kubeshark/kubeshark

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

What it solves

Kubeshark is a network observability tool for Kubernetes clusters that allows SREs and AI agents to monitor, troubleshoot, and analyze network traffic in real-time without requiring code instrumentation or sidecars.

How it works

It uses eBPF at the kernel level to index cluster-wide network traffic. It parses traffic according to protocol specifications (such as HTTP, gRPC, Redis, and Kafka) and provides a query language (KFL) that combines Kubernetes identity, API context, and network attributes. It also automatically decrypts TLS/mTLS traffic using eBPF, removing the need for manual key management.

Who it’s for

This tool is designed for Site Reliability Engineers (SREs) and developers who need to debug network issues in Kubernetes, as well as AI agents that require network data for automated incident response and root cause analysis.

Highlights

  • AI Integration: Connects to AI assistants (like Claude and Copilot) via the Model Context Protocol (MCP) to enable natural language queries for network troubleshooting.
  • TLS Decryption: Automatically decrypts encrypted traffic in plain text using eBPF.
  • Traffic Snapshots: Captures and stores cluster-wide packet captures (PCAPs) in cloud storage (S3, Azure Blob, GCS) for long-term retention and Wireshark analysis.
  • Workload Dependency Map: Provides a visual map of how workloads communicate across the cluster.
  • KFL Query Language: A CEL-based language for pinpointing specific traffic using API, Kubernetes, and network semantics.

Related

  • Project
    eunomia-bpf/agentsight

    A system-level observability tool for AI agents that uses eBPF to monitor model calls, process execution, and file activity without requiring an SDK or proxy.

  • Project
    vfarcic/dot-ai

    An npm‑published Node library that adds LLM‑driven assistants to Kubernetes/DevOps workflows. It provides a CLI and a managed platform (MCP) for natural‑language cluster queries, deployment recommendations, automated remediation, policy‑driven prompt libraries, and semantic doc search, all packaged for easy installation on a Kubernetes cluster.

  • Project
    skyhook-io/radar

    An open-source Kubernetes UI that provides real-time cluster visualization, resource management, and GitOps monitoring as a single binary with no required cluster-side agents.

  • Project
    ccfos/huatuo

    A cloud-native observability project that uses eBPF to provide kernel-wide insights and continuous profiling for cloud-native and AI infrastructure with minimal overhead.

  • Project
    k8sgpt-ai/k8sgpt-operator

    A Kubernetes operator that enables AI-driven cluster analysis and troubleshooting, featuring automated remediation for specific workload failures.