May be this is a tool I should use extensively to better understand calls under the hood to write better run-time security policies more related to control plane.Honestly, it is not a fair to compare this with Sysdig falco or Cilium Tetragon, but the way this captures and tunes the data makes me look at real time detection aspect and think about using it in some of the security aspects more related to K8s API anomalies.It would be good to do a performance benchmark at decent scale and see how this tool scales, affects compute & storage, given the amount of traffic grows exponentially at massive scale.Can extend the data to do some real time alerting, both operational and security alerts.Service Maps provide a high level overview of how my cluster is looking from a visual perspective.Debugging/Troubleshooting becomes super simple by adding the appropriate filters to the traffic.Helps deepen my understanding of how various components in the cluster communicate and work together at the lowest level possible.Kubeshark will start monitoring/tapping the traffic & start a viewer on port 8899 on your localhost. Tap -A taps all namespaces, you can specify -n to monitor a specific namespace. You can install KubeShark using this command sh <(curl -Ls )įor specific release and arch, download binary from here Lets install Kubeshark and see how does it work. Think of failed calls on get secrets, failed instance meta-data calls, many more anomalies like these. Real Time Alerting - Can build really powerful alerting for K8s with the Data Kubeshark is allowing me to use.Easier Debugging - Whether its debugging something or deepening the understanding of comms between various components in the cluster, this greatly enables to do so.PCAP store - Store PCAP for future analysis of an incident, can easily dump this into S3 or some other storage, load and visualize later.Request Response details on the right pane are super clear. Visualize - Kubeshark Viewer is so simple, yet so powerful to view real time traffic, filter, analyze and troubleshoot any issue.Monitor everything - Be it monitoring Pod-Pod network traffic, API calls made, monitor a single node, a service, or a specific path like - /latest/meta-data or /health etc.

Kubeshark dashboard What is Kubeshark solving?

Wireshark arch linux