Wondering about your Kubernetes cluster’s network communications? This tool helps you see and analyse all related TCP traffic.

k8spacket collects TCP traffic and TLS connection metadata using eBPF and visualises it via Grafana. Here’s how it works and what it offers:
- It launches as a DaemonSet, which listens to network interfaces on all Kubernetes nodes.
- It checks every 10s (default) to see any changes in the network interfaces.
- eBPF is used to get information about TCP connections inside the cluster and collect information about the TLS handshake process.
- It can display graphs in Grafana and expose Prometheus metrics.
- Visualisation has different types of stats (connections’ number and lifetime, sent/received bytes) and supports filtering (by K8s namespaces, included/excluded workload names).

You can install k8spacket via a Helm chart. To run its latest, fully-eBPF-based versions (v2.x.x), you’ll need a Linux kernel v5.8+.

▶️ GitHub repo: https://github.com/k8spacket/k8spacket

#tools #networking

Struggling with network policies in Kubernetes? This tool helps manage them using CLI or Web UI.

netfetch aims to “demystify network policies” in Kubernetes. To do so, it scans your cluster, visualises the network, and helps you improve the network policies. Here are its main features:

- Command-line (CLI) and dashboard (Web UI) interfaces, which vary a bit in their functionality.
- Scan a cluster, detect the Pods without network policies, and evaluate a security score.
- Build an interactive network map or save scan output as a text file.
- Improve network policies by creating default deny rules and suggesting new network policies for existing workloads.
- Network policy editing and previewing in Web UI.
- Written in Go and Vue. Installable via Helm, Homebrew (for Mac), or binaries.

▶️ GitHub repo

#tools #networking #security

Using Gateway API in your Kubernetes clusters? This CLI tool is very helpful in managing your resources.

gwctl is an experimental feature of the Gateway API project that provides an official way of working with relevant resources. Here’s what it offers today:

- Viewing, creating, and deleting Gateway API resources;
- Getting more detailed information about resources, including related resources, policies, and potential problems;
- Analysing resources before creating them;
- Visualising connections between your Gateway API resources using DOT graph representations.

Language: Go | License: Apache 2 | 39 ⭐️

▶️ GitHub repo

#tools #networking

Don’t fancy endless kubectl port-forward commands and manual reconnections when your Pod dies? This nice GUI is to the rescue!

kftray is a tool for simplifying Kubernetes port-forwarding settings. It interacts with the Kubernetes API directly (not relying on kubectl) and offers two interfaces: desktop (kftray) and terminal (kftui). Its features include:

- Simple (“one-click”) configuration for several port-forwarding instances;
- Access to internal or external servers using the kftray’s proxy relay server deployed in your Kubernetes cluster, with TCP and UDP port forwarding support;
- Automatic reconnection to the Pod when it dies;
- Desktop app-only features: HTTP logs support and storing your configurations on GitHub.

Language: Rust | License: GPL 3 | 877 ⭐️

▶️ GitHub repo
📢 Reddit announcement

#tools #networking #gui

InGate is a new project developed within the Kubernetes SIG to replace a well-known Ingress NGINX Controller for Kubernetes (ingress-nginx).

As its official description says, InGate is “an Ingress and Gateway API Controller for Kubernetes.” The idea is to have a traditional ingress controller that provides more flexibility in traffic routing, load balancing, etc., thanks to the Gateway API implementation under the hood. At the same time, it should not be difficult for those using ingress-nginx to adapt.

You can learn more about this project from the “Securing the Future of Ingress-Nginx” talk (starting from 13:13) presented by James Strong, Isovalent & Marco Ebert, Giant Swarm during KubeCon NA 2024.

P.S. Thanks to Trenton VanderWert for bringing this news to our attention.

#news #networking

Have you heard of kgateway? 🤔

It’s a new name for the Gloo Gateway Open Source project. Gloo Gateway is a flexible Kubernetes-native ingress controller and API gateway built on top of Envoy proxy and the Kubernetes Gateway API. Solo.io, the company behind it, decided to make it an independent project by introducing vendor-neutral governance, renaming it, and donating to CNCF.

Find more details about kgateway and its future in the CNCF blog, related CNCF Sandbox application request, and new GitHub repo.

#news #tools #networking #cncfprojects

Kong Gateway is a Cloud Native, platform-agnostic, scalable API Gateway. Its recent 3.10.x release introduced the following breaking change: “Free mode is no longer available. Running Kong Gateway without a license will now behave the same as running it with an expired license.”

In response to this news, Tetrate Labs promptly released kong2eg, “a migration tool that helps you transition from Kong Gateway to Envoy Gateway by integrating Kong as an external processing extension within Envoy Gateway.”

#news #networking #tools

Why not have a Kubernetes Ingress controller written in Rust? This new project makes this idea easy to try out.

