| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: kubeshark-cli-bash-completion | Distribution: openSUSE Tumbleweed |
| Version: 53.3.0 | Vendor: openSUSE |
| Release: 1.4 | Build date: Tue May 19 14:16:27 2026 |
| Group: System/Shells | Build host: reproducible |
| Size: 16333 | Source RPM: kubeshark-cli-53.3.0-1.4.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://github.com/kubeshark/kubeshark | |
| Summary: Bash Completion for kubeshark-cli | |
Bash command line completion support for kubeshark-cli.
Apache-2.0
* Tue May 19 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 53.3.0:
Kubeshark 53.3.0 promotes the TLSX dissector to on-by-default
with full TLS handshake visibility (ClientHello / ServerHello
fields, SNI summary, TLS 1.3 detection), ships a complete
authorization refactoring across CLI, Helm chart, hub and front,
and adds L7 data boundaries with a LIVE filter button for scoping
traffic queries. Snapshot creation now supports namespace and
pod-regex filters, and a new internal bearer-token auth layer
secures in-cluster gRPC calls. The release also introduces three
new AI skills: security audit, install guidance, and PostgreSQL
KFL support.
* New Features
- TLSX dissector enabled by default — The TLS handshake
dissector is now active out of the box, exposing ClientHello
and ServerHello fields (cipher suites, supported versions,
SNI, ALPN) as first-class KFL variables (tlsx, tls_sni,
tls_version, etc.)
- L7 data boundaries with LIVE filter — New MCP tool, API
endpoint, and frontend button to query L7 data time
boundaries and scope traffic views to live data
- Snapshot namespace & pod filters — Snapshot creation dialog
now accepts namespace and pod-regex filters, making it easy
to capture targeted slices of traffic
- Internal bearer-token auth for in-cluster gRPC — Hub now
issues and validates bearer tokens for worker-to-hub gRPC
calls, replacing implicit trust; worker pods are labeled for
token-review access
- Security-audit AI skill — MITRE ATT&CK-based threat detection
methodology for Kubeshark MCP-powered security audits
- Install AI skill — Guided Kubeshark deployment skill covering
CLI, Helm, platform-specific config, auth, and
troubleshooting
- PostgreSQL KFL support — KFL skill updated with PostgreSQL
protocol filter reference
* Improvements
- Authorization refactoring — Unified authz model across Helm
chart, CLI, hub, and front with cleaner role/permission
boundaries
- TLS handshake detail fields — Human-readable string
representations added to TlsServerHelloInfo proto for easier
inspection
- Responsive snapshot creation dialog — Snapshot dialog now
adapts to smaller viewports
- Swap tab order — API Stream tab now appears before Map tab
for faster access to the most-used view
- Force credential re-prompt on login — Auth flow now forces a
fresh credential prompt on every login instead of reusing
stale sessions
- Filter out Kubeshark's own DNS queries — Self-generated DNS
traffic is no longer shown in the traffic stream
- Update license error messages and capacity limits — Clearer
messaging for license-related issues
- Don't gate UI for Descope auth backend — UI no longer blocks
rendering while waiting for Descope auth state
* Bug Fixes
- Fix race in dissectors KFL module loading — Resolves a race
condition when loading KFL modules in dissectors
- Fix dissection toggle button not responding to clicks —
Toggle now reliably enables/disables dissection
- Fix snapshot download — Adds missing addToast import that
broke snapshot file downloads
- Fix loading payloads for realtime and delayed-dissection
entries — Corrects payload rendering for both live and
historical traffic
- Fix Descope user profile mirroring — Descope SDK user profile
(email/name) now correctly populates the identity atom
- Stop polling when unauthenticated — Frontend stops API
polling after auth is revoked, preventing cascading 401
errors
- Handle Sentry-reported network errors — Graceful handling of
network errors surfaced via Sentry
- Prevent MS Outlook crawl errors in Sentry — Suppresses noise
from Outlook prefetch probes
- Guard rawcapture against removed worker —
recordSuccess/recordFailure no longer panic when a worker has
been removed
- Fix equality filter for missing fields (KFL2) — Equality
filters now correctly handle entries that lack the filtered
field
- PCAP-only boundaries + race-tolerant streaming — Snapshot
data service handles PCAP boundaries correctly and tolerates
concurrent access
- Fix memory leak in delayed dissection — Resolves leak
introduced after the HTTP one-leg fix
- Fix sentry error severity levels — Errors now report with
correct severity
- Fix slice bounds out of range in HTTP dissection — Prevents
panic on malformed HTTP payloads
- Add PCAP boundary for preventing truncated packets — Guards
against partial packet writes
- Extract error status codes from Kafka responses — Kafka
dissector now surfaces error codes from response frames
* Infrastructure & Dependencies
- Rename TLS proto types from Tls to Tlsx — Consistent naming
across api2, kfl2, worker, and hub
- Bump Go to 1.26.3
- Bump Node from 25-alpine to 26-alpine (front)
- Helm: grant hub tokenreviews RBAC and label worker pods for
internal auth
- UX: improved error toast messages across the frontend
* Fri May 01 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 53.2.5 (.4 was not released):
Kubeshark 53.2.5 adds native MySQL and PostgreSQL protocol
dissection — both enabled out of the box — fixes server-side TLS
decryption for pre-fork servers like PostgreSQL, and introduces a
configurable dashboard entries limit. The release also includes
stream-history playback, a 4× heap memory reduction in the
dashboard, and several reliability fixes across the stack.
