Hubble is a network observability tool that provides visibility into Kubernetes cluster traffic and security using eBPF.
Hubble solves the problem of understanding what is happening inside Kubernetes clusters by leveraging eBPF to observe network flows, service interactions, and security events without requiring code instrumentation or kernel modifications. It captures packet and flow information at the kernel level, making it possible to see encrypted traffic patterns and service dependencies that would otherwise be invisible to traditional monitoring approaches. The tool integrates with Cilium to provide deep visibility into both the data plane and policy enforcement.
Hubble suits operators and platform teams running Kubernetes who need to understand network behavior, troubleshoot connectivity issues, or audit security policies in action. It is particularly valuable for clusters where traditional packet capture is impractical or where encrypted traffic obscures application behavior. Teams investigating service mesh interactions, validating network policies, or responding to security incidents will find the kernel-level observability it provides essential. The tool works best in environments where Cilium is already deployed or planned as the CNI.
The project maintains active development with regular updates to support new Kubernetes versions and eBPF capabilities. The codebase shows ongoing refinement of observability features and integration points with the broader Cilium ecosystem. Development activity indicates sustained investment in expanding the types of network and security events that can be observed and the ways those observations can be queried and exported.
