V52.4.0 (2025-02-05)

Release Highlights

In this new minor release, in addition to fixing bugs and improving performance, we’ve implemented a few significant features.

Automatic Patch Updates

Benefit: Quicker bug fixes

Going forward, the major.minor tag will always include the latest patch release. An explicit patch version can still be used by using the major.minor.patch tag (e.g., 52.3.96 or 52.4.0).

Automatic Packet Capture Technology Choice per Node

Benefit: Harvest more information using fewer resources (CPU, memory)

An algorithm now attempts to find the best packet capture technology for each node. Selecting the optimal packet capture technology per node can significantly impact the amount of information harvested by Kubeshark, as well as memory and CPU consumption.

This optimal method depends on the node’s kernel version, supported networking technologies (e.g. eBPF, Cgroup V1 or V2, AF_PACKET, etc), and available security capabilities.

The flow is:
eBPF on Cgroup V2 => eBPF on Cgroup V1 => AF_PACKET => libpcap

You can still explicitly set the packet capture technology by configuring the appropriate Helm value. For example:

--set tap.packetCapture=af_packet

Default Protocol Port Mapping

Benefit: Faster protocol detection and dissection

We’ve added default port mapping to test and detect protocols based on the ports being used. For example, if port 80 or 443 is detected, Kubeshark will first attempt to test for HTTP. If the protocol is not identified as HTTP, Kubeshark will continue testing against all other protocol options.

This approach helps reduce false detections and optimizes the time required to begin dissecting a specific protocol. When default ports aren’t used, users can modify the default port mapping by setting the tap.portMapping Helm value.

New Features & Bug Fixes

• Automatic determination of the best packet capture technology per node
• Automatic patch update system
• Added default port mapping for better protocol detection and faster dissection
• Fixed a few bugs related to the kubeshark pcapdump command
• Fixed the missing pull secret alignment (ce7913c)
• Refactored the workers’ security context, enabling more granularity with configuration support for AppArmor, SELinux, and more
• Added a way to see Kubeshark’s logs in the dashboard by enabling the script named: Kubeshark Logs and Pod Events Report
• Added a way to monitor the Hub and workers’ CPU and memory consumption in the dashboard by enabling the script named: Monitor Kubeshark Resources
• Improved the Hub’s memory and CPU consumption
• Fixed a DNS-related panic (#1708))
• Fixed an issue in the service map where aggregation numbers (e.g., bandwidth, CPU) related to Kafka were incorrect

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.4.0/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

rm -f kubeshark && curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.4.0/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.4.0/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.4.0/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v52.4.0/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.