{ "componentChunkName": "component---src-templates-issues-tsx", "path": "/issues/234", "result": {"data":{"issuesJson":{"id":"73489dac-e375-58d2-b0b4-d91164b4aa6f","title":"cilium/hubble: Hubble - 使用 eBPF 的 Kubernetes 网络、服务和安全可观测性","number":234,"bodyHTML":"
\n



\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Reposcilium/hubble
Views\"views\"
Stars\"stars\"
Forks\"forks\"
License\"license\"
UpdatedAt\"last-commit\"
CreatedAt\"create-at\"
\n\n

\"\"

\n\n
\n \n \n \"Hubble\n\n

\"License\"

\n
\n

Network, Service & Security Observability for Kubernetes

\n\n

What is Hubble?

\n

Hubble is a fully distributed networking and security observability platform
\nfor cloud native workloads. It is built on top of Cilium and eBPF to enable
\ndeep visibility into the communication and behavior of services as well as the
\nnetworking infrastructure in a completely transparent manner.

\n

Hubble can answer questions such as:

\n

Service dependencies & communication map:

\n\n

Operational monitoring & alerting:

\n\n

Application monitoring:

\n\n

Security observability:

\n\n

Why Hubble?

\n

The Linux kernel technology eBPF is enabling visibility into systems and
\napplications at a granularity and efficiency that was not possible before. It
\ndoes so in a completely transparent way, without requiring the application to
\nchange or for the application to hide information. By building on top of
\nCilium, Hubble can leverage eBPF for visibility. By leveraging eBPF, all
\nvisibility is programmable and allows for a dynamic approach that minimizes
\noverhead while providing deep and detailed insight where required. Hubble has
\nbeen created and specifically designed to make best use of these new eBPF
\npowers.

\n

Releases

\n

The Hubble CLI is backward compatible with all supported Cilium releases. For
\nthis reason, only the latest Hubble CLI version is maintained.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
VersionRelease DateMaintainedSupported Cilium VersionArtifacts
v1.172025-04-30 (v1.17.3)YesCilium 1.17 and olderGitHub Release
\n

Component Stability

\n

Hubble project consists of several components (see Architecture section).

\n

While the core Hubble components have been running in production in multiple
\nenvironments, new components continue to emerge as the project grows and
\nexpands in scope.

\n

Some components, due to their relatively young age, are still considered beta
\nand have to be used with caution in critical production workloads.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ComponentAreaState
Hubble CLICoreStable
Hubble ServerCoreStable
Hubble MetricsCoreStable
Hubble RelayMultinodeStable
Hubble UIUIBeta
\n

Architecture

\n

\"Hubble

\n

Getting Started

\n\n

Features

\n

Service Dependency Graph

\n

Troubleshooting microservices application connectivity is a challenging task.
\nSimply looking at \"kubectl get pods\" does not indicate dependencies between
\neach service or external APIs or databases.

\n

Hubble enables zero-effort automatic discovery of the service dependency graph
\nfor Kubernetes Clusters at L3/L4 and even L7, allowing user-friendly
\nvisualization and filtering of those dataflows as a Service Map.

\n

See Hubble Service Map Tutorial
\nfor more examples.

\n

\"Service

\n

Metrics & Monitoring

\n

The metrics and monitoring functionality provides an overview of the state of
\nsystems and allow to recognize patterns indicating failure and other scenarios
\nthat require action. The following is a short list of example metrics, for a
\nmore detailed list of examples, see the
\nMetrics Documentation.

\n

Networking Behavior

\n

\"Networking\"

\n

Network Policy Observation

\n

\"Network

\n

HTTP Request/Response Rate & Latency

\n

\"HTTP\"

\n

DNS Request/Response Monitoring

\n

\"DNS\"

\n

Flow Visibility

\n

Flow visibility provides visibility into flow information on the network and
\napplication protocol level. This enables visibility into individual TCP
\nconnections, DNS queries, HTTP requests, Kafka communication, and much more.

