V52.3.94 (2025-01-03)

Release Highlights

This release introduces a range of enhancements to Kubeshark's functionality, including improved traffic capture, extended configurability, and enhanced compatibility for air-gapped environments. Key updates include support for PCAP traffic recording, refined Istio/Envoy inspection, and the ability to define custom macros. Additionally, communication and performance improvements, as well as user-friendly logging configurations, make this update more robust and user-centric.

Keywords: Envoy, Istio, tcpdump, eBPF

New Features & Bug Fixes:

• TCPdump-Style PCAP Recording:

• Extended the pcapdump command (tcpdump-style traffic recording) that records all L4 traffic (TCP, UDP, SCTP) captured by Kubeshark, including decrypted TLS and mTLS traffic.This capability can run on any size cluster with no limit with no license required.

• Can now record all traffic within a certain time window (e.g. 5 minutes)

• Read more about it here.

• Enhance the Linux Operating System Context by adding detailed process information (e.g., process name, ID, path) for both source and destination of each request-response pair.

• Improved eBPF traffic capture by supporting both cgroup V1 and V2, with the ability to explicitly choose between them.

• Added Prometheus reporting capabilities to the Hub.

• Replaced the default Sniffer port from 30001 to 48999 to avoid port collisions with other applications.

• Improved communication between Sniffer and Tracer for better performance.

• Enabled the definition of custom KFL macros. As an example, set by default: tap.customMacros.https="(http or http2) and tls, which allows users to filter TLS-decrypted HTTP 1 and 2 traffic using the https keyword. Additional macros can be set by the user.

• Kubeshark now works seamlessly in air-gapped environments, removing dependencies on a licensing server.

• Added links and options for product support.

• Granular Log Levels:

• Introduced a logLevel configuration value to allow for more granular control over log verbosity.

• Supported values: info, debug, warning, error.

• Default log level: warning.

• Deprecated the previous tap.debug configuration.

• Istio/Envoy Inspection:

• Enhanced identification of Istio/Envoy traffic to inspect communications between containers and Envoy sidecars in Istio-enabled pods.

• Added an easy way to redact sensitive information from the dashboard

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.3.94/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

rm -f kubeshark && curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.3.94/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.3.94/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.3.94/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v52.3.94/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.