* New Features
- MySQL protocol dissector — Full wire-protocol dissection for
MySQL traffic on port 3306, enabled by default. Includes
worker dissector, hub dependency update, front-end UI
support, and e2e tests
- PostgreSQL protocol dissector — Full wire-protocol dissection
for PostgreSQL traffic on port 5432, enabled by default.
Includes worker dissector, hub dependency update, front-end
UI support, and e2e tests
- Stream history — New API and UI for streaming historical (raw
capture) traffic, enabling retrospective browsing of
previously captured data with a time-picker range control
- Dashboard entries limit — New tap.dashboard.entriesLimit Helm
value (default 300000) controls the maximum number of entries
the dashboard holds in memory
* Improvements
- Columnar entry storage — 4× heap memory reduction — Replaces
sparse per-entry maps with dictionary-backed columnar
storage, dramatically reducing browser memory usage
- Decode multi-message gRPC payloads — Request and response
views now decode concatenated gRPC frames instead of showing
raw bytes
- Surface grpc_method / grpc_status as KFL queries in UI —
Clicking the Path row on gRPC entries emits grpc_method ==
"..." and clicking Grpc-Status emits grpc_status == N
- Show both entry namespaces by default — Source and
destination namespaces are now always visible in the entry
list
- Copy button for snapshot failure reason — Adds a clipboard
copy button to snapshot error messages for easier debugging
- Document gRPC KFL fields in MCP schema — grpc, grpc_method,
grpc_status are now documented in the MCP KFL schema
- Adjust KFL input boxes — Visual refinements to KFL filter
input areas
- Release pipeline overhaul — Split the monolithic release-pr
Makefile target into three independent, idempotent targets
(release-siblings, release-pr-kubeshark, release-pr-helm)
that can be rerun individually without side effects
- Fix Chart.yaml sync to kubeshark.github.io — The helm PR
target was switching back to master before copying the chart,
shipping the pre-bump version
* Bug Fixes
- Fix server-side TLS decryption for pre-fork servers
(PostgreSQL) — Adds dual-key connection_context and
accept-symbol fallback for servers that fork before accepting
connections
- Fix TLS stop-capturing — Prevent closing uprobe hooks for TLS
workloads that are still being traced
- Fix Istio one-leg HTTP — Corrects single-leg HTTP capture in
Istio service mesh environments
- Fix HTTP api-server one-leg — Resolves single-leg API server
traffic capture
- Remove sliding-window TLS heuristic from all L7 dissectors —
Eliminates false-positive TLS detection that could
misclassify plaintext traffic
- Fix request/response matcher in MongoDB and Kafka — Corrects
pairing logic in the MongoDB and Kafka protocol dissectors
- Fix Pebble use-after-close — Resolves a crash from accessing
Pebble DB after it has been closed (worker#1114)
- Fix re-running dissection on failure — Snapshot dissection
can now be retried after a failure without manual
intervention
- Skip incomplete dissections from cloud upload — Prevents
partially dissected snapshots from being uploaded to cloud
storage
- Ensure auth credentials on all API requests — Mirrors auth
headers to cookies for consistent authentication across all
request types
* Infrastructure & Dependencies
- Revert time-boundaries display above snapshots table —
Reverted pending a redesign
- Update Go to 1.26.2
- Update build environment to latest version
- Bump deps to close Scout CVEs — Updates moby v2, go-jose,
jsonparser, and OpenTelemetry dependencies)
- Update spdystream — Addresses CVEs
- Bump KFL2 and lock in gRPC trailer merge
- Drop arm64 race builds due to toolchain limitations
- Update registry offsets — Refreshes embedded Go TLS offset
bundle
- Reduce noisy parse-packet log messages
- Update gRPC in e2e tests to address Dependabot issues
- Update hub dependencies for Docker Scout compliance
* Mon Apr 20 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 53.2.3:
* Release Highlights
Kubeshark 53.2.3 expands eBPF Go TLS decryption enabling
transparent TLS visibility in proxies like Traefik that layer
their own Conn types over the native TCP connection. The
release also threads elapsed_time through every dissected API
entry end-to-end, surfaces a dedicated tls KFL keyword, and
ships reliability fixes around worker reconnection, reused-IP
resolution, and snapshot time boundaries.
