Getting started with Kubeshark is easy. You only need to download the CLI and run it.

The CLI communicates directly with Kubernetes API to deploy the right containers at the right place at the right time.

We recommend choosing the right binary to download directly from the latest release.

Alternatively you can use a shell script to download the right binary for your operating system and CPU architecture:

sh <(curl -Ls


Homebrew users can add Kubeshark formulae with:

brew tap kubeshark/kubeshark

and install Kubeshark CLI with:

brew install kubeshark


Here are a few examples how you can use the Kubeshark CLI to start capturing traffic in your Kubernetes cluster:

kubeshark tap
kubeshark tap -A
kubeshark tap -n sock-shop "(catalo*|front-end*)"

For more options on how to use the CLI, refer to the Pods & Namespaces page.

Once you run the CLI, a browser window will open at localhost:8899 by default.

Kubeshark UI

Clean Up

To clean up a Kubeshark deployment from your cluster, simply run:

kubeshark clean

Only A Certain Namespace

By default, the Kubeshark clean command removes any Kubeshark deployments cluster-wide. To clean up only a certain namespace:

kubeshark clean -n sock-shop