kubeshark

Kubeshark Security Hardening Guide

Least-privilege permissions

• Limit who can access kubeshark: Only authorized security and DevOps staff should be able to view traffic data or run queries. Prevent developers and AI agents from accessing raw network captures without approval.
• Restrict AI agent queries: Set strict rules on what types of questions AI agents can ask kubeshark—block requests that try to extract credentials, reconstruct messages, or access traffic from sensitive systems.
• Use read-only access for humans: Give security teams permission to view dashboards but prevent them from reconfiguring kubeshark or changing which traffic gets captured.
• Audit who runs kubeshark: Run kubeshark under a dedicated service account and log all access attempts, query results, and configuration changes.

Network isolation

• Isolate the kubeshark dashboard: Do not expose the kubeshark web interface to the internet or untrusted networks; only allow internal corporate VPN or direct cluster access.
• Encrypt all traffic to kubeshark: Use TLS/HTTPS to encrypt connections between users, AI agents, and the kubeshark interface so captured data cannot be intercepted in transit.
• Separate sensitive workloads: Run critical services (databases, payment systems, identity providers) on dedicated nodes and use network policies to prevent kubeshark from capturing their traffic—or exclude them entirely from observation.
• Restrict MCP connections: Only allow kubeshark's AI agent interface (MCP connector) to accept queries from approved, internal AI systems; block external or untrusted AI agents.

Monitoring

• Log all queries: Record what data every user and AI agent requests from kubeshark; flag unusual patterns like bulk credential lookups or repeated queries to sensitive services.
• Alert on sensitive data access: Set up automatic warnings if kubeshark captures or serves credentials, API keys, or payment card data; investigate immediately.
• Track decrypted TLS content: Monitor where decrypted traffic is stored and how long it is kept; ensure data is deleted after the retention period and not backed up to unauthorized locations.
• Audit configuration drift: Verify weekly that kubeshark's capture rules and permissions have not changed unexpectedly; use version control for all configuration changes.

Red flags to watch for

• Unencrypted credentials in captured traffic: If kubeshark shows passwords or API keys in plaintext, immediately enforce application-level encryption and require all services to stop sending secrets over the network.
• AI agents requesting unusual data patterns: If an AI agent tries to reconstruct full application conversations, exfiltrate traffic from multiple services, or bypass query restrictions, isolate and investigate the AI system.
• Kubeshark storing decrypted data indefinitely: If decrypted TLS payloads are found in logs, databases, or backups beyond the intended retention window, investigate the storage backend and apply immediate data retention policies.
• Privilege escalation attempts: If the kubeshark process or any user tries to modify kernel settings, escalate permissions, or access other cluster data outside its scope, treat as a security incident and audit the entire system.