\n

DNS Resolution

\n

Identifying pods which have received DNS response indicating failure:

\n
hubble observe --since=1m -t l7 -o json \\\n   | jq 'select(.l7.dns.rcode==3) | .destination.namespace + \"/\" + .destination.pod_name' \\\n   | sort | uniq -c | sort -r\n  42 \"starwars/jar-jar-binks-6f5847c97c-qmggv\"\n
\n

Successful query & response:

\n
starwars/x-wing-bd86d75c5-njv8k            kube-system/coredns-5c98db65d4-twwdg      DNS Query deathstar.starwars.svc.cluster.local. A\nkube-system/coredns-5c98db65d4-twwdg       starwars/x-wing-bd86d75c5-njv8k           DNS Answer \"10.110.126.213\" TTL: 3 (Query deathstar.starwars.svc.cluster.local. A)\n
\n

Non-existent domain:

\n
starwars/jar-jar-binks-789c4b695d-ltrzm    kube-system/coredns-5c98db65d4-f4m8n      DNS Query unknown-galaxy.svc.cluster.local. A\nstarwars/jar-jar-binks-789c4b695d-ltrzm    kube-system/coredns-5c98db65d4-f4m8n      DNS Query unknown-galaxy.svc.cluster.local. AAAA\nkube-system/coredns-5c98db65d4-twwdg       starwars/jar-jar-binks-789c4b695d-ltrzm   DNS Answer RCode: Non-Existent Domain TTL: 4294967295 (Query unknown-galaxy.starwars.svc.cluster.local. A)\nkube-system/coredns-5c98db65d4-twwdg       starwars/jar-jar-binks-789c4b695d-ltrzm   DNS Answer RCode: Non-Existent Domain TTL: 4294967295 (Query unknown-galaxy.starwars.svc.cluster.local. AAAA)\n
\n

HTTP Protocol

\n

Successful request & response with latency information:

\n
starwars/x-wing-bd86d75c5-njv8k:53410      starwars/deathstar-695d8f7ddc-lvj84:80    HTTP/1.1 GET http://deathstar/\nstarwars/deathstar-695d8f7ddc-lvj84:80     starwars/x-wing-bd86d75c5-njv8k:53410     HTTP/1.1 200 1ms (GET http://deathstar/)\n
\n

TCP/UDP Packets

\n

Successful TCP connection:

\n
starwars/x-wing-bd86d75c5-njv8k:53410      starwars/deathstar-695d8f7ddc-lvj84:80    TCP Flags: SYN\ndeathstar.starwars.svc.cluster.local:80    starwars/x-wing-bd86d75c5-njv8k:53410     TCP Flags: SYN, ACK\nstarwars/x-wing-bd86d75c5-njv8k:53410      starwars/deathstar-695d8f7ddc-lvj84:80    TCP Flags: ACK, FIN\ndeathstar.starwars.svc.cluster.local:80    starwars/x-wing-bd86d75c5-njv8k:53410     TCP Flags: ACK, FIN\n
\n

Connection timeout:

\n
starwars/r2d2-6694d57947-xwhtz:60948   deathstar.starwars.svc.cluster.local:8080     TCP Flags: SYN\nstarwars/r2d2-6694d57947-xwhtz:60948   deathstar.starwars.svc.cluster.local:8080     TCP Flags: SYN\nstarwars/r2d2-6694d57947-xwhtz:60948   deathstar.starwars.svc.cluster.local:8080     TCP Flags: SYN\n
\n

Network Policy Behavior

\n

Denied connection attempt:

\n
starwars/enterprise-5775b56c4b-thtwl:37800   starwars/deathstar-695d8f7ddc-lvj84:80(http)   Policy denied (L3)   TCP Flags: SYN\nstarwars/enterprise-5775b56c4b-thtwl:37800   starwars/deathstar-695d8f7ddc-lvj84:80(http)   Policy denied (L3)   TCP Flags: SYN\nstarwars/enterprise-5775b56c4b-thtwl:37800   starwars/deathstar-695d8f7ddc-lvj84:80(http)   Policy denied (L3)   TCP Flags: SYN\n
\n

Specifying Raw Flow Filters

\n

Hubble supports extensive set of filtering options that can be specified as a combination of
\nallowlist and denylist. Hubble applies these filters as follows:

\n
for each flow:\n  if flow does not match any of the allowlist filters:\n    continue\n  if flow matches any of the denylist filters:\n    continue\n  send flow to client\n
\n

You can pass these filters to hubble observe command as
\nJSON-encoded
\nFlowFilters. For
\nexample, to observe flows that match the following conditions:

\n\n

Alternatively, you can also specify these flags as HUBBLE_{ALLOWLIST,DENYLIST} environment variables:

\n
cat > allowlist.txt <<EOF\n{\"source_label\":[\"k8s:io.kubernetes.pod.namespace=kube-system\",\"reserved:host\"]}\n{\"destination_label\":[\"k8s:io.kubernetes.pod.namespace=kube-system\",\"reserved:host\"]}\nEOF\n\ncat > denylist.txt <<EOF\n{\"source_label\":[\"k8s:k8s-app=kube-dns\"]}\n{\"destination_label\":[\"k8s:k8s-app=kube-dns\"]}\nEOF\n\nHUBBLE_ALLOWLIST=$(cat allowlist.txt)\nHUBBLE_DENYLIST=$(cat denylist.txt)\nexport HUBBLE_ALLOWLIST\nexport HUBBLE_DENYLIST\n\nhubble observe\n
\n

Note that --allowlist and --denylist filters get included in the request in addition to
\nregular flow filters like --label or --namespace. Use --print-raw-filters flag to verify
\nthe exact filters that the Hubble CLI generates. For example:

\n
% hubble observe --print-raw-filters \\\n    -t drop \\\n    -n kube-system \\\n    --not --label \"k8s:k8s-app=kube-dns\" \\\n    --allowlist '{\"source_label\":[\"k8s:k8s-app=my-app\"]}'\nallowlist:\n- '{\"source_pod\":[\"kube-system/\"],\"event_type\":[{\"type\":1}]}'\n- '{\"destination_pod\":[\"kube-system/\"],\"event_type\":[{\"type\":1}]}'\n- '{\"source_label\":[\"k8s:k8s-app=my-app\"]}'\ndenylist:\n- '{\"source_label\":[\"k8s:k8s-app=kube-dns\"]}'\n- '{\"destination_label\":[\"k8s:k8s-app=kube-dns\"]}'\n
\n

The output YAML can be saved to a file and passed to hubble observe command with --config
\nflag. For example:

\n
% hubble observe --print-raw-filters --allowlist '{\"source_label\":[\"k8s:k8s-app=my-app\"]}' > filters.yaml\n% hubble observe --config ./filters.yaml\n
\n

Community

\n

Join the Cilium Slack #hubble channel to chat
\nwith Cilium Hubble developers and other Cilium / Hubble users. This is a good
\nplace to learn about Hubble and Cilium, ask questions, and share your
\nexperiences.

\n

Learn more about Cilium.

\n

Authors

\n

Hubble is an open source project licensed under the Apache License. Everybody
\nis welcome to contribute. The project is following the Governance Rules of
\nthe Cilium project. See CONTRIBUTING for instructions on how to contribute
\nand details of the Code of Conduct.

","updatedAt":"2025-05-21T16:02:17Z","upvoteCount":null,"author":{"login":"eryajf","avatarUrl":"https://avatars.githubusercontent.com/u/33259379?u=e4a4090a38ac2473aaed4ef9945233636776c6c3&v=4","url":"https://github.com/eryajf"},"category":null,"labels":{"edges":[{"node":{"name":"更多","color":"25B472"}},{"node":{"name":"Monitor","color":"533a1e"}},{"node":{"name":"cilium","color":"6c4341"}}]},"comments":{"edges":[]}}},"pageContext":{"number":234,"previous":{"title":"davecheney/httpstat: 显示 HTTP 请求链路详情的工具，便于我们看到请求耗时在什么地方","number":233},"next":{"title":"hyperdxio/hyperdx: 一个开源可观察性平台，统一会话重放、日志、指标、跟踪和错误","number":235}}}, "staticQueryHashes": ["151096407","2861350382"]}