* New Features
- Add eBPF Go TLS decryption, enabling TLS decryption in
Traefik and similar wrapping proxies
- Add tls KFL keyword for filtering TLS-bearing traffic with a
single boolean
- Add time boundaries display above the snapshots table to show
the available data window at a glance
* Improvements
- Populate elapsed_time in every BaseEntry end-to-end (worker →
hub → dashboard), enabling latency filtering and sorting
across all protocols
- Rename snapshots in cloud storage (S3/GCS/Azure) when the
local snapshot is renamed
- Use file modification time for snapshot start boundary
instead of creation time — fixes incorrect windows on
filesystems that don't preserve birth time
- Set explicit nginx proxy_buffer_size / proxy_buffers
directives to prevent upstream header-too-large errors under
load
- Bump Go base image from 1.26.1 to 1.26.2
* Bug Fixes
- Fix worker reconnection after container restart — the hub now
correctly re-establishes worker streams, eliminating silent
gaps in traffic
- Fix reused-IP resolution returning stale pod/service names
after pod churn
- Fix BPF pids_info lookup by keying on cgroup_id instead of
PID; add pid=0 wildcard fallback
- Fix BPF wrapper-chain unwrap to break only on concrete types
(is_interface==0) and increase the chain limit from 2 to 4
* Fri Apr 17 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 53.2.2:
* Release Highlights
Kubeshark 53.2.2 introduces MongoDB protocol dissection,
bringing L7 visibility to MongoDB traffic across the dashboard,
MCP tools, and KFL filtering. Kubernetes metadata enrichment
has been moved from the hub to the worker nodes, significantly
reducing hub load and improving scalability in large clusters.
The eBPF tracer now supports Envoy BoringSSL TLS decryption via
offset-based hooking and introduces a ring buffer-based packet
poller for improved capture performance.
* New Features
- Add MongoDB protocol dissector with request parsing (Phase
1), MCP transform support, and dashboard UI
- Add Envoy BoringSSL TLS decryption via offset-based hooking
in the eBPF tracer
- Add dashboard-level namespace, worker, and dissector filters
for granular traffic scoping
- Add back-end resolved entry summary display in the dashboard
- Add time preset buttons in snapshot creation dialog for quick
time window selection
- Add external volume support for dissection jobs, enabling
persistent storage across restarts
- Add recvmsg/sendmsg/recvmmsg/sendmmsg/readv/writev syscall
hooks for improved SSL-to-fd tracking
* Improvements
- Move Kubernetes metadata enrichment from hub to worker nodes
— reduces hub load and improves scalability
- Stream pod Modified events to workers when enrichment fields
change, keeping worker-side K8s metadata up to date
- Replace eBPF perf buffer with ring buffer-based packet poller
for improved capture performance and memory efficiency
- Add async pin cleanup for graceful eBPF tracer termination,
improving shutdown reliability
- Update MCP KFL schema to match KFL2 capabilities
- Update Network RCA AI skill resolution tools to
list_workloads/list_ips
- Improve JSON payload detection and formatting in the
dashboard
- Reset API stream on targeting change for consistent real-time
view
- Extract snapshot tar archives directly during download for
dissection
- Pass dissection storage flags to dissection jobs
- TCP flows in CLOSED state now bypass backend capture rules
- Add subPathExpr to worker DaemonSet for shared persistent
storage
- Refactor string splitting in loops for improved performance
- Bump Go base image from 1.25.7 to 1.26.1
* Bug Fixes
- Fix pod targeting collision for same-named pods in different
namespaces
- Fix KFL K8s field filtering for MCP live queries
- Fix eBPF-TLS capture source icon in the dashboard
- Fix snapshot creation to use only healthy workers
- Fix do_accept() compatibility issue in eBPF tracer
- Fix processing of stop raw capture command
- Fix flaking tests in hub
* Wed Apr 01 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 53.2.0:
* Release Highlights
Kubeshark 53.2.0 introduces open-source AI skills for network
root cause analysis and traffic filtering, making Kubeshark's
MCP-powered workflows reusable and shareable. Snapshot
capabilities have been significantly expanded with GCS cloud
storage, local .tar upload, snapshot renaming, PCAP export
filters, and disk usage visibility. TLS-decrypted traffic is
now included in snapshots, and gRPC streaming has been
rearchitected for improved reliability and real-time
responsiveness. The eBPF tracer now supports stripped Go
binaries via offset table lookups, improving TLS hooking
reliability in production environments.
