What is Hubble?
Hubble, built on top of Cilium and eBPF, is a networking and security observability platform, enabling deep visibility into the communication and services of your cloud native workloads.
Relying on eBPF, all visibility is programmable, allowing for a dynamic approach that minimizes overhead while providing deep and detailed visibility as required by users. Hubble has been created and specifically designed to best use these new eBPF powers.
Hubble can answer questions such as:
Service dependencies & communication map
- What services are communicating with each other? How frequently? What does the service dependency graph look like?
- What HTTP calls are being made? What Kafka topics does a service consume from or produce to?
Network monitoring & alerting
- Is any network communication failing? Why is communication failing? Is it DNS? Is it an application or network problem? Is the communication broken on layer 4 (TCP) or layer 7 (HTTP)?
- Which services have experienced a DNS resolution problem in the last 5 minutes? Which services have recently experienced an interrupted TCP connection or have seen connections timing out? What is the rate of unanswered TCP SYN requests?
Application monitoring
- What is the rate of 5xx or 4xx HTTP response codes for a particular service or across all clusters?
- What is my cluster’s 95th and 99th percentile latency between HTTP requests and responses? Which services are performing the worst? What is the latency between the different services?
Security observability
- Which services had connections blocked due to network policy? What services have been accessed from outside the cluster? Which services have resolved a particular DNS name?
Introducing the Hubble Cheat Sheet
When learning about any new tooling, it’s always useful to have an easy-to-use list or revision notes on how to use the tool. Therefore, we’ve produced the Hubble Cheat Sheet, which complements our Cilium Cheat Sheet.
Either click the image or the button below, which will open a new browser tab to the PDF file for you to save. No sign-up is required.
I remember when I worked in IT operational roles, I would often take various cheat sheets for the technologies I worked with and hang them on the walls of the office. It certainly helped me learn Microsoft PowerShell at the time.
Components of Hubble
Below is a high-level overview of the components that make up Hubble Observability with Cilium in a Kubernetes Cluster.
Cilium Agent – Runs the cilium-agent binary which acts as a CNI to manage connectivity, observability, and security for all CNI-managed Kubernetes pods.
Hubble Relay – Provides a cluster-wide API for querying Hubble flow data, which can be accessed directly or via the Hubble CLI and UI.
Hubble UI – Provides a graphical UI for visualizing network flow data, network policy, and security-related events.
Accessing Hubble
To access the Hubble CLI, we can configure this using the Cilium CLI, if you need to install both CLI tools, follow the links below:
To access the UI
Checking Hubble Status
Seeing the current and max flows at 100% is expected, as the Hubble relay ring buffer fills, older events will automatically be dropped.
Selecting which traffic flows to observe from the Hubble Relay
Observing and filtering traffic examples
Observe by Resource
With hubble observe you can filter by resources, either looking at incoming/outgoing or all traffic for that resource, below is a list of the filters available.
The following examples will show a mix of these filters in use.
Observe by Protocol
Observe by Policy Verdict
Observe by FQDN
Observe by HTTP Method, Path and Status
A more complex example
Filters can be combined, too, the below example filters for flows of HTTP requests any pod with the label “app=core-api”, where the HTTP path is “/applicants” and the HTTP method is “PUT”.
You can use the following argument to exclude data from results:
This example command ensures no flows from anything with a specific label are returned when viewing all flows from a namespace
Formatting the Output
Watch the Hubble CLI Walkthrough Video
Along with this new content, you can watch the below video to see the commands in action!
Where can I learn more?
You can also get started with Hubble in our Isovalent Labs, I recommend the “Isovalent Enterprise for Cilium: Connectivity Visibility” lab, which also shows off the enterprise features for Hubble, such as Role Based Access Control and Hubble Timescape, the historical datastore for network flows and process events.
Lab: Isovalent Enterprise for Cilium: Connectivity Visibility
This lab provides an introduction to Isovalent Enterprise for Cilium capabilities related to connectivity observability.
Start Lab
Dean Lewis is a Senior Technical Marketing Engineer at Isovalent – the company behind the open-source cloud native solution Cilium.
Dean had a varied background working in the technology fields, from support to operations to architectural design and delivery at IT Solutions Providers based in the UK, before moving to VMware and focusing on cloud management and cloud native, which remains as his primary focus. You can find Dean in the past and present speaking at various Technology User Groups and Industry Conferences, as well as his personal blog.
