Hubble

Hubble is a self-hosted observability layer for teams running Cilium in Kubernetes. It is best for platform and security operators who need network-level service context alongside Cilium, rather than a standalone tracing product. Its free, open-source deployment is compelling when Cilium is already central to the cluster; otherwise the installation requirement and limited pod coverage are decisive drawbacks.

Overview

Built on Cilium and eBPF, Hubble turns networking and security telemetry into an operational view of service communication. The web UI presents a graphical map of service dependencies and recent flow events, while flow records include workload identity and label metadata. DNS-aware filtering and protocol-specific views make the data useful for narrowing an incident instead of merely displaying traffic.

That focus gives Hubble a clear troubleshooting role. It can help distinguish a DNS failure from an application problem or a networking fault at Layer 4 or Layer 7. The boundary matters: Cilium must be installed in the Kubernetes cluster, and Hubble observes only pods managed by Cilium. Organizations with mixed networking implementations should not expect a complete picture of every workload.

Key features

Service maps and flow analysis

The map supplies topology at a glance, while recent flows provide the evidence behind a dependency or outage. Identity and labels add workload context, and DNS and protocol filters reduce the search area during investigations. This combination is more actionable for Kubernetes operators than raw packet-level visibility alone, especially when the question is which service-to-service path is failing.

CLI and multi-cluster Relay

The Hubble CLI connects to a local Hubble server or Hubble Relay to retrieve flow events, giving operators a scriptable and terminal-based path into the same telemetry. Relay can aggregate Hubble instances for visibility across a cluster and across multiple clusters in a ClusterMesh setup. When APIs are exposed over TCP, mutual TLS secures connections between Hubble instances and Relay by default, an important protection for distributed deployments.

Monitoring and data controls

Cilium documents integration with Prometheus, Grafana, and other monitoring systems, and Hubble supports OpenTelemetry. These integrations let teams connect flow observability to existing metrics and alerting rather than operate it as an isolated console. Layer 7 flow data is not redacted by default, however. Cilium provides controls for redacting HTTP query parameters, URL user information, and headers, so privacy-sensitive deployments need to configure those controls deliberately.

Pricing

Hubble costs free on its Hubble plan. The plan is an open-source observability layer of Cilium and requires Cilium to be installed in a Kubernetes cluster. There are no paid tiers, seat charges, usage quotas, or trial terms to weigh in the published plan. That makes it a natural choice for teams already operating Cilium and willing to run the software themselves; it does not remove the operational cost of maintaining the Kubernetes, Cilium, Relay, and monitoring stack.

Platforms

Hubble is available as a self-hosted deployment with API and web access. The CLI has installation downloads for Linux, macOS, and Windows. This mix suits infrastructure teams that want cluster-resident control with both browser and command-line access, rather than a hosted service that abstracts deployment.

Who it's for

Choose Hubble when Cilium already manages your Kubernetes networking and you need service maps, flow-level evidence, and cross-cluster visibility. It is particularly well suited to platform, reliability, and security teams tracing communication failures through DNS, application behavior, and network policy. Look elsewhere if workloads fall outside Cilium management, if you need a vendor-hosted experience, or if your primary requirement is application tracing independent of the network layer.

Pros and cons

Pros

• Free and open source: There are no published seat or usage fees, making broad cluster adoption possible.
• Useful network context: Service maps, identity metadata, DNS filtering, and protocol views connect topology with individual flow events.
• Operational reach: CLI access, Relay aggregation, mutual TLS defaults, and monitoring integrations support local and multi-cluster operations.
• Layered troubleshooting: The data helps separate DNS, application, and Layer 4 or Layer 7 network causes.

Cons

• Cilium dependency: Hubble cannot be used as a general observer without Cilium installed.
• Partial workload coverage: Pods not managed by Cilium are outside its visibility.
• Privacy requires configuration: Layer 7 records expose sensitive URL and header content until redaction is enabled.
• Self-hosted responsibility: Teams must operate the deployment and its supporting cluster and monitoring components.

Alternatives

For a broader catalog of tracing and observability choices, see Distributed Tracing Tools.

AWS X-Ray is the better fit for teams wanting a paid, usage-based service with a monthly free allowance for recorded and retrieved traces across API, desktop, and web environments.

Grafana Cloud Application Observability suits organizations preferring a hosted freemium model, with an always-free host-hour allowance and a paid tier for expanded usage.

Tracetest is an alternative open-source option for teams seeking trace-focused workflows without Hubble's Cilium requirement.

Uptrace is preferable when a cloud plan with 50 GB of included monthly data and unlimited users, services, and hosts matches your operating model.

Apache SkyWalking provides another free, self-hosted observability platform.

Honeycomb fits teams wanting a hosted freemium service with event and metrics allowances plus paid expansion.

Hypertrace offers a free self-hosted alternative centered on service, endpoint, backend, and service-graph views.

Jaeger is a fully open-source, self-hosted choice for teams whose priority is cloud-native distributed tracing.

Verdict

Hubble is the right choice for Cilium-based Kubernetes operators who want free, self-hosted flow visibility, service maps, and multi-cluster context in the same networking stack. Choose it for fast diagnosis of service communication and policy-related problems. Look elsewhere when you need visibility into non-Cilium pods, a hosted operating model, or tracing that is not tied to Cilium-managed networking.