Using Hubble from the CLI or Hubble UI: CCA practice questions

Two tools read Hubble data: the hubble command-line client and the Hubble UI web interface. Both normally work through Hubble Relay, which has to be enabled first, for example with cilium hubble enable or the Helm value hubble.relay.enabled=true. Adding --ui to cilium hubble enable, or setting hubble.ui.enabled=true, deploys the UI as well.

The CLI expects Relay at localhost:4245. Three ways to get there are documented: cilium hubble port-forward, kubectl -n kube-system port-forward service/hubble-relay 4245:80, or the -P flag on the hubble command itself, which sets up the port-forward automatically. If you forward to another local port, point the client at it with --server or the HUBBLE_SERVER environment variable. hubble status then checks health and shows how many flows are buffered against the maximum, the flow rate and how many nodes are connected.

hubble observe is where most of the work happens. Without arguments it prints recent flows; -f follows new ones; -o picks compact, dict, json, jsonpb or table output. Filters cover nearly every flow field: --pod, --namespace (-n), --label, --to-fqdn, --protocol (for example tcp, udp, dns or http), --port, --verdict (FORWARDED, DROPPED, AUDIT, REDIRECTED, ERROR, TRACED, TRANSLATED), --type for event types (capture, drop, l7, policy-verdict, trace, trace-sock), and HTTP filters such as --http-method, --http-path and --http-status, which takes a prefix like 404 or 5+. Encrypted and reply traffic have their own switches, --encrypted, --unencrypted, --reply and --not-reply.

Filter logic is worth knowing exactly. Several values of one flag are alternatives, so --http-method put --http-method get matches either method. Different flags must all match, so adding --to-namespace foo narrows the result to flows that end in foo. Prefixing a filter with --not reverses it. Flows saved with -o jsonpb can be replayed later with --input-file, in which case follow, last and server flags are ignored.

Hubble UI is opened with cilium hubble ui, which forwards the hubble-ui service to local port 12000 and keeps running while the forward is active. After you choose a namespace, the UI draws the services as a dependency map built from observed flows, at L3/L4 and, where L7 visibility exists, at L7, and lists recent flow events below the map. Running cilium connectivity test in a loop and opening the cilium-test namespace is the documented way to see a busy map.