retina

Retina is an open-source Kubernetes network observability platform developed by Microsoft. It uses eBPF to collect customizable telemetry from cluster workloads, providing a centralized hub for monitoring application health, network health, and security. The tool targets cluster network administrators, security administrators, and DevOps engineers working on DevOps, SecOps, and compliance use cases. Key capabilities include eBPF-based network observability for Kubernetes workloads, on-demand and configurable data collection, industry-standard Prometheus metrics, and streamlined packet captures for deep-dive investigations. Retina is cloud-agnostic and supports multiple operating systems including Linux, Windows Server 2022, and Azure Linux. Retina offers two major features: Metrics and Captures. Metrics can be exported to storage backends such as Prometheus and Azure Monitor, then visualized with tools like Grafana and Azure Log Analytics. Captures can be initiated through a CLI (installable via Krew) or through Kubernetes Custom Resource Definitions (CRDs). The project is distributed as a Helm chart from GHCR, with cryptographically signed container images verifiable via sigstore/cosign. Known limitations include performance considerations on nodes with 32+ CPU cores under high network load when using Advanced metrics with the packetparser plugin, and the removal of Windows Server 2019 node support in favor of Windows Server 2022.