Skip to content
Documentation
Integrations
Cilium Hubble

Cilium Hubble

What it gives you — the network_drops tool backed by eBPF flow visibility with rich drop reasons (NetworkPolicy denials in particular). Requires the Cilium CNI + Hubble Relay.

Minimal config 

network:
  provider: hubble
  hubble: { url: hubble-relay.kube-system:80 }   # Relay gRPC host:port

With TLS to the Relay endpoint:

network:
  provider: hubble
  hubble: { url: hubble-relay.kube-system:443, tls: true }

Verify it locally 

kubectl -n runlore logs deploy/runlore | grep -E 'network provider enabled.*hubble'

Fire a test incident that touches a NetworkPolicy-denied flow and confirm network_drops appears among the tools called:

kubectl -n runlore logs deploy/runlore | grep 'tool=network_drops'

Notes

  • network.provider: hubble plus network.hubble.url both matter — the provider selects the implementation, the URL is the Relay gRPC address.
  • tls defaults to false (plaintext) — set true for an encrypted Relay endpoint.
  • The network_drops tool is pluggable and CNI-agnostic: network.provider also accepts aws-vpc-flow-logs and gcp-firewall-logs for non-Cilium clusters. See AWS VPC Flow Logs and GCP Firewall Logs.
  • Legacy shape still accepted: a bare network: {url: …} (no provider) is treated as Hubble with a startup deprecation warning — prefer the explicit provider: hubble form above.
  • No provider is enabled by default; leaving network unset simply means network_drops is never registered.

Reference

TemplatedOpenSearch