f38980ea94
* deps: bump indirect deps to clear critical/high Dependabot alerts Bumps the vulnerable indirect dependencies flagged as critical or high severity in Dependabot: - golang.org/x/crypto v0.39.0 -> v0.54.0 (7 critical + 2 high: SSH agent constraint/key-constraint bypass, @revoked auth bypass, FIDO/U2F presence check bypass, VerifiedPublicKeyCallback permission skip, infinite loop on large channel writes, client-induced server deadlock, RSA/DSA DoS, byte arithmetic underflow panic) - google.golang.org/grpc v1.68.1 -> v1.83.0 (critical: authz bypass via missing leading slash in :path; high: xDS RBAC and HTTP/2 issues) - github.com/containerd/containerd v1.7.27 -> v1.7.34 (high: LABEL -> restart-monitor binary:// host-root RCE, runAsNonRoot evasion, local privesc via wide CRI directory permissions) - oras.land/oras-go/v2 v2.6.0 -> v2.6.2 (high: CVE-2026-50163 hardlink extract-dir escape, credential forwarding via unvalidated Location header) - github.com/moby/spdystream v0.5.0 -> v0.5.1 (high: DoS on CRI) Transitively pulls up x/net, x/sync, x/sys, x/term, x/text, x/time, x/oauth2, protobuf, filepath-securejoin, selinux and go-logr via go mod tidy. The go directive moves 1.24.0 -> 1.25.0 (required by the upgraded modules); the explicit toolchain pin is dropped. CI resolves Go from go.mod, so no workflow changes are needed. go build ./... and go test ./... pass. * ci: move golangci-lint to v2, fix resulting lint issues golangci-lint-action@v3 pins `latest` to v1.64.8, which is built with go1.24 and refuses to run now that go.mod targets 1.25.0: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.0) Move the job to golangci-lint-action@v7 + v2.8.0 and add a .golangci.yml mirroring the hub repo's v2 config: govet, staticcheck, ineffassign and unused, plus gofmt/goimports as formatters. Fixes for the issues that surfaced: - ST1005: lowercase error strings, drop trailing '!' in connect/hub.go - SA4011: kubernetes/watch.go had a `break` inside a `select` default that broke the select rather than the loop, i.e. a no-op; removed - QF1008: drop the embedded ChartPathOptions selector in helm.go - QF1003: tagged switch on r.URL.Path in mcp_test.go - QF1004: strings.Replace(..., -1) -> strings.ReplaceAll - gofmt -s and goimports with a local prefix across the tree errcheck is not in the enabled set, matching hub. * cmd: clarify --time parse error in pcap dump The error neither named the offending flag/value nor separated the wrapped error from the message. Reported by Copilot on #1952. --------- Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
Network Observability for SREs & AI Agents
Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics.
What you can do:
- Download Retrospective PCAPs — cluster-wide packet captures filtered by nodes, time, workloads, and IPs. Store PCAPs for long-term retention and later investigation.
- Visualize Network Data — explore traffic matching queries with API, Kubernetes, or network semantics through a real-time dashboard.
- See Encrypted Traffic in Plain Text — automatically decrypt TLS/mTLS traffic using eBPF, with no key management or sidecars required.
- Integrate with AI — connect your favorite AI assistant (e.g. Claude, Copilot) to include network data in AI-driven workflows like incident response and root cause analysis.
Get Started
helm repo add kubeshark https://helm.kubeshark.com
helm install kubeshark kubeshark/kubeshark
kubectl port-forward svc/kubeshark-front 8899:80
Open http://localhost:8899 in your browser. You're capturing traffic.
For production use, we recommend using an ingress controller instead of port-forward.
Connect an AI agent via MCP:
brew install kubeshark
claude mcp add kubeshark -- kubeshark mcp
Network Data for AI Agents
Kubeshark exposes cluster-wide network data via MCP — enabling AI agents to query traffic, investigate API calls, and perform root cause analysis through natural language.
"Why did checkout fail at 2:15 PM?" "Which services have error rates above 1%?" "Show TCP retransmission rates across all node-to-node paths" "Trace request abc123 through all services"
Works with Claude Code, Cursor, and any MCP-compatible AI.
AI Skills
Open-source, reusable skills that teach AI agents domain-specific workflows on top of Kubeshark's MCP tools:
| Skill | Description |
|---|---|
| Network RCA | Retrospective root cause analysis — snapshots, dissection, PCAP extraction, trend comparison |
| KFL | KFL (Kubeshark Filter Language) expert — writes, debugs, and optimizes traffic filters |
Install as a Claude Code plugin:
/plugin marketplace add kubeshark/kubeshark
/plugin install kubeshark
Or clone and use directly — skills trigger automatically based on conversation context.
Query with API, Kubernetes, and Network Semantics
Kubeshark indexes cluster-wide network traffic by parsing it according to protocol specifications, with support for HTTP, gRPC, Redis, Kafka, DNS, and more. A single KFL query can combine all three semantic layers — Kubernetes identity, API context, and network attributes — to pinpoint exactly the traffic you need. No code instrumentation required.
KFL reference → · Traffic indexing →
Workload Dependency Map
A visual map of how workloads communicate, showing dependencies, traffic volume, and protocol usage across the cluster.
Traffic Retention & PCAP Export
Capture and retain raw network traffic cluster-wide, including decrypted TLS. Download PCAPs scoped by time range, nodes, workloads, and IPs — ready for Wireshark or any PCAP-compatible tool. Store snapshots in cloud storage (S3, Azure Blob, GCS) for long-term retention and cross-cluster sharing.
Snapshots guide → · Cloud storage →
Features
| Feature | Description |
|---|---|
| Traffic Snapshots | Point-in-time snapshots with cloud storage (S3, Azure Blob, GCS), PCAP export for Wireshark |
| Traffic Indexing | Real-time and delayed L7 indexing with request/response matching and full payloads |
| Protocol Support | HTTP, gRPC, GraphQL, Redis, Kafka, DNS, and more |
| TLS Decryption | eBPF-based decryption without key management, included in snapshots |
| AI Integration | MCP server + open-source AI skills for network RCA and traffic filtering |
| KFL Query Language | CEL-based query language with Kubernetes, API, and network semantics |
| 100% On-Premises | Air-gapped support, no external dependencies |
Install
| Method | Command |
|---|---|
| Helm | helm repo add kubeshark https://helm.kubeshark.com && helm install kubeshark kubeshark/kubeshark |
| Homebrew | brew install kubeshark && kubeshark tap |
| Binary | Download |
Contributing
We welcome contributions. See CONTRIBUTING.md.