[opensourcedex]

retina is a free, open source monitoring & observability project written in Go and released under MIT. It has 3,184 GitHub stars, 308 forks and 190 open issues, and was last pushed 9 hours ago. On this registry it ranks #133 of 270 tracked projects in Monitoring & Observability, with 5 head-to-head comparisons available. It gained 8 stars over the last 30 tracked days.

What is retina?

Retina is a cloud-agnostic, open-source, eBPF-based network observability platform for Kubernetes, built for cluster network administrators, cluster security administrators, and DevOps engineers who need a centralized hub for monitoring application health, network health, and security.

What it is

Retina is a Kubernetes network observability platform written in Go and released under the MIT licence. It uses eBPF to collect customizable telemetry from Kubernetes workloads and presents itself as a centralized hub for application health, network health, and security monitoring. The project lives in the Microsoft GitHub organization, ships from ghcr.io as the Helm chart oci://ghcr.io/microsoft/retina/charts/retina, and publishes its documentation at retina.sh. It is cloud-agnostic and supports Linux, Windows Server 2022, and Azure Linux nodes.

The concrete problem it solves is fragmented network investigation. Instead of assembling separate per-node tracing and metrics tooling and correlating the results by hand, operators get two capabilities from one platform: Metrics for continuous cluster monitoring and Captures for on-demand deep dives. Retina answers the DevOps, SecOps, and compliance questions that arise when a Kubernetes network misbehaves, and it exports its telemetry to storage backends such as Prometheus and Azure Monitor and to visualization layers such as Grafana and Azure Log Analytics, so the data lands in tooling teams already run rather than in a Retina-only silo.

Key capabilities

  • eBPF-based network observability for Kubernetes workloads, producing actionable, industry-standard Prometheus metrics.
  • Two major feature areas: Metrics and Captures.
  • Configurable, on-demand telemetry collection rather than a fixed, always-on sampling profile.
  • Streamlined packet captures for deep dives into specific network events.
  • Linux plugin selection at install time through enabledPlugin_linux, with values such as dropreason, packetforward, linuxutil, and dns.
  • Cloud-agnostic execution across Linux, Windows Server 2022, and Azure Linux.
  • A kubectl-retina CLI exposing capture, config, shell (experimental), trace, and version commands.

Who uses it and how

  • Cluster network administrators investigating connectivity incidents use the capture command to pull packet captures from a node or pod on demand.
  • Cluster security administrators and compliance owners consume Retina's exported telemetry for SecOps and audit workflows.
  • DevOps engineers run the Metrics side continuously, forwarding Prometheus metrics into Grafana or Azure Log Analytics dashboards.
  • Mixed-OS fleets use one platform across Linux, Windows Server 2022, and Azure Linux nodes.
  • Large node types use the Basic metrics mode instead of Advanced metrics, since the packetparser plugin has reported performance considerations on nodes with 32 or more CPU cores under high network load.

Getting started

Install the Helm chart directly from GHCR with helm upgrade --install retina oci://ghcr.io/microsoft/retina/charts/retina, setting the chart version and image tags as needed. The CLI installs through Krew with kubectl krew install retina, and the Prometheus and Grafana setup steps are documented at retina.sh.

How it compares

The facts name no paid products that Retina replaces, and no direct peer tool in this registry, so Retina stands alone here in the Infrastructure and Operations / Monitoring and Observability category. Prometheus, Grafana, Azure Monitor, and Azure Log Analytics appear as export targets rather than alternatives. Unlike a proprietary monitoring agent, Retina is MIT-licensed, distributed publicly through GHCR, and keeps collected telemetry under the operator's own storage choices.

When to use it — and when not

A self-hoster must operate a Kubernetes cluster plus the storage and visualization stack that consumes Retina's output, such as Prometheus and Grafana, and keep the Helm release and CLI updated. Do not pick Retina for Windows Server 2019 nodes, which it no longer supports, and be cautious with Advanced metrics on 32-plus-core nodes under high network load where Basic metrics mode is the safer start. With 190 open issues, the project is actively evolving rather than settled.

project readme (upstream, from github) — read inline

Open in GitHub Codespaces

goreport GitHub release retina-publish license

retina-test retinash retina-publish retina-codeql-img retina-golangci-lint-img

Overview

Retina is a cloud-agnostic, open-source Kubernetes network observability platform that provides a centralized hub for monitoring application health, network health, and security. It provides actionable insights to cluster network administrators, cluster security administrators, and DevOps engineers navigating DevOps, SecOps, and compliance use cases.