Aralez is a high-performance reverse proxy built on top of Cloudflare's Pingora, a Rust framework for fast and programmable network services. It can operate as an Ingress controller for Kubernetes and offers:

- Zero-config support for gRPC and WebSocket;
- Dynamic load of upstreams and SSL certificates;
- Various authentication methods: basic auth, API tokens, JWT;
- Load balancing based on round-robin, failover with health checks, and sticky sessions via cookies;
- Built-in rate limiter (global and per path);
- Built-in file server for serving static files;
- Prometheus metrics.

Language: Rust | License: Apache 2.0 | 460 ⭐️

▶️ GitHub repo
💬 Reddit announcement

#tools #networking

Ingress NGINX will be retired soon

Another significant announcement made during KubeCon NA involved deprecation. Kubernetes SIG Network and the Security Response Committee declared that Ingress NGINX will be retired in March 2026.

This Ingress controller was developed a long time ago as an example implementation of the API. However, its broad adoption and excess flexibility (e.g., "snippets" annotations) became “today’s insurmountable technical debt.” A recent attempt to replace it with InGate (we covered it in this post) failed, and the project became unsustainable, leading to a difficult decision to retire it.

Users are advised to migrate to Gateway API or another Ingress controller as fast as they can.

P.S. Don’t confuse Ingress NGINX with NGINX Ingress. There is a long-lasting naming confusion for these projects.

#news #networking

This project has been around for a while, but it is especially useful now, given the upcoming retirement of the Ingress NGINX controller.

Ingress2gateway is part of the Gateway API SIG-Network subproject, focusing on translating Ingress and provider-specific CRDs to Gateway API resources. It supports Ingress NGINX and several other providers (including Apache APISIX, Cilium, Istio, GCE, Kong, NGINX Ingress, and OpenAPI).

However, it’s essential to note that it doesn’t support all the annotations available. The list of those supported for Ingress NGINX is available here.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 643 ⭐️

#tools #networking

Ingress NGINX retirement: helpful tools and resources

Tools and repos:
1. Ingress2gateway (we described it here before)
2. Gateway API Benchmarks lists and compares existing Gateway API implementations
3. Ingress Migration Kit is a new tool that generates Gateway API migration plans

Related posts and other activities from vendors, projects, and community:
1. Clarifications from a Gateway API maintainer
2. NGINX Inc (F5): blog post; live AMA with the NGINX team (December 10th and 11th); migration experience from a user
3. Isovalent / Cilium: blog post; migration experience from a user
4. Traefik: blog post; Ingress NGINX Migration tool from the company
5. HAProxy: blog post; migration assistance from the company
6. SUSE: blog post

#articles #tools #networking

New Kubernetes working group: AI Gateway

The “AI Gateway” term refers to network gateway infrastructure, such as proxy servers and load balancers, that implements the Gateway API specification with enhanced capabilities for AI workloads. The newly announced AI Gateway WG will create declarative APIs, standards, and guidance for AI workload networking in Kubernetes.

P.S. This announcement came shortly after disbanding the Kubernetes WG Serving.

#news #networking #aiml

AWS Load Balancer Controller now supports Gateway API

Previously, AWS Load Balancer Controller relied on Application Load Balancer and Network Load Balancer as Ingress and Service in Kubernetes environments. Now, you can also use the Gateway API.

P.S. According to this GitHub issue, Azure Kubernetes Service is also expected to introduce Gateway API support for App Routing in March. Google Cloud has been recommending using its Gateway API implementation in the GKE Gateway controller to expose apps in Kubernetes for a while.

#news #networking #aws

Ingress2gateway 1.0

The Kubernetes SIG Network just announced the stable version of its official assistant that helps migrate from the soon-to-be-retired Ingress NGINX controller to Gateway API.

With this new release, the tool supports 30+ widely used annotations, covering headers, timeouts, redirects, rewrites, regex, CORS, backend TLS, and IP range control.

Find more details from this announcement and on GitHub.

#news #releases #networking

The kubernetes/ingress-nginx repository has finally been archived. It happened right on the KubeCon stage just a couple of hours ago.

P.S. Previously, we covered the recent ingress2gateway v1.0 release and some other related tools.

#news #networking

Where do ingress-nginx users migrate?

According to a recent Reddit poll, Traefik and Envoy Gateway are the leading alternatives for those who previously relied on ingress-nginx in their production Kubernetes clusters. Other options (HAProxy, F5 NGINX, and Kong) got much fewer votes.

As for even more other solutions mentioned in the comments, Kgateway and specific Envoy implementations (namely, in Istio and Cilium) got the most upvotes.

#networking

k8gb v1.0.0

k8gb, a Kubernetes Global Balancer, originated at Absa Group. More than six years have passed since the first whiteboard session in Johannesburg, conducted by Yury Tsarev and Bradley Andersen, both employed by this company at the time. In 2021, k8gb was accepted into the CNCF Sandbox, and earlier this year, as we mentioned recently, it became a CNCF Incubating project.

Yesterday, right during its 100th community meeting, the k8gb maintainers pushed the v1.0.0 release. This update highlights a significant milestone in the project's maturity.

#releases #cncfprojects #networking