# Using Mitmproxy to Observe kubectl Traffic

DevFeed: [Using Mitmproxy to Observe kubectl Traffic](<https://devfeed.tech/articles/using-mitmproxy-to-observe-kubectl-traffic-10924.md>)

Original publisher: [Read original article](<https://blog.scottlowe.org/2026/03/04/using-mitmproxy-to-observe-kubectl-traffic/>)

Author: Scott Lowe

Published: 2026-03-04T22:30:00Z

Content type: tutorial

Language: en

Sources: [Scott's Weblog](<https://devfeed.tech/sources/scott-s-weblog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [kubectl](<https://devfeed.tech/topics/kubectl.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Ubuntu](<https://devfeed.tech/topics/ubuntu.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Network](<https://devfeed.tech/topics/network.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>)

Tags: [apt](<https://devfeed.tech/tags/apt.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [aws](<https://devfeed.tech/tags/aws.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [cilium](<https://devfeed.tech/tags/cilium.md>), [cli](<https://devfeed.tech/tags/cli.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cni](<https://devfeed.tech/tags/cni.md>), [commands](<https://devfeed.tech/tags/commands.md>), [containers](<https://devfeed.tech/tags/containers.md>), [cri-o](<https://devfeed.tech/tags/cri-o.md>), [devops](<https://devfeed.tech/tags/devops.md>), [docker](<https://devfeed.tech/tags/docker.md>), [go](<https://devfeed.tech/tags/go.md>), [iac](<https://devfeed.tech/tags/iac.md>), [k8s](<https://devfeed.tech/tags/k8s.md>), [kubectl](<https://devfeed.tech/tags/kubectl.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux](<https://devfeed.tech/tags/linux.md>), [macos](<https://devfeed.tech/tags/macos.md>), [networking](<https://devfeed.tech/tags/networking.md>), [oci](<https://devfeed.tech/tags/oci.md>), [security](<https://devfeed.tech/tags/security.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>), [ubuntu](<https://devfeed.tech/tags/ubuntu.md>)

## AI overview

This tutorial explains how to use mitmproxy to observe traffic between kubectl and the Kubernetes API Server. It describes the tested Linux and Ubuntu environment, notes that the commands should work similarly on macOS, and discusses extracting client certificates from a Kubeconfig file for certificate-based authentication.

## Source excerpt

When I first started learning Kubernetes, I had the idea that observing the network traffic between a client system using kubectl and the Kubernetes API Server would be a useful thing to do. The source of the idea is unclear; I am unsure why I thought this would be useful as a learning tool. Regardless, I continued on with learning Kubernetes and never really pursued this idea--until this week. I found it can be a useful troubleshooting technique, but I will leave it up to you to determine if it is a useful learning technique. In this post, I will show you how to observe kubectl traffic using mitmproxy. This technique is inspired by/informed by Ahmet Alp Balkan's similarly-named blog post from 2019. Unfortunately, I found the instructions there to be incomplete (most likely just due to the passage of time and continued evolution of the tools involved). I used the following tools and environments in my testing: The tests were conducted on a Linux system running Ubuntu 24.04.4. The commands should work similarly on macOS. Mitmproxy was installed from the Ubuntu repositories using apt. kubectl version 1.33.3 was used to communicate to a self-managed cluster on AWS (in other words, not Amazon EKS) running Kubernetes 1.32.9. The cluster was bootstrapped using kubeadm. I wouldn't expect any major/significant differences with other versions of kubectl or Kubernetes. I was using a client certificate to authenticate to Kubernetes. It's unclear to me how this might work--if it works at all--with alternate authentication mechanisms. Prepare Client Certificates Before you can start mitmproxy, you'll first need to extract the client certificates from the Kubeconfig file. A couple of ways exist to do this; a blog post of mine from 2022 contains what I believe is the easiest way. The method involves yq (to extract information from the Kubeconfig) and base64 (to decode the client certificate and client key). Refer to the linked blog post for full details. First, extract the client cer