Kubeshark — Deep Network Observability for Kubernetes

How to deploy Kubeshark?

Install:

brew install kubeshark

Start capturing Traffic:

kubeshark tap

Ready

Add the Helm repository and install:

helm repo add kubeshark https://helm.kubeshark.co
‍helm install kubeshark kubeshark/kubeshark

Enable dashboard access:

kubectl port-forward service/kubeshark-front 8899:80

Visit local page:

Visit localhost:8899 to view real time streaming traffic

Ready

Install the CLI using a simple shell script:

sh <(curl -Ls https://kubeshark.co/install)

Alternatively, you can download the latest release of Kubeshark CLI directly from GitHub

Start capturing Traffic:

kubeshark tap

Ready

Clone:

git clone https://github.com/kubeshark/kubeshark.git

Build:

cd kubeshark && make

Start capturing traffic:

./bin/kubeshark__ tap

Ready

Kubernetes Incident Investigation for DFIR teams

Deep Network Observability

Gain protocol-level visibility into K8s' internal network across all parts of the cluster.
Refine your analysis using a rich query language.
Unravel the intricate web of relationships with an identity-aware service map.
Analyze pod-to-pod connections and detect network errors.

Service map, logs and metrics in Grafana, Elastic or Influx

Traffic Recording & Offline Analysis

Stop holding your breath while waiting for symptoms to appear as you watch.
Capture the last hour/day/week of selected pods' traffic and analyze offline at your discretion.
Ideal for compliance teams to securely record API transactions for future review.

Actionable detection of suspicious network behaviors

Monitoring & Alerts

Detect suspicious network behaviors in real-time.
Trigger alerts and export network metrics and schema-free documents to your preferred telemetry or log aggregation application.
Create custom logic scripts in conjunction with OSI L4/L7 hooks.

What are people saying about

The Must Have Tool for Devops & SREs

Alex Jones from Canonical describes why Kubeshark is a must have tool for Devops and SREs, and provides a brief history of Wireshark and the importance of network analysis.

From

Understand Traffic Flow in K8s

Abhishek Veeramalla, a DevOps evangelist, uses Kubeshark in his DevOps course to understand how services handle load balancing, service discovery, and exposing applications to the outside world.

From

Kubeshark:  Wireshark for Kubernetes

Kubeshark: Wireshark for Kubernetes Harsha Koushik, a security engineer, is using Kubeshark for traffic monitoring and threat modeling while comparing to other tools in the industry.

From

Review

I had a use case to identify all outbound connections made during normal operations of our product (to help clients with whitelisting), and Kubeshark saved me loads of time in the process! I raved about the tool to colleagues as well.

Nathan Chang

Solutions Architecture at Robust Inteligence