* New Features
- Add KFL and Network RCA open-source AI skills for MCP-powered
network analysis workflows
- Add GCS (Google Cloud Storage) support for snapshot cloud
storage
- Add snapshot PCAP export filters dialog for targeted traffic
extraction
- Add ability to rename snapshots
- Add ability to upload local .tar snapshot files for analysis
- Add snapshot creation from custom time windows with enhanced
time selection and auto-dissection
- Add snapshot disk space usage and available space metrics in
the Snapshots tab
- Add ability to recreate dissection by deleting old and
creating new one
- Add get_api_call_details MCP tool with hub proxy routing
- Add snapshot support to list_api_calls and
get_api_call_details MCP tools
- Add cloud storage MCP tools for upload/download operations
- Add Demo Portal readonly mode with no authentication required
- Add configurable L4 map visibility via Helm value
- Add IP/workload resolution database for snapshots, enabling
workload-to-IP and IP-to-workload lookups
- Add BaseEntry history support for tracking entry changes over
time
- Add KFL support for DNS resolution names (dst.dns)
- Add TLS (eBPF) indication in the UI with fixed KFL filtering
- Add explicit cloud storage configuration options
- Add Go offset table support for stripped binaries in eBPF
tracer, with Build ID content hash matching and targetCgroup
retry fallback
* Improvements
- Include decrypted TLS traffic in snapshots via decrypted_pcap
directory support
- Implement TCP segments coalescing to reflect real-time
connection behaviour
- Rearchitect gRPC streaming with heartbeat/data event
separation for improved reliability
- Send initial heartbeat ahead once gRPC client is ready to
reduce UI load time
- Verify hub/front pods are ready by conditions before
proceeding
- Use last modification time as snapshot data boundary end for
accuracy
- Persist selected db query parameter across navigation
- Use more deterministic status indicators for loading L4/L7
entries
- Map legend: worker-node switching with no node legend item
- Use current time for new-snapshot end time by default
- Split TCP reader into two parts for delayed dissection;
cancel request/response matcher goroutines in DD mode
- Skip applying KFL2 K8s expressions on worker side (hub-only)
- Exclude TCP-CONNs and UDP-CONNs from selected base entries
fetch
- Skip capacity check for community edition within node/pod
limits
- Download/export snapshots over direct HTTP for improved
performance
- Use OIDC auth instead of interactive OAuth for MCP Registry
publish
- Poll script logs when scripting is enabled
- Add ENTERPRISE2 license type support
- Delete worker from health report when not running
- Add BaseEntry ID and nodeID KFL2 filter expressions
- Add KFL2 filters for DNS resolution fields
- Add PCAP streaming bytes metric for monitoring
* Bug Fixes
- Fix memory leak in flow tracer
- Fix DNS resolution for TLS entries in delayed dissection
- Fix TLS hooking in tracer (eBPF)
- Fix derived entries processing
- Fix dissection-control front environment variable logic
- Fix GraphQL entry view rendering
- Fix PCAP fetching for entries from dissection DB
- Fix snapshots local storage size calculation
- Fix snapshot data boundary detection using last modification
time
- Fix handling of missing PCAPs in export and snapshot
operations
- Fix dissection progress reporting and error handling
- Fix race condition between resolving DB query and stream
start
- Fix L7 map for delayed-dissection entries when realtime
dissection is stopped
- Fix streaming-cancelled error handling in the UI
- Fix entry details panel edge cases
- Fix entries-list z-index layering
- Restore cloud storage MCP tools accidentally dropped in prior
PR
- Restore dissection telemetry on hub restart
- Use pending cgroups when container ID is not yet known
(tracer)
* Security
- Update compromised Trivy action across worker and hub CI
pipelines
- Update tracer to fix gRPC vulnerability
- Upgrade trivy-action from 0.28.0 to 0.34.2
- Rename KubeHQ to Kubeshark, Inc. in LICENSE across all repos
* Fri Mar 06 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 53.1.0 (no version 53.0.0):
* CLI-related changes:
- Add --release-helmChartPath CLI flag for deploying with a
local Helm chart
* Security
- Fix CVE-2025-30204 by updating golang-jwt to patched versions
- Fix CVE-2025-47914 and CVE-2025-58181 by updating
golang.org/x/crypto to 0.45.0
* Mon Jan 26 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.12.0:
* Bug Fixes & New Features
- Improved performance of the cluster-wide L4 connectivity map.