Retina collects customizable telemetry, which can be exported to multiple storage options (such as Prometheus, Azure Monitor, and other vendors) and visualized in a variety of ways (like Grafana, Azure Log Analytics, and other vendors).

Features

  • eBPF-based Network Observability platform for Kubernetes workloads.
  • On-Demand and Configurable.
  • Actionable, industry-standard Prometheus metrics.
  • Streamlined Packet Captures for deep dives.
  • Cloud-agnostic, supporting multiple OS (like Linux, Windows, Azure Linux).

Why Retina?

Retina lets you investigate network issues on-demand and continuously monitor your clusters. For scenarios where Retina shines, see the intro docs here

Documentation

See retina.sh for documentation and examples.

Known Limitations

⚠️ Performance on High-Core-Count Systems: Community users have reported performance considerations when using Advanced metrics (with packetparser plugin) on nodes with 32+ CPU cores under high network load. Consider starting with Basic metrics mode on large node types. See Known Limitations for details.

⚠️ Windows Server 2019: Retina no longer supports Windows Server 2019 nodes. Use Windows Server 2022 for Windows workloads.

Capabilities

Retina has two major features:

Metrics Quick Install Guide

Retina can be installed using the Helm chart from GHCR:

# Set the version to a specific version here or get latest version from GitHub API.
VERSION=$( curl -sL https://api.github.com/repos/microsoft/retina/releases/latest | jq -r .name)
helm upgrade --install retina oci://ghcr.io/microsoft/retina/charts/retina \
    --version $VERSION \
    --set image.tag=$VERSION \
    --set operator.tag=$VERSION \
    --set logLevel=info \
    --set enabledPlugin_linux="\[dropreason\,packetforward\,linuxutil\,dns\]"

Set the version and image tag arguments to the desired version, if different.

After Helm install, follow the steps for setting up Prometheus and Grafana to configure metrics collection and visualization.

Captures Quick Start Guide

Captures via CLI

The preferred way to install the Retina CLI using Krew.

kubectl krew install retina

Other installation options are documented in CLI Installation.

Verify installation:

$ kubectl retina
Retina is an eBPF distributed networking observability tool for Kubernetes.

Usage:
  kubectl-retina [command]

Available Commands:
  capture     Capture network traffic
  completion  Generate the autocompletion script for the specified shell
  config      Configure retina CLI
  help        Help about any command
  shell       [EXPERIMENTAL] Interactively debug a node or pod
  trace       Retrieve status or results from Retina
  version     Show version

Flags:
  -h, --help   help for kubectl-retina

Use "kubectl-retina [command] --help" for more information about a command.

To quickly start creating a capture:

kubectl retina capture create --pod-selectors <app=my-app>

For further CLI documentation, see Capture with Retina CLI.

Captures via CRD

Install Retina using Helm:

VERSION=$( curl -sL https://api.github.com/repos/microsoft/retina/releases/latest | jq -r .name)
helm upgrade --install retina oci://ghcr.io/microsoft/retina/charts/retina \
    --version $VERSION \
    --set image.tag=$VERSION \
    --set operator.tag=$VERSION \
    --set image.pullPolicy=Always \
    --set logLevel=info \
    --set os.windows=true \
    --set operator.enabled=true \
    --set operator.enableRetinaEndpoint=true \
    --skip-crds \
    --set enabledPlugin_linux="\[dropreason\,packetforward\,linuxutil\,dns\,packetparser\]"

Then follow steps in Capture CRD for documentation of the CRD and examples for setting up Captures.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit .

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Read more about how to begin contributing here.

Verify signed images

Retina images published to GHCR are cryptographically signed. You can verify their provenance with sigstore/cosign:

REPO=microsoft/retina # or your repo
IMAGE=retina-operator # or other image to verify
# This can be replaced with another tag to verify, or with the image SHA256
LATEST_TAG=$(curl -s https://api.github.com/repos/microsoft/retina/releases | jq -r '.[0].name')
cosign verify ghcr.io/$REPO/$IMAGE:$LATEST_TAG --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp="https://github.com/$REPO" -o text

Office Hours and Community Meetings

We host a periodic open community meeting. Find the details here.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

License

See the LICENSE.

Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Contact

For bugs or feature requests, open an issue. For security or vulnerability concerns, see SECURITY.md. For other communication, contact the maintainers at .

Frequently asked questions

Is retina free to use?

retina is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does retina do?

eBPF distributed networking observability tool for Kubernetes

What is retina written in?

retina is primarily written in Go. Its source is publicly available at https://github.com/microsoft/retina, and it has 3,184 GitHub stars.