Observing the network with Hubble

1. Hubble in brief #

Cilium's observability layer.

Architecture #

Cilium is an eBPF-based Kubernetes CNI. Since it sees every packet, it can also produce flows: who talks to whom, on which port, with which verdict (forwarded, dropped), and for HTTP, DNS or Kafka, the details of the request. Hubble exposes these flows.

2. Installing and observing #

The cilium and hubble CLIs.

Enabling #

cilium install
cilium status --wait
cilium hubble enable --ui
cilium hubble port-forward &      # Relay sur localhost:4245
hubble status

# ou avec Helm
helm upgrade cilium cilium/cilium -n kube-system --reuse-values \
  --set hubble.relay.enabled=true --set hubble.ui.enabled=true \
  --set hubble.metrics.enabled="{dns,drop,tcp,flow,port-distribution,httpV2}" 

hubble observe #

hubble observe --namespace boutique --follow
hubble observe --verdict DROPPED                      # paquets rejetés (network policies)
hubble observe --protocol dns --namespace boutique    # requêtes DNS
hubble observe --to-pod boutique/checkout --protocol http
hubble observe --from-label app=front -o json | jq '.flow.destination'

Good practice: hubble observe --verdict DROPPED is the first reflex when « service A can no longer reach service B » after adding a NetworkPolicy.

3. Interface and metrics #

Visualizing and alerting.

Hubble UI #

cilium hubble ui opens a map of a namespace's services, built from real flows, with the list of flows and their verdicts. Ideal for discovering the dependencies of an unfamiliar application.

Prometheus metrics #

- alert: PolicyDrops
  expr: sum by (reason) (rate(hubble_drop_total{reason="POLICY_DENIED"}[5m])) > 1
  for: 10m
  labels: { severity: warning }