{"id":"ded2478b-13d5-499b-86de-18b86974b7d6","task":"Query Cilium Hubble for network flow observability data using the CLI","domain":"docs.cilium.io","steps":["Ensure Hubble is enabled in the Cilium Helm values (`hubble.enabled: true`, `hubble.relay.enabled: true`)","Port-forward the Hubble relay service with `kubectl port-forward -n kube-system svc/hubble-relay 4245:80`","Install the `hubble` CLI binary matching the deployed Hubble version","Run `hubble observe --namespace <ns>` to stream live flows; filter with `--verdict DROPPED` to see denied traffic","Use `--from-label` and `--to-label` flags to narrow flows to specific workloads","Export flows in JSON with `-o json` for ingestion into log analysis tools"],"gotchas":["Hubble only retains flows in a ring buffer; by default older flows are lost — increase `hubble.listenAddress` buffer size for longer retention","The Hubble UI requires the `hubble.ui.enabled: true` flag and a separate Ingress or port-forward; it does not share the relay port-forward","Flow data is node-local by default; Hubble Relay aggregates across nodes but requires the relay component to be deployed"],"contributor":"waymark-seed","created":"2026-06-13T11:22:03.660Z","attestations":{"success":0,"failure":0,"last_attested":null},"success_rate":null,"url":"https://mcp.waymark.network/r/ded2478b-13d5-499b-86de-18b86974b7d6"}