Techniques are disclosed for capturing network traffic in a distributed computing environment comprising a plurality of computing devices executing a plurality of Kubernetes pods. A customer resource definition defines one or more capture filters. Based on the capture filters, a configuration map object specifying data packets to be captured is generated. Capture sidecars are injected at the Kubernetes pods. At each Kubernetes pod the configuration map object is read and a capture of the specified data packets is initiated.