orb8

Free plan APILinuxMacSelf-hosted

What orb8 is

orb8 is a free, self-hosted eBPF toolkit for observing Kubernetes network traffic, with a stated focus on AI/ML clusters. Its probes capture IPv4 TCP, UDP, and ICMP flows on ingress and egress, then map packet IP addresses to Kubernetes pod names through the Kubernetes API. The CLI reports agent status, queries aggregated flows, streams network events, and supports namespace and pod filters. A gRPC API exposes QueryFlows, StreamEvents, and GetStatus operations. The agent runs as a Kubernetes DaemonSet with a ServiceAccount and ClusterRole for pod list and watch access. orb8 requires Linux kernel 5.8 or later with BTF enabled and is described as not running in a privileged container. The project says capture needs no application changes, sidecar, or kernel module. Version 0.0.6 lists capture, pod enrichment, API, CLI, and DaemonSet deployment as working. Installation is documented through Cargo or source, followed by a Kubernetes manifest.

Who it suits

It suits Kubernetes operators and developers who need self-hosted visibility into IPv4 traffic and pod relationships, especially in AI/ML clusters. Linux kernel and Kubernetes requirements must fit the target environment.

What it does well

Captures TCP, UDP, and ICMP flows
Maps packet IPs to pod names
Offers CLI and gRPC interfaces
Runs as a Kubernetes DaemonSet
Needs no sidecar or application changes

What to know first

Capture is IPv4-only
Some same-node pod traffic may be invisible
Cluster-wide query aggregation is not available yet
Requires Linux kernel 5.8+ with BTF

Limits

orb8 captures IPv4 traffic only. Same-node pod traffic may be invisible when probes attach only to eth0, and cluster-wide query aggregation is not yet available.

Getting started

Install orb8 through Cargo or from source
Prepare a Linux host with kernel 5.8 or later and BTF enabled
Deploy the agent as a Kubernetes DaemonSet
Apply the Kubernetes manifest with its ServiceAccount and ClusterRole
Use the CLI or gRPC API to query flows and stream events

Verdict

orb8 provides focused Kubernetes network visibility through eBPF, pod enrichment, live events, and aggregated queries. Its early implementation and documented IPv4 and aggregation limits matter when assessing coverage.

Questions

What does orb8 cost?

orb8 is free and provides a free plan.

Which systems does it support?

The deployment requires Linux with kernel 5.8 or later and BTF enabled. macOS development is documented through Lima and QEMU.

How is orb8 deployed?

Its agent runs as a Kubernetes DaemonSet. Installation is documented through Cargo or from source, followed by a Kubernetes manifest.

What network traffic can it capture?

The eBPF probes capture IPv4 TCP, UDP, and ICMP flows on ingress and egress.

Does orb8 change applications?

The project says it captures cluster flows without application changes, a sidecar, or a kernel module.

What license does it use?

The repository identifies the license as Apache License 2.0.

Facts from orb8's own pages

API: The agent exposes a gRPC API with QueryFlows, StreamEvents, and GetStatus operations. · github.com, 8 Oct 2026
CLI and API: The CLI can check agent status, query aggregated flows, and stream network events; the gRPC API provides QueryFlows, StreamEvents, and GetStatus. · github.com, 7 Oct 2026
Current maturity: The README identifies v0.0.6 as the current implementation and lists network capture, pod enrichment, a gRPC API, CLI commands, and DaemonSet deployment as working. · github.com, 7 Oct 2026
Deployment: The agent is deployed as a Kubernetes DaemonSet and requires Linux kernel 5.8 or later with BTF enabled. · github.com, 7 Oct 2026
Installation: The project documents installation through Cargo or from source, plus deployment with a Kubernetes manifest. · github.com, 8 Oct 2026
Known coverage limits: Documented limitations include IPv4-only capture, invisible same-node pod traffic in some probe configurations, and no cluster-wide aggregation yet. · github.com, 7 Oct 2026
Kubernetes deployment: The agent can be deployed as a Kubernetes DaemonSet, with a ServiceAccount and ClusterRole for pod list and watch access. · github.com, 8 Oct 2026
License: The repository is licensed under Apache License 2.0. · github.com, 8 Oct 2026
Limits: Documented limitations include IPv4-only capture, invisible same-node pod traffic when probes attach only to eth0, and no cluster-wide query aggregation yet. · github.com, 8 Oct 2026
Live features: The current release documents aggregated flow queries, real-time event streaming, agent status, and a CLI with namespace and pod filters. · github.com, 8 Oct 2026
Maker: The GitHub profile for Ignoramuss identifies the account holder as Mayank. · github.com, 8 Oct 2026
No application changes: The project says it captures cluster network flows without application changes, a sidecar, or a kernel module. · github.com, 7 Oct 2026
Packet capture: Its eBPF probes capture IPv4 network flows for TCP, UDP, and ICMP traffic on ingress and egress. · github.com, 7 Oct 2026
Packet visibility: It captures IPv4 TCP, UDP, and ICMP network flows and maps packet IPs to Kubernetes pods. · github.com, 8 Oct 2026
Planned capabilities: GPU telemetry, syscall monitoring, Prometheus metrics, and cluster-wide queries are listed as roadmap items. · github.com, 8 Oct 2026
Pod mapping: It maps packet IP addresses to Kubernetes pod names through the Kubernetes API. · github.com, 7 Oct 2026
Purpose: orb8 is an eBPF-powered toolkit for Kubernetes network observability, designed for AI/ML clusters. · github.com, 8 Oct 2026
Requirements: The agent requires Linux kernel 5.8 or later with BTF enabled. · github.com, 8 Oct 2026
Security: The documented DaemonSet uses specific Linux capabilities and is described as not running in privileged mode. · github.com, 8 Oct 2026
Security model: The DaemonSet uses specified Linux capabilities and is described as not running in a privileged container. · github.com, 7 Oct 2026

Where orb8 stands on Freedom251

eBPF Observability Tools#18 of 29