- Fixed the missing footer bug in the frontend.
- Added individual PCAP files to snapshot archive downloads to
help find the needle in the haystack in busy clusters.
- Transitioned the following domains:
- docs.kubehq.com to docs.kubeshark.com
- kubeshark.kubehq.com to demo.kubeshark.com
- console.kubehq.com to console.kubeshark.com
- helm.kubehq.com to helm.kubeshark.com
- api.kubehq.com to api.kubeshark.com
* Fri Jan 16 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.11.7 (versions between .0 and this one were
not released):
* Release Highlights
- This release includes a complementary license, enabling
Kubeshark to run in clusters of up to 100 nodes, free
* Bug Fixes & New Features
- Extended complementary license
* Wed Dec 17 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.11.0:
This is the first release in preparation for V2.00, which will be
officially launched in January 2026. We will continue adding new
features while deprecating older ones, as V1.00 is gradually
being sunset.
You can read more about this transition here.
https://www.linkedin.com/pulse/kubeshark-v200-coming-soon-alon-girmonsky-o9jtc/
* Bug Fixes & New Features
- The backend was completely refactored. The new backend is now
available as part of V2.00, while V1.00 continues to use the
legacy backend. In addition to enabling new features, the new
backend is significantly more performant than the legacy
implementation.
- Added an easy way to export cluster-wide L4 traffic (PCAP).
Read more here.
- Added L7-to-L4 mapping (API calls mapped to L4 TCP/UDP
connections). This functionality includes an online PCAP
viewer, as well as the ability to download a single
aggregated PCAP file. Read more here
- Fixed an issue where backend filter rules related to
namespace exclusion did not work correctly.
* Thu Dec 04 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.10.3 (no releases between .0 and this one):
* Bump the Helm chart version to 52.10.3
* Adding a default license (#1812)
* Use `www.kubehq.com` for links (#1809)
* Wed Nov 26 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.10.0:
* Bump the Helm chart version to 52.10.0
* Bump the Helm chart version to 52.10.0
* Update kubeshark.co references (#1807)
* Migrate from `kubeshark.co` to `kubehq.com` (#1805)
* Adding Slack Support (#1804)
* Make host-network in worker daemonset configurable (#1803)
* Revert "Add `-save-objects-pcaps` worker command flag
(#1794)" (#1802)
* Add volume for snapshots in hub (#1801)
* Add `-save-objects-pcaps` worker command flag (#1794)
* Set default dbMaxSize to 500Mi (#1796)
* Fri Oct 03 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.9.0:
* Bug Fixes & New Features
- Added a Helm property to control the duration before
Kubeshark automatically enters
[Dormant](https://docs.kubeshark.co/en/on_off_switch) mode to
conserve resources when idle. In Dormant mode, resource
consumption is minimized. This behavior can be disabled via
Helm. Kubeshark will not enter Dormant mode if any dashboard,
Agent logic script, or recording is active.
- The hostroot volume is now created only when the tracer is
deployed. tracer deployment is controlled by the
tap.tls=true/false setting.
- Introduced support for defining a custom ingress path via the
Helm value: tap.ingress.path.
* Tue Aug 19 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.8.1:
* Bug Fixes & New Features
- Fixed support for Cgroup V2 in cases where additional
privileges are required.
- Implemented a traffic processing timeout for periods of
complete inactivity:
- A new Helm value has been introduced to define the timeout
duration when there is no dashboard streaming traffic, no
active recordings, and no agents operating.
- In such cases, Kubeshark will transition into a Dormant
state until new activity is detected.
- During the Dormant state, traffic processing is halted, and
resource consumption is minimized.
- This ensures Kubeshark consumes negligible system resources
unless actively in use.
* Sun Aug 03 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.8.0:
* Bug Fixes & New Features
- Resolved Helm chart issue (#1763)
- Implemented minor bug fix (#1767)
- Patched multiple vulnerabilities (#1773)
- Introduced PriorityClass to Helm chart (#1775)
- Bump the Helm chart version to 52.8.0
- Add priority class configuration for Kubeshark components
(#1775)
- CVE-2025-53547: Update helm to latest (#1774)
- Add `api2BetaEnabled` helm value (#1770)
- docs-changes (#1768)
- chore: fix some minor issues in the comments (#1767)
- Fix bugs in helm chart (#1765)
- Bump the Helm chart version to 52.7.8
- updated dry release target
- added back online support (#1764)
- enable support
- Use chart minor version for dockertag (#1762)
* Tue Jun 17 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.7.8:
* Bug Fixes & New Features
- Resolved a Make issue that caused the CLI to use an explicit
tag (e.g., v52.3.77) instead of the latest tag (e.g., v52.3).
