Kubeshark

Kubeshark is a self-hosted network observability tool for Kubernetes clusters, aimed at SREs and network engineers investigating traffic and reliability issues. It suits teams that need workload-aware traffic analysis; teams seeking general-purpose network monitoring should look elsewhere.

Overview

Kubeshark indexes cluster-wide network traffic at the kernel level with eBPF and makes it queryable using Kubernetes, API, and network context. That combination can connect a flow to the workloads and services involved, making it more useful for tracing cluster incidents than packet data without that context.

It also exposes cluster network data through MCP to AI assistants including Claude Code, Cursor, and GitHub Copilot. This is a practical route to bring traffic context into AI-assisted investigations, while the product remains focused on Kubernetes rather than broader network monitoring.

Key features

Traffic queries, protocols, and capture

KFL combines Kubernetes identity, API context, and network attributes for filtering. Kubeshark supports more than 23 protocols, including HTTP, HTTP/2, WebSocket, GraphQL, Kafka, AMQP, Redis, MongoDB, MySQL, PostgreSQL, gRPC, DNS, ICMP, TCP, UDP, SCTP, LDAP, RADIUS, DIAMETER, and TLS. The breadth is useful for mixed application and infrastructure traffic; teams that need a tool outside Kubernetes will not get the same focused context.

Retrospective snapshots can be filtered by time, nodes, workloads, and IPs, then exported as PCAP files. This is valuable when an incident is recognized after traffic has passed, though snapshot workflows are not a substitute for a general packet-analysis platform.

Visibility and security

Kubeshark decrypts TLS and service-mesh mTLS traffic with eBPF, without requiring keys, certificates, sidecars, or application changes. That lowers the operational burden of investigating encrypted traffic. Its identity-aware service map and performance KPIs cover pods, services, nodes, and namespaces, giving teams a useful cluster-level view alongside query-based analysis.

Documented security capabilities include sensitive-data redaction, authorization rules, encrypted browser communication, ingress TLS, and SAML authentication for self-hosted deployments. Its About page displays a SOC 2 compliance confirmation. Traffic snapshots can be stored in Amazon S3, Azure Blob, or Google Cloud Storage for long-term retention and cross-cluster sharing.

Pricing

Kubeshark is freemium, with monthly paid plans starting at $30/mo. Plans differ substantially in node and pod ceilings, API capacity, and connectivity requirements, so the lowest price is not a universal entry point.

Community — free: Covers up to 3 nodes or 60 pods, with unlimited API call capacity and community support. It requires internet connectivity, so it is a constrained way to evaluate or run smaller connected clusters, not an air-gapped option.

Pro — $30 a month: Starts at this price and allows unlimited nodes and pods, but API call capacity is limited. It requires internet connectivity and includes community support. This suits larger connected clusters where API usage is manageable.

Micro — $30 a month: Includes 6 nodes or 120 pods, unlimited capacity and API calls, and unlimited clusters. It is explicitly for dev/test clusters, offering predictable limits for non-production use.

Dynamic — $190 a month: Allows unlimited nodes and pods and unlimited clusters, with limited capacity and 100K daily API calls. Additional calls cost $50 per extra 100K calls. This fits teams needing broad cluster coverage with a defined daily API allowance.

Small — $360 a month: Covers 20 nodes or 400 pods, unlimited capacity and API calls, and unlimited clusters. Its stated focus is small production clusters.

Enterprise — custom pricing: Billed per pod per month, with unlimited cluster size and consumption, air-gapped clusters, unlimited API call capacity, and dedicated support. The air-gapped option is important for disconnected environments; the per-pod billing basis makes it a different cost model from the fixed monthly tiers.

Support is usually provided through a dedicated Slack channel. Enterprise adds dedicated Slack support, on-demand Zoom calls, and premium onboarding. Helm deployment in Kubernetes and self-hosted operation suit teams that want to run the product in their own environment; air-gapped operation is reserved for Enterprise.

Platforms

Kubeshark is self-hosted and deploys with Helm in Kubernetes. Listed platforms are API, Linux, macOS, web, and Windows. Its Kubernetes focus and cluster-wide capture are central to its value; the platform list should not be read as a claim of equivalent standalone monitoring on every operating system.

Who it's for

Kubeshark is a strong fit for SREs and network engineers who need to investigate Kubernetes traffic in context, inspect encrypted service traffic, or retrieve retrospective PCAP snapshots. MCP access may also suit teams bringing AI assistants into root-cause analysis. It is less suitable for teams that need broad non-Kubernetes monitoring, require an air-gapped deployment below Enterprise, or need unlimited API calls without accepting the node and pod limits of Micro or Small.

Pros and cons

Pros: eBPF-based, cluster-wide visibility paired with Kubernetes-aware queries connects network traffic to workload context.

Pros: TLS and mTLS decryption without keys, certificates, sidecars, or application changes reduces setup friction for encrypted-traffic investigations.

Pros: Retrospective snapshots can be filtered and exported as PCAP, supporting follow-up analysis after an incident is identified.

Cons: Community is capped at 3 nodes or 60 pods and requires internet connectivity, limiting its usefulness for larger or isolated clusters.

Cons: Paid tiers trade off capacity, API allowances, and cluster size differently; choosing by headline price alone can lead to a poor fit.

Cons: Air-gapped operation and the stronger support package are confined to Enterprise with custom pricing.

Alternatives

eBPF Observability Tools is a useful category starting point for comparing products built around eBPF.

DeepFlow is worth considering for a free, open-source edition supporting Linux servers and selected Kubernetes, cloud, and container environments.

Coroot offers a free, Apache 2.0 self-hosted Community Edition; consider it when that licensing and deployment combination is the priority.

Odigos is an alternative when free, open-source core OpenTelemetry tracing is a better match for the work.

Elastic Observability is another option for teams comparing a broader observability product; its listed Serverless Complete pricing is usage-based and not fully stated.

groundcover offers a free-forever BYOC plan with 12-hour data retention and Slack Community support, making it an option for a no-cost, short-retention starting point.

Qpoint has a free Community plan for up to 25 endpoints, with agent discovery and monitoring with attribution and policy plugins; consider it when endpoint-level coverage is the priority.

Metoro Kubernetes Profiling is an alternative for a one-cluster, one-user hobby setup with two nodes and 28-day retention.

Anteon is another option to compare for paid observability, with a Pro plan starting at $99 a month and usage-based ingestion charges.

Verdict

Choose Kubeshark if your team needs Kubernetes-aware traffic queries, encrypted-traffic visibility, and retrospective packet captures in one self-hosted tool. Its most distinctive strength is connecting cluster traffic to workload identity without requiring TLS keys or application changes. Look elsewhere if you need broad network monitoring beyond Kubernetes, a lower-cost air-gapped tier, or a simpler capacity model than its node, pod, and API limits provide.