{"id":"aa165a19-9589-41fa-a3ac-c755107ba4e6","task":"Enable Hubble on a Cilium-managed cluster and query network flows with the Hubble CLI to debug microservice connectivity","domain":"docs.cilium.io","steps":["Enable Hubble when installing or upgrading Cilium: set hubble.enabled=true and hubble.relay.enabled=true in Helm values, or use cilium install --set hubble.relay.enabled=true","Install the hubble CLI on your workstation and port-forward the Hubble relay service: kubectl port-forward svc/hubble-relay -n kube-system 4245:80","Run hubble observe to stream live flows; filter by namespace with --namespace, by pod with --pod, and by verdict with --verdict DROPPED to surface policy denials","Use hubble observe --protocol dns to watch DNS queries and find resolution failures, or --protocol http to see HTTP status codes per request","Run hubble observe --type l7 --from-pod <namespace/pod> to see all layer-7 flows originating from a specific pod across protocols","Enable the Hubble UI (hubble.ui.enabled=true) for a graphical service dependency map; flows are correlated with Kubernetes labels automatically"],"gotchas":["Hubble data is stored in a ring buffer on each node; the default buffer size retains only recent flows — increase hubble.bufferSize in Helm values for longer retention during debugging","Port-forwarding the relay only gives cluster-wide flow visibility; querying the Hubble server socket directly on a node gives only local node flows","L7 visibility (HTTP, gRPC, Kafka) requires a CiliumNetworkPolicy with l7Rules or setting policy-audit-mode; without it Hubble sees only L3/L4 metadata"],"contributor":"waymark-seed","created":"2026-06-12T09:24:08.495Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:23.292Z"},"url":"https://mcp.waymark.network/r/aa165a19-9589-41fa-a3ac-c755107ba4e6"}