- Reintroduced online support via Intercom. This can be
disabled using: --set supportChatEnabled=false.
- Fixed a panic related to the WebSocket (WS) protocol.
- Added the ability to download an Agent logic script
(JavaScript file). Once downloaded, the script can be used
locally and managed via source control.
* Tue Jun 03 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.7.7 (52.7.6 does not exist):
* Release Highlights
- This release includes several key bug fixes and feature
enhancements. Notably, it adds support for external secret
managers and improves Helm chart semantic versioning (semver)
compliance.
* Bug Fixes & New Features
- Fixed a bug where eBPF traffic capture did not work when
persistent volume storage was used. (#1757).
- Fixed a bug where Kubeshark stopped processing traffic when
Workers restarted (#1760).
- Added an option to configure secrets to be read from
environment variables, enabling the use of external secret
managers for storing items such as licenses or SAML/OIDC
secrets.
- Updated Chart.yaml to use the full semantic version, ensuring
the Helm chart is semver compliant (#1752).
- Improved calculations for throughput, bandwidth, and latency
in the service map.
* Tue Jun 03 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.7.5 (52.7.4 does not exist):
* :bookmark: Bump the Helm chart version to 52.7.5
* Set tap.docker.tag to minor version of release (#1761)
* Tue Jun 03 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.7.3 (52.7.1 and 52.7.2 do not exist):
* Bump the Helm chart version to 52.7.3
* disabled sctp by default as it is part of debug protocols.
* disable watchdog by default (#1759)
* eBPF capture didn't work in case of persistent storage (#1757)
* Add secret names to inject env variables from (#1756)
* Use full semver version in Chart.yaml (#1754)
* Incerased storage limit from 500Mi to 5Gi (#1755)
* Add kubeshark_dropped_chunks_total metric description (#1753)
* Fri Apr 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 52.7.0:
* Release Highlights
This update adds new Helm options, improves GitOps
compatibility, and enhances traffic capture with AF_PACKET. It
also fixes bugs related to CLI exit, packet loss, Kafka
crashes, and watchdog stability.
Keywords: AF_PACKET, BPF, Dex, PVC, Kafka, Packet loss, Scripts
* Bug Fixes & New Features
- Added support for tapping network interface traffic using
AF_PACKET. This can be configured by entering a BPF
expression (e.g., net 0.0.0.0/0) in the BPF OVERRIDE field in
the Settings dialog. Useful when expected traffic is not
being captured.
- Added the Helm value tap.dashboard.completeStreamingEnabled,
which sets the default mode for full (with payload) or
partial (without payload) processing. This option can also be
controlled from the dashboard.
- Added the Helm value tap.auth.dexOidc.bypassSslCaCheck, which
allows communication with a Dex IdP using an unknown SSL
Certificate Authority, preventing SSL CA-related errors.
- Added support for azure-csi-premium for RWX PVC volumes
(https://github.com/kubernetes-sigs/azuredisk-csi-driver/tree/master/deploy/example/sharedisk).
- Disabled the online chat option by default.
- Added support for a GitOps-friendly mode where dynamically
changed configmap and secret values are preserved during Helm
upgrades, avoiding CI/CD system overrides while Kubeshark is
running.
- Enabled the kubeshark CLI to use a proprietary configuration
file.
- Fixed a protocol matcher bug caused by packet loss (#1746).
- Fixed a panic that occasionally occurred in the Kafka
dissector.
- Fixed a bug where the watchdog function could crash the
Worker when no traffic was being processed on the node.
- Fixed a bug in the kubeshark scripts command where it didn't
exit properly upon receiving ^C.
* Tue Mar 25 2025 opensuse_buildservice@ojkastl.de
- Update to version 52.6.0:
In this release, we fixed several bugs and added notable
integrations. Highlights include support for OIDC with DEX and
the ability to host Kubeshark behind a reverse proxy using a
custom path.
* Bug Fixes & New Features
- Optimized service map performance for large clusters
(thousands of pods and above).
- Improved SCTP reassembler support.
- Fixed a bug related to LDAP protocol dissection.
- Added OIDC with DEX integration for SSO authentication.
Read more in our OIDC with DEX section.
https://docs.kubeshark.co/en/oidc
- Introduced a watchdog mechanism that terminates the Worker if
it deems it non-functional. This feature is enabled by
default and can be disabled using the Helm value: --set
tap.watchdog.enabled=false
- Added support for hosting Kubeshark behind a reverse proxy
with a custom path.
