The Hubble Observer is a small observability component that monitors network flows within Cilium.

Note: You can enable the CF2CNP feature in the Helm chart (cf2cnp.enabled=true) to automatically generate CiliumNetworkPolicies based on observed network flows. These policies are not applied automatically; you need to download them and apply them yourself. See the values.yaml file for additional cf2cnp configuration options.

The Hubble Observer also includes a Grafana dashboard for visualizing Cilium network flows. Here's a preview of the dashboard:

Before installing the Hubble Observer, ensure you have the following components installed in your Kubernetes cluster:

1. Hubble Relay

   • Required to connect to all Cilium pods and export the flows.

2. Grafana Operator

   • Required for deploying the Grafana dashboard. (you can disable this: grafanaDashboard.enabled=false)
   • Installation instructions: Grafana Operator Documentation

3. Loki

   • Required for log aggregation and querying
   • The Grafana dashboard uses LogQL queries
   • Installation instructions: Loki Documentation

The way it works is very straightforward: it uses the hubble container image which connects to the hubble relay and sends all flows to the stdout. Thats why you need a log collector which ships the logs to Loki.

helm upgrade --install hubble-observer oci://ghcr.io/onzack/helm-charts/hubble-observer --version <VERSION>

See values.yaml for configuration options.

CF2CNP can be exposed via cf2cnp.ingress or, with the Gateway API, via cf2cnp.httpRoute. The URL the Grafana dashboard uses is taken from the first ingress host or httpRoute hostname.