github.com/cilium/cilium@v1.16.2/Documentation/observability/hubble/setup.rst (about) 1 .. only:: not (epub or latex or html) 2 3 WARNING: You are looking at unreleased Cilium documentation. 4 Please use the official rendered version released here: 5 https://docs.cilium.io 6 7 .. _hubble_setup: 8 9 ******************************* 10 Setting up Hubble Observability 11 ******************************* 12 13 Hubble is the observability layer of Cilium and can be used to obtain 14 cluster-wide visibility into the network and security layer of your Kubernetes 15 cluster. 16 17 .. note:: 18 19 This guide assumes that Cilium has been correctly installed in your 20 Kubernetes cluster. Please see :ref:`k8s_quick_install` for more 21 information. If unsure, run ``cilium status`` and validate that Cilium is up 22 and running. 23 24 Enable Hubble in Cilium 25 ======================= 26 27 .. tabs:: 28 29 .. group-tab:: Cilium CLI 30 31 In order to enable Hubble, run the command ``cilium hubble enable`` as shown 32 below: 33 34 .. code-block:: shell-session 35 36 $ cilium hubble enable 37 🔑 Found existing CA in secret cilium-ca 38 ✨ Patching ConfigMap cilium-config to enable Hubble... 39 ♻️ Restarted Cilium pods 40 🔑 Generating certificates for Relay... 41 2021/04/13 17:11:23 [INFO] generate received request 42 2021/04/13 17:11:23 [INFO] received CSR 43 2021/04/13 17:11:23 [INFO] generating key: ecdsa-256 44 2021/04/13 17:11:23 [INFO] encoded CSR 45 2021/04/13 17:11:23 [INFO] signed certificate with serial number 365589302067830033295858933512588007090526050046 46 2021/04/13 17:11:24 [INFO] generate received request 47 2021/04/13 17:11:24 [INFO] received CSR 48 2021/04/13 17:11:24 [INFO] generating key: ecdsa-256 49 2021/04/13 17:11:24 [INFO] encoded CSR 50 2021/04/13 17:11:24 [INFO] signed certificate with serial number 644167683731852948186644541769558498727586273511 51 ✨ Deploying Relay... 52 53 54 .. tip:: 55 56 Enabling Hubble requires the TCP port 4244 to be open on all nodes running 57 Cilium. This is required for Relay to operate correctly. 58 59 Run ``cilium status`` to validate that Hubble is enabled and running: 60 61 .. code-block:: shell-session 62 63 $ cilium status 64 /¯¯\ 65 /¯¯\__/¯¯\ Cilium: OK 66 \__/¯¯\__/ Operator: OK 67 /¯¯\__/¯¯\ Hubble: OK 68 \__/¯¯\__/ ClusterMesh: disabled 69 \__/ 70 71 DaemonSet cilium Desired: 3, Ready: 3/3, Available: 3/3 72 Deployment cilium-operator Desired: 1, Ready: 1/1, Available: 1/1 73 Deployment hubble-relay Desired: 1, Ready: 1/1, Available: 1/1 74 Containers: cilium Running: 3 75 cilium-operator Running: 1 76 hubble-relay Running: 1 77 Image versions cilium-operator quay.io/cilium/operator-generic:v1.9.5: 1 78 hubble-relay quay.io/cilium/hubble-relay:v1.9.5: 1 79 cilium quay.io/cilium/cilium:v1.9.5: 3 80 81 .. group-tab:: Helm 82 83 If you installed Cilium via ``helm install``, you may enable Hubble 84 Relay and UI with the following command: 85 86 .. parsed-literal:: 87 88 helm upgrade cilium |CHART_RELEASE| \\ 89 --namespace kube-system \\ 90 --reuse-values \\ 91 --set hubble.relay.enabled=true \\ 92 --set hubble.ui.enabled=true 93 94 .. _hubble_cli_install: 95 96 Install the Hubble Client 97 ========================= 98 99 In order to access the observability data collected by Hubble, you must first install Hubble CLI. 100 101 Select the tab for your platform below and install the latest release of Hubble CLI. 102 103 .. tabs:: 104 105 .. group-tab:: Linux 106 107 Download the latest hubble release: 108 109 .. code-block:: shell-session 110 111 HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/master/stable.txt) 112 HUBBLE_ARCH=amd64 113 if [ "$(uname -m)" = "aarch64" ]; then HUBBLE_ARCH=arm64; fi 114 curl -L --fail --remote-name-all https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum} 115 sha256sum --check hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum 116 sudo tar xzvfC hubble-linux-${HUBBLE_ARCH}.tar.gz /usr/local/bin 117 rm hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum} 118 119 .. group-tab:: MacOS 120 121 Download the latest hubble release: 122 123 .. code-block:: shell-session 124 125 HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/master/stable.txt) 126 HUBBLE_ARCH=amd64 127 if [ "$(uname -m)" = "arm64" ]; then HUBBLE_ARCH=arm64; fi 128 curl -L --fail --remote-name-all https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-darwin-${HUBBLE_ARCH}.tar.gz{,.sha256sum} 129 shasum -a 256 -c hubble-darwin-${HUBBLE_ARCH}.tar.gz.sha256sum 130 sudo tar xzvfC hubble-darwin-${HUBBLE_ARCH}.tar.gz /usr/local/bin 131 rm hubble-darwin-${HUBBLE_ARCH}.tar.gz{,.sha256sum} 132 133 .. group-tab:: Windows 134 135 Download the latest hubble release: 136 137 .. code-block:: shell-session 138 139 curl -LO "https://raw.githubusercontent.com/cilium/hubble/master/stable.txt" 140 set /p HUBBLE_VERSION=<stable.txt 141 curl -L --fail -O "https://github.com/cilium/hubble/releases/download/%HUBBLE_VERSION%/hubble-windows-amd64.tar.gz" 142 curl -L --fail -O "https://github.com/cilium/hubble/releases/download/%HUBBLE_VERSION%/hubble-windows-amd64.tar.gz.sha256sum" 143 certutil -hashfile hubble-windows-amd64.tar.gz SHA256 144 type hubble-windows-amd64.tar.gz.sha256sum 145 :: verify that the checksum from the two commands above match 146 tar zxf hubble-windows-amd64.tar.gz 147 148 and move the ``hubble.exe`` CLI to a directory listed in the ``%PATH%`` environment variable after 149 extracting it from the tarball. 150 151 .. _hubble_validate_api_access: 152 153 Validate Hubble API Access 154 ==================================== 155 156 In order to access the Hubble API, create a port forward to the Hubble service 157 from your local machine. This will allow you to connect the Hubble client to 158 the local port ``4245`` and access the Hubble Relay service in your Kubernetes 159 cluster. For more information on this method, see `Use Port Forwarding to Access Application in a Cluster <https://kubernetes.io/docs/tasks/access-application-cluster/port-forward-access-application-cluster/>`_. 160 161 .. code-block:: shell-session 162 163 $ cilium hubble port-forward& 164 Forwarding from 0.0.0.0:4245 -> 4245 165 Forwarding from [::]:4245 -> 4245 166 167 Now you can validate that you can access the Hubble API via the installed CLI: 168 169 .. code-block:: shell-session 170 171 $ hubble status 172 Healthcheck (via localhost:4245): Ok 173 Current/Max Flows: 11917/12288 (96.98%) 174 Flows/s: 11.74 175 Connected Nodes: 3/3 176 177 You can also query the flow API and look for flows: 178 179 .. code-block:: shell-session 180 181 $ hubble observe 182 183 .. note:: 184 185 If you port forward to a port other than ``4245``, make sure to use the 186 ``--server`` flag or ``HUBBLE_SERVER`` environment variable to set the 187 Hubble server address (default: ``localhost:4245``). For more information, 188 check out Hubble CLI's help message by running ``hubble help status`` or 189 ``hubble help observe`` as well as ``hubble config`` for configuring Hubble 190 CLI. 191 192 .. note:: 193 194 If you have :ref:`enabled TLS<hubble_enable_tls>` then you will need to specify additional flags to :ref:`access the Hubble API<hubble_api_tls>`. 195 196 Next Steps 197 ========== 198 199 * :ref:`hubble_cli` 200 * :ref:`hubble_ui` 201 * :ref:`hubble_enable_tls`