Read more in our Reverse Proxy with a Custom Path section.
https://docs.kubeshark.co/en/custom_path
* Sun Mar 02 2025 opensuse_buildservice@ojkastl.de
- Update to version 52.5.0:
* :bookmark: Bump the Helm chart version to 52.5.0
* Update structs and docs (#1710)
* :wrench: Add `aiAssistantEnabled` helm value (#1717)
* :wrench: Enable BPF-override on `tap.packetCapture: af_packet`
(#1712)
* Update name of merged file (#1716)
* Add `demoModeEnabled` helm value (#1714)
* finished templating `tap.mountBpf` option. (#1711)
* Tue Feb 11 2025 opensuse_buildservice@ojkastl.de
- Update to version 52.4.2:
A quick patch release for the v52.4 minor branch.
* Fixed Websocket related panic that was due to an oversized
message size (#1713).
* Removed some redundant warnings from the Workers' logs.
* Optimized Workers CPU consumption.
* Added KFL selectors the the legend components int he legend
section in the Service Map.
* Fri Feb 07 2025 opensuse_buildservice@ojkastl.de
- Update to version 52.4.0:
* :bookmark: Bump the Helm chart version to 52.4.0
* Worker component security context refactoring (#1707)
* Remove init container; remove -disable-ebpf option (#1706)
* Readme updated (#1705)
* Fix pull secret aligning (#1703)
* Refactor and simplify pcapdump logic (#1701)
* Add `PortMapping` to `TapConfig` for port number based
dissector prioritization (#1700)
* Automatic patch updates
* Moving to eBPF as a default packet capture method. Making
default packet capture method eBPF, defaulting to AF_PACKET in
case eBPF is not available
* Sat Jan 25 2025 opensuse_buildservice@ojkastl.de
- Update to version 52.3.96:
* :bookmark: Bump the Helm chart version to 52.3.96
* Changed two errors to warnings.
* Add dns config (#1698)
* add diameter protocol support (#1696)
* Make node selector component specific (#1694)
* added `-disable-tracer` option (#1695)
* #528 Remove pcap src from configMap (#1693)
* Add helm variable to disable live config-map user actions
(#1689)
* Fix error on getting namespaces for pcap target files (#1691)
* Fix err when using dest arg (#1688)
* Sat Jan 11 2025 opensuse_buildservice@ojkastl.de
- Update to version 52.3.95:
* :bookmark: Bump the Helm chart version to 52.3.95
* Update worker liveness/readiness config (#1684)
* support new radius protocol (#1682)
* updated the notes (#1681)
* Sat Jan 04 2025 opensuse_buildservice@ojkastl.de
- Update to version 52.3.94 (52.3.93 was yanked):
* :sparkles: Update the Helm chart
* :bookmark: Bump the Helm chart version to 52.3.93
* extended the https macro to include http2 in addition to http
* added https as a default macro (#1680)
* Add `CUSTOM_MACROS` to `ConfigMap` (#1674)
* Revert "Revert "Initialize kubeshark pinned eBPF resources
inside init container (#1665)" (#1676)" (#1678)
* Add save/activate/delete role scripting permissions (#1675)
* Revert "Initialize kubeshark pinned eBPF resources inside init
container (#1665)" (#1676)
* Added security capabilities, especially IPC_LOCK (#1671)
* Revert "Add `CUSTOM_MACROS` to `ConfigMap`"
* Add `CUSTOM_MACROS` to `ConfigMap`
* Initialize kubeshark pinned eBPF resources inside init
container (#1665)
* Replace sniffer 30001 port with 48999 (#1670)
* Add hub metrics port (#1666)
* removed the loglevel flag (#1669)
* Create save/activate/delete role scripting permissions
(#1667)
* Add --time param to pcapdump (#1664)
* from debug to logLevel (#1668)
* Tue Dec 10 2024 opensuse_buildservice@ojkastl.de
- Update to version 52.3.92:
* :bookmark: Bump the Helm chart version to 52.3.92
* change the tlx dissector name to tlsx (#1648)
* Added LDAP support (#1647)
* Default startup values change (#1646)
* fixed a bug where a new script can't be added if (#1645)
* Add permissions to watch namespaces (#1644)
* Mon Dec 02 2024 opensuse_buildservice@ojkastl.de
- Update to version 52.3.91:
* :bookmark: Bump the Helm chart version to 52.3.91
* fixed a small issues in the Makefile
* Wed Nov 20 2024 opensuse_buildservice@ojkastl.de
- Update to version 52.3.90:
* Bump the Helm chart version to 52.3.90
* updated `pcapdump` command's help starting deprecated the
`export` command
* Brought back `.gitignore`` after having been deleted due to a
bad commit.
