Cilium: Up and Running

Chapter 15. Observability with Hubble

Hubble is built on top of Cilium and eBPF, providing deep visibility into how applications communicate and behave. It focuses primarily on networking observability, helping operators understand dependencies between services and identify performance or security issues.

What makes Hubble particularly valuable is that it provides visibility not only at layers 3 and 4, where most flow tools operate, but also at layer 7. This means it can reveal application-level information such as HTTP methods or DNS queries, giving you a more complete picture of traffic behavior. Hubble also surfaces security-related context, such as blocked connections and the policies that caused them, allowing you to refine network policies based on observed flows.

All of this happens transparently, without requiring any modification to the applications themselves. In addition to live flow visibility, Hubble exposes Prometheus metrics, enabling integration with common observability tools such as Prometheus and Grafana for monitoring and alerting.

Hubble Architecture

Before we start using Hubble, it is worth taking a moment to understand how its main components fit together. Hubble collects information by tapping into Cilium’s eBPF datapath. A Hubble agent runs on every node as part of the Cilium DaemonSet; it is not a separate pod. Each agent reports flow data from its own node only, which means querying a single agent provides a limited view of cluster-wide activity.