Kubeshark release v53.6.0 (10-21-2026)

Release Highlights

Cloud snapshots now work against S3-compatible stores signed by a private CA, a trace log level
makes authorization and snapshot failures diagnosable without a debugger, and three long-standing
worker and Hub noise sources are gone.

New Features

• Skip TLS verification for the snapshot S3 endpoint — tap.snapshots.cloud.s3.insecureSkipVerify
  lets the Hub talk to an S3-compatible endpoint whose certificate is signed by a private CA, which
  previously failed the startup bucket check and left cloud snapshots unavailable. It applies only
  to the S3 endpoint, not to the STS call, and is off by default
• trace log level — logLevel: trace is accepted by the Hub, the worker and the dissector.
  Previously it fell through to the default and silently became warning, less output than asked
  for. The Hub also passes its log level to the dissection jobs it spawns, which used to run at their
  own default regardless
• Authorization and snapshot diagnostics — every authorization denial (REST, MCP and
  Connect-RPC) now logs the route, the required capability, the resolved role and the effective
  capability set, and the OIDC pipeline logs discovery, the login round trip, token verification and
  role resolution step by step. Snapshot creation records what was requested, what each worker
  returned, and separates the three previously identical "no PCAP files found" causes. The
  per-request narrative sits at trace; actionable outcomes are at warn

Improvements

• Raw capture retry reporting — a worker that exhausts its raw capture retries is reported once
  at error, naming the cause, instead of each retried attempt being reported and the exhaustion
  itself going unlogged
• MCP list_api_calls honours snapshot_id and dissection_id on the GET endpoint — a
  snapshot query no longer falls through to the live worker stores and returns current traffic in
  place of the snapshot's dissection results
• Benign stream ends are no longer errors — a normally closed gRPC stream between Hub and
  worker, or a client that disconnects from a read stream, is classified as a routine end rather
  than reported as a fault, in all four stream paths
• Discarded base entries are counted — the worker keeps a counter of dropped base entries and
  logs the syscall reconnect at a level that reaches the pod logs

Bug Fixes

• Empty entries from the syscall dissector were stored and broadcast — the syscall dissector
  returned a base entry it never populated. The store rejected it, logging an error that blamed the
  store, and the empty entry was still sent to live consumers. Such entries are now dropped before
  they reach the store or the stream
• Tracer restart leaked a file descriptor in the worker — the syscall event socket was never
  closed before redialling after the tracer restarted, and the routine EOF on that socket was
  logged as an error

Infrastructure & Dependencies

• Go 1.27.2 in the Hub image
• api2 realigned in the Hub and the worker to the stream-end classifier
• tracer submodule advanced to accept the trace log level

Validation

Validation results will be added once the post-release runs complete.

Patches

Patches to this release will be listed here.

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.6.0/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.6.0/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.6.0/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.6.0/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v53.6.0/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.