What it does
Hubble is Cilium's network, service, and security observability layer for Kubernetes. Built on eBPF, it shows communication between workloads and the network infrastructure at node scope, with Hubble Relay extending visibility to a cluster or Cluster Mesh. Operators can query flows with the Hubble CLI and optionally enable a browser UI for the service dependency graph and filtered traffic. Hubble is a network-observation component in a Cilium-managed environment, not a hosted telemetry backend or a monitor for arbitrary standalone hosts.
Begin with the flows visible to one Cilium agent
Hubble reads network observations from Cilium agents. The setup guide assumes Cilium is already installed, then walks through enabling Hubble, installing the client, and validating API access. By default, the Hubble API is scoped to the node where that Cilium agent runs, so a direct CLI query starts with that node's traffic. The documented CLI filters help narrow a network-flow investigation to the workload or protocol in question.
Widen the view with Relay
Deploy Hubble Relay when the investigation needs cluster-wide visibility, or multi-cluster visibility in a Cilium Cluster Mesh. The same observations can then be queried through the CLI or shown in Hubble UI, whose service map can reveal dependencies and filter traffic at network and application layers. The setup guide notes that TCP port 4244 must be open on all Cilium nodes for Relay to operate.
Illustrative example, not a test: if one service reports timeouts, an operator could filter its source and destination flows, then compare the observed traffic with a denied flow or an unanswered request. That evidence can help distinguish network policy or connectivity problems from an application symptom, but the team still needs to diagnose and resolve the underlying issue.
Hubble's useful boundary is also its main constraint: it observes Kubernetes networking managed by Cilium. Teams need Cilium installed and Hubble enabled, and should add Relay when a local node view is too narrow. Hubble is an Apache-licensed open-source project; no separate hosted Hubble pricing was established in the sources checked.
Strengths
- Shows service communication and network behavior at node, cluster, and, with Cluster Mesh, multi-cluster scope.
- The optional Hubble UI visualizes service dependencies and lets operators filter observed flows.
- Its CLI and Hubble API provide a direct way to inspect flows rather than relying only on application logs.
Watch out for
- Hubble requires a correctly installed Cilium cluster with Hubble enabled; cluster-wide visibility also requires Relay and TCP port 4244 open on all nodes.
Best for
- Investigating Kubernetes service-to-service traffic when an application reports errors or timeouts.
- Visualizing dependencies and filtering network flows in a Cilium-managed cluster.
- Operators who need network and security context from Cilium's eBPF datapath.
Sources
- Network Observability with Hubble - Cilium documentation (Oct 26, 2026)
- Setting up Hubble Observability - Cilium documentation (Oct 26, 2026)
- Inspecting Network Flows with the CLI - Cilium documentation (Oct 26, 2026)
- cilium/hubble (Oct 26, 2026)
- LICENSE (Hubble) (Oct 26, 2026)
- Service Map & Hubble UI - Cilium documentation (Oct 26, 2026)