Kubeshark

Kubeshark is a self-hosted Kubernetes network observability tool for teams that need to investigate traffic across workloads. It is best suited to SREs and network engineers working on cluster incidents and reliability. Its strongest case is the combination of Kubernetes-aware queries, TLS visibility, and retrospective packet capture; its main trade-offs are tier-specific capacity limits and an internet requirement on most plans.

Overview

Kubeshark indexes Kubernetes network traffic at the kernel level with eBPF, then makes it searchable with Kubernetes, API, and network context. That can help teams trace traffic back to the workloads and services involved, rather than treat packet data as a collection of disconnected flows. It is purpose-built for Kubernetes, so teams looking for broad network monitoring beyond clusters should look elsewhere.

It also exposes cluster network data through MCP to AI assistants such as Claude Code, Cursor, and GitHub Copilot. That creates a route for AI-assisted investigation, while keeping the underlying use case focused on network observability and root-cause analysis.

Key features

Traffic analysis and capture

Kubeshark supports more than 23 protocols, including HTTP, HTTP/2, WebSocket, GraphQL, Kafka, AMQP, Redis, MongoDB, MySQL, PostgreSQL, gRPC, DNS, TCP, UDP, and TLS. KFL combines Kubernetes identity, API context, and network attributes for filtering, which is useful when an investigation starts with a service or workload rather than a raw address. Retrospective snapshots can be filtered by time, nodes, workloads, and IPs, then exported as PCAP files; this gives teams a way to preserve relevant traffic for later analysis.

TLS and service context

Kubeshark decrypts TLS and service-mesh mTLS traffic with eBPF without requiring keys, certificates, sidecars, or application changes. That reduces the instrumentation burden for inspecting encrypted traffic, though teams should weigh that visibility against their own sensitive-data handling requirements. Sensitive-data redaction, authorization rules, encrypted browser communication, ingress TLS, and SAML authentication for self-hosted deployments are documented security capabilities. Its About page displays SOC 2 compliance confirmation.

An identity-aware service map and performance KPIs cover pods, services, nodes, and namespaces. Snapshot storage can use Amazon S3, Azure Blob, or Google Cloud Storage for longer retention and sharing across clusters. Kubeshark deploys with Helm and supports air-gapped self-hosted operation on Enterprise.

Pricing

The Community plan is free and covers up to 3 nodes or 60 pods, with unlimited API call capacity and community support. It requires internet connectivity, so it is a constrained starting point for smaller connected clusters, not an option for air-gapped use.

Pro is $30 a month, billed per month, starting at that price. It removes node and pod limits but has limited API call capacity and still requires internet connectivity. Micro is also $30 a month, billed per month; it caps clusters at 6 nodes or 120 pods while offering unlimited capacity, API calls, and clusters, and is intended for dev/test. The choice between them is therefore about cluster footprint versus consumption and API headroom.

Dynamic costs $190 a month, billed per month, for unlimited nodes and pods, unlimited clusters, limited capacity, and 100K daily API calls; extra calls cost $50 per 100K. Small costs $360 a month, billed per month, and is capped at 20 nodes or 400 pods while including unlimited capacity, API calls, and clusters. Dynamic suits larger clusters with a defined API allowance, while Small fits smaller production clusters needing unlimited API calls.

Enterprise has custom pricing, billed per pod / month. It offers unlimited cluster size and consumption, air-gapped clusters, unlimited API call capacity, and dedicated support. Kubeshark usually provides support through a dedicated Slack channel; Enterprise adds dedicated Slack support, on-demand Zoom calls, and premium onboarding. Teams with offline requirements or heavier support needs have a clear reason to consider it, while the per-pod billing means cost depends on deployment size.

Platforms

Kubeshark supports API, Linux, macOS, self-hosted, web, and Windows environments. It is a Kubernetes-focused, self-hosted deployment, with Helm-based installation and air-gapped operation reserved for Enterprise.

Who it's for

Kubeshark is a strong fit for SREs and network engineers who need to connect cluster traffic with Kubernetes identity, inspect encrypted service traffic, or retain filtered packet snapshots for incident response. Its MCP interface may also suit teams bringing AI assistants into those workflows. It is less suitable for small clusters that exceed the free tier but cannot accept paid capacity trade-offs, or for teams that need offline operation without Enterprise.

Pros and cons

• Pro: Kubernetes, API, and network-aware KFL queries link traffic to cluster context, making workload-oriented investigation more direct.
• Pro: TLS and mTLS decryption without keys or application changes, plus retrospective PCAP export, support deeper incident analysis.
• Pro: Snapshot storage in three major cloud object stores supports retention and cross-cluster sharing.
• Con: Community is capped at 3 nodes or 60 pods and requires internet connectivity, limiting its fit for larger or isolated environments.
• Con: Pro has limited API call capacity, while the lower-priced Micro plan trades unlimited capacity for a 6-node or 120-pod cap.
• Con: Air-gapped deployment and dedicated support require Enterprise, with custom per-pod pricing.

Alternatives

For a different eBPF observability tool, browse the eBPF Observability Tools list. Choose DeepFlow if an open-source edition supporting Linux servers and selected Kubernetes, cloud, and container environments better matches your scope. Qpoint is worth considering for endpoint-focused agent discovery and monitoring with attribution, policy plugins, and source enforcement; its Community plan covers up to 25 endpoints.

Coroot offers a self-hosted Apache 2.0 Community Edition with core features, making it an alternative for teams prioritizing an open-source self-hosted edition. groundcover may suit teams seeking a free-forever BYOC plan with 12-hour data retention and Slack Community support. Inspektor Gadget is an open-source tools and framework option for Linux 5.10+ systems with BTF.

Odigos is an alternative for teams seeking core OpenTelemetry tracing in a free and open-source Apache 2.0 edition. Pyroscope offers a free plan with 50 GB ingested per month and 14-day retention. BCC is a free Apache-2.0 option for Linux systems running kernel 4.1 or newer.

Verdict

Kubeshark is a compelling choice for SRE and network teams investigating Kubernetes traffic when workload-aware filtering, encrypted-traffic visibility, and retrospective PCAP capture matter together. The key reason to choose it is that cluster context extends from queries to service mapping and snapshots. Look elsewhere if you need broad non-Kubernetes monitoring, want a larger free allowance, or require air-gapped use without Enterprise.