azure Log Analytics.checked 9 Oct 2001
- Notable limitation
- The project reports performance considerations for Advanced metrics with the packetparser plugin on nodes with 32 or more CPU cores under high network load.checked 9 Oct 2001
- Packet capture
- Retina can run distributed packet captures across nodes hosting selected pods and upload the results to storage.checked 9 Oct 2001
- Packet captures
- It supports distributed packet captures initiated through its CLI or a Kubernetes Capture resource.checked 9 Oct 2001
- Performance limitation
- The documentation reports community concerns about performance on systems with 32 or more CPU cores under sustained, high-volume network load when using Advanced metrics with packetparser.checked 9 Oct 2001
- Product
- Retina is an open-source Kubernetes network observability platform for monitoring application health, network health, and security.checked 9 Oct 2001
- Requirements
- Installation requires an existing Kubernetes cluster and Helm version 3.8.0 or later; Retina documents Linux kernel 5.4.0 as its minimum.checked 9 Oct 2001
- Security
- The project states that Retina images published to GHCR are cryptographically signed and provides cosign verification instructions.checked 9 Oct 2001
- Support
- The project lists [email protected] as a contact address and publishes community office hours every Friday at 11:30 AM PST.checked 9 Oct 2001
- Supported environments
- The project says it works with cloud or on-premises Kubernetes distributions and multiple operating systems, including Linux and Windows.checked 9 Oct 2001
Where it runs
- CLI platforms
- The Retina CLI supports Linux, Windows, and macOS on x86_64 and ARM64.checked 9 Oct 2001
- Windows limitation
- Retina no longer supports Windows Server 2019 nodes; the project directs users to Windows Server 2022 for Windows workloads.checked 9 Oct 2001
Alternatives to Retina
- 1
Kubeshark
Free planOpen sourceWebAPILinuxmacOS8.1From $0.40 a month - 2
Metoro Kubernetes Profiling
Free planWebAPILinuxSelf-hosted7.5From $20 a month - 3
Coroot
Free planWebAPILinuxSelf-hosted7.1From $1 a month - 4
groundcover
Free planWebLinuxSelf-hosted7.1From $30 a month - 5
Elastic Observability
WebAPILinuxmacOS6.9 - 6
DeepFlow
Free planAndroidWebAPILinux6.7Free plan