9f5a1a41c0
* fix(release-pr): sync bumped Chart.yaml to kubeshark.github.io The release-pr target was switching back to master (and pulling) BEFORE copying helm-chart/ into ../kubeshark.github.io/charts/chart. That reverted the working tree to the pre-bump Chart.yaml, so the kubeshark.github.io PR shipped the previous version and the chart-releaser action failed trying to recreate an existing tag. Copy the bumped chart from the release/vX.Y.Z working tree, then switch kubeshark back to master at the end of the target. Also consolidate iterative robustness improvements: VERSION validation, idempotent sibling-repo tagging, idempotent branch / commit / push / PR creation, and a "nothing to commit" guard so reruns of release-pr do not fail. * refactor(release): split release-pr into three rerunnable targets Before, release-pr did three things in one recipe: tag sibling repos, create the kubeshark release PR, and create the helm chart PR. If any step failed, the whole target had to be rerun, even for the parts that had already succeeded, and some sub-steps (like tagging worker/hub/front after a docker-image-only rebuild) had no standalone entry point. Split into: - release-siblings : tag worker, hub, front - release-pr-kubeshark : bump Chart.yaml, build, open kubeshark PR - release-pr-helm : sync chart to kubeshark.github.io, open helm PR - release-pr : orchestrates all three in order Each is idempotent and can be rerun independently. release-siblings is now the canonical entry point for tagging sibling repos when refreshing docker images without a full release. release-pr-helm checks out release/v$(VERSION) (fetching from origin if absent) before copying helm-chart/, so it has the bumped Chart.yaml regardless of whether it runs right after release-pr-kubeshark or days later in a separate invocation. A shared _release-check-version prerequisite validates VERSION once per target invocation. * fix(release): make branch creation and push truly idempotent Delete and recreate local release/helm branches instead of conditionally checking out, and use --force-with-lease push to handle local/remote divergence on reruns. --------- Co-authored-by: Alon Girmonsky <alongir@Alons-Mac-Studio.local>
Network Observability for SREs & AI Agents
Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics.
What you can do:
- Download Retrospective PCAPs — cluster-wide packet captures filtered by nodes, time, workloads, and IPs. Store PCAPs for long-term retention and later investigation.
- Visualize Network Data — explore traffic matching queries with API, Kubernetes, or network semantics through a real-time dashboard.
- See Encrypted Traffic in Plain Text — automatically decrypt TLS/mTLS traffic using eBPF, with no key management or sidecars required.
- Integrate with AI — connect your favorite AI assistant (e.g. Claude, Copilot) to include network data in AI-driven workflows like incident response and root cause analysis.
Get Started
helm repo add kubeshark https://helm.kubeshark.com
helm install kubeshark kubeshark/kubeshark
kubectl port-forward svc/kubeshark-front 8899:80
Open http://localhost:8899 in your browser. You're capturing traffic.
For production use, we recommend using an ingress controller instead of port-forward.
Connect an AI agent via MCP:
brew install kubeshark
claude mcp add kubeshark -- kubeshark mcp
Network Data for AI Agents
Kubeshark exposes cluster-wide network data via MCP — enabling AI agents to query traffic, investigate API calls, and perform root cause analysis through natural language.
"Why did checkout fail at 2:15 PM?" "Which services have error rates above 1%?" "Show TCP retransmission rates across all node-to-node paths" "Trace request abc123 through all services"
Works with Claude Code, Cursor, and any MCP-compatible AI.
AI Skills
Open-source, reusable skills that teach AI agents domain-specific workflows on top of Kubeshark's MCP tools:
| Skill | Description |
|---|---|
| Network RCA | Retrospective root cause analysis — snapshots, dissection, PCAP extraction, trend comparison |
| KFL | KFL (Kubeshark Filter Language) expert — writes, debugs, and optimizes traffic filters |
Install as a Claude Code plugin:
/plugin marketplace add kubeshark/kubeshark
/plugin install kubeshark
Or clone and use directly — skills trigger automatically based on conversation context.
Query with API, Kubernetes, and Network Semantics
Kubeshark indexes cluster-wide network traffic by parsing it according to protocol specifications, with support for HTTP, gRPC, Redis, Kafka, DNS, and more. A single KFL query can combine all three semantic layers — Kubernetes identity, API context, and network attributes — to pinpoint exactly the traffic you need. No code instrumentation required.
KFL reference → · Traffic indexing →
Workload Dependency Map
A visual map of how workloads communicate, showing dependencies, traffic volume, and protocol usage across the cluster.
Traffic Retention & PCAP Export
Capture and retain raw network traffic cluster-wide, including decrypted TLS. Download PCAPs scoped by time range, nodes, workloads, and IPs — ready for Wireshark or any PCAP-compatible tool. Store snapshots in cloud storage (S3, Azure Blob, GCS) for long-term retention and cross-cluster sharing.
Snapshots guide → · Cloud storage →
Features
| Feature | Description |
|---|---|
| Traffic Snapshots | Point-in-time snapshots with cloud storage (S3, Azure Blob, GCS), PCAP export for Wireshark |
| Traffic Indexing | Real-time and delayed L7 indexing with request/response matching and full payloads |
| Protocol Support | HTTP, gRPC, GraphQL, Redis, Kafka, DNS, and more |
| TLS Decryption | eBPF-based decryption without key management, included in snapshots |
| AI Integration | MCP server + open-source AI skills for network RCA and traffic filtering |
| KFL Query Language | CEL-based query language with Kubernetes, API, and network semantics |
| 100% On-Premises | Air-gapped support, no external dependencies |
Install
| Method | Command |
|---|---|
| Helm | helm repo add kubeshark https://helm.kubeshark.com && helm install kubeshark kubeshark/kubeshark |
| Homebrew | brew install kubeshark && kubeshark tap |
| Binary | Download |
Contributing
We welcome contributions. See CONTRIBUTING.md.