kfl

Build Kubeshark traffic filters with KFL2 syntax and CEL expressions.

12.0k|544|Updated Apr 19, 2021
One-click install
npx skills add https://github.com/kubeshark/kubeshark --skill kfl
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: kfl
Source: https://github.com/kubeshark/kubeshark/tree/main/skills/kfl
Command: npx skills add https://github.com/kubeshark/kubeshark --skill kfl

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill provides a reference and safety guidance for Kubeshark Filter Language (KFL2), ensuring users construct correct, statically typed filters before querying traffic.

Core Features & Use Cases

  • Comprehensive KFL2 syntax, operators, and functions based on Google's CEL, enabling precise, efficient traffic filtering.
  • Kubernetes and protocol-aware filtering support with core variables and flags (http, dns, tls, etc.), plus step-by-step usage for common investigations.
  • Quick access to the complete variable reference in references/kfl2-reference.md for advanced users.

Quick Start

Load the KFL skill before writing or evaluating any KFL expressions to ensure correct syntax and safe typing.

Frequently Asked Questions about kfl

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I filter Kubernetes traffic by HTTP protocol in Kubeshark?

You can filter Kubernetes traffic by HTTP in Kubeshark by loading the KFL skill to access KFL2 syntax, then constructing a statically typed expression using the http protocol flag and Kubernetes context variables.

What is the Kubeshark Filter Language and how does it work?

Kubeshark Filter Language (KFL2) is a query language based on Google's CEL that provides a precise, safe way to build traffic filters using statically typed expressions, protocol flags, and Kubernetes context variables.

Can I use CEL expressions to query DNS traffic in Kubernetes?

Yes, you can use CEL-based KFL2 expressions to query DNS traffic in Kubernetes by utilizing the dns protocol flag and Kubernetes context variables provided in the KFL skill's syntax reference.

How do I build a statically typed traffic filter query?

To build a statically typed traffic filter query, load the KFL skill before writing expressions to ensure correct KFL2 syntax. This provides the complete variable reference needed to safely evaluate Kubernetes and protocol-aware filters.

Does Kubeshark filter language support TLS protocol detection?

Yes, Kubeshark filter language supports TLS protocol detection through dedicated tls protocol flags. KFL2 includes core variables for tls, http, and dns, allowing you to construct precise, statically typed filters for encrypted traffic.

Why do I need to load a reference before writing KFL2 expressions?

You need to load the KFL reference before writing KFL2 expressions because it enforces static typing and provides the complete syntax and variable reference. Loading it first ensures you construct correct, safe filters before querying traffic.