* removed two binary files uploaded due to a bad earlier commit.
* Fixed a bug in the Makefile
* Tue Nov 12 2024 opensuse_buildservice@ojkastl.de
- Update to version 52.3.89:
* :bookmark: Bump the Helm chart version to 52.3.89
* if no scripting source folders, that's not an error
* Remove pfring leftovers from ds (#1642)
* Fix frontend port (#1641)
* Added an option to provide multiple script sources. (#1640)
* Remove PF_RING references (#1638)
* Watch cm creation and sync scripts (#1637)
* Fix helm resource requests/limits templates (#1639)
* Sun Nov 03 2024 opensuse_buildservice@ojkastl.de
- Update to version 52.3.88:
* :bookmark: Bump the Helm chart version to 52.3.88
* missing commit
* Improved resource limits and requests Helm templating
* Added an ability to override image names for a case, where when
using a CI, one needs to use individual image names (#1636)
* Thu Oct 31 2024 opensuse_buildservice@ojkastl.de
- Update to version 52.3.87:
* :bookmark: Bump the Helm chart version to 52.3.87
* Wed Oct 30 2024 opensuse_buildservice@ojkastl.de
- Update to version 52.3.86:
* removed debug comments
* :bookmark: Bump the Helm chart version to 52.3.86
* Revert "Set resource guard to true by default."
* Wed Oct 30 2024 opensuse_buildservice@ojkastl.de
- Update to version 52.3.85:
* :bookmark: Bump the Helm chart version to 52.3.85
* fixed an issue that was added for debugging purposes
* Set resource guard to true by default.
* When compiling helm values from golang config structs, ignore
local ~/.kubeshark/config.yaml file if one exists
* Fixed the double action for commands: console and scripts, when
running the proxyRunner
* Revert "🐛 Prevent `hub` host-not-found nginx upstream error in
`front` (#1628)" (#1633)
* Removed the `timestamp>now()` fro the `globalFilter` flag.
* remove `tcp` and `udp` dissectors by default
* changed `tap.stopped` to `false` by default
* scripting improvements
* Add networkpolicies permissions (#1631)
* Fri Oct 18 2024 opensuse_buildservice@ojkastl.de
- Update to version 52.3.84:
* added timestamp>now() as a global filter
* set `disableTlsLog` to `true` by default.
* Hub default limit set to 5GB (an arbitrary number)
* show filter presets by default
* change CPU limit to no limit Change memory limit to 3Gi
* scripting-revamp-1 (#1630)
* Prevent `hub` host-not-found nginx upstream error in `front`
(#1628)
* fix lint issue
* Added log lines for verbosity
* Added the scripting `console` command functionality to the
`tap` command Added both the `scripting` and `console` commands
to the `proxy` command Added a `scripting.console`, a boolean
value indicating whether the `console` functionality should be
part of the `tap` and `proxy` commands
* Improved the `console` command made it resilient to Websocket
breaks and redeployment.
* Fri Oct 11 2024 opensuse_buildservice@ojkastl.de
- Update to version 52.3.83:
* :bookmark: Bump the Helm chart version to 52.3.83
* :bookmark: Bump the Helm chart version to 72.3.83
* Added some error and info log lines
* Add `tap.presetFiltersChangingEnabled` helm value (#1627)
* Set reasonable `pcapdump` defaults. Storage is now at 10% of
the Worker's allocated storage.
* Tag Tracer as well as the other components upon a new release
* Ensure `scripting` command watched only JS files
* Feat pcapsaver (#1621)
* emit tls item (#1625)
* Update README with resource guard configuration (#1623)
* Add resource guard flag (#1622)
* Regenerate `values.yaml` and `complete.yaml`
* Do not enable `-unixsocket` flag of worker if no tracer is
running (#1619)
* Fixed a bug in the `console` command, where the CLI couldn't
connect to Hub as when the `url.URL` method was used, the Host
included a path
* Add list permissions for kubeshark service account (#1617)
* Add `udp` to list of enabled dissectors (#1616)
* Make the `scritps` command directly use the K8s API without
requiring a connector to Hub (#1615)
* Print instructions for running `kubectl port-forward` command
in case of failure (#1614)
* propagate host root to the tracer (#1613)
* Fix `-staletimeout` worker command value (#1611)
* Template the `-staletimeout` flag (#1610)
* updated Grafana dahsboard
* text change
* text changes
* Mon Sep 23 2024 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- new package kubeshark-cli: CLI for the API traffic analyzer for
Kubernetes
/usr/share/bash-completion/completions/kubeshark
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Aug 2 03:14:27 2026