hubble

No entries match these filters. Clear filters

1. docs update Jul 31, 2026 · issue 031

   Hubble CLI adds --reply and --not-reply flags to filter flows by traffic direction.

2. v1.18.0 Aug 11, 2025 · release notes

   Hubble v1.18.0 adds policy-name visibility in flow output and IPIP tunnel datapath support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.18.0 https://github.com/cilium/hubble.git
   # already have the repo? check out this version:
   $ git checkout v1.18.0

   └──▷ TRY IT
   Identify which CiliumNetworkPolicy allowed or dropped a specific flow — useful when auditing policy decisions across namespaces.
   copy

   $ hubble observe --print-policy-names

   • Adds --print-policy-names flag to hubble observe to display the names of CiliumNetworkPolicies (CNPs/CCNPs) that allowed or denied traffic.
   • Sends server version via gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. response metadata, enabling clients to inspect the Hubble server version.
   • Attaches datapath to IPIP tunnel devices, extending network visibility to IPIP tunnels.

   3 details in Everything

3. advisory CVE-2025-48056 May 20, 2025 · issue 128
   • CVE-2025-48056: Character injection in Hubble CLI (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < v1.17.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
4. v1.17.0 Feb 7, 2025 · release notes

   Hubble CLI v1.17.0 adds native port-forwarding and cross-cluster flow filters

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.17.0 https://github.com/cilium/hubble.git
   # already have the repo? check out this version:
   $ git checkout v1.17.0

   • Adds native automatic port-forwarding in the Hubble CLI, replacing the previous kubectl-based implementation
   • Adds from and to cluster filters for filtering flows by source or destination cluster in multi-cluster environments
   • Drops 32-bit binary builds; only 64-bit targets are now produced

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !32-bit binaries are no longer built; users on 32-bit platforms will not receive Hubble CLI binaries going forward.
5. v1.16.4 Nov 21, 2024 · release notes

   hubble v1.16.4 adds a release Make target

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.16.4 https://github.com/cilium/hubble.git
   # already have the repo? check out this version:
   $ git checkout v1.16.4

   └──▷ TRY IT
   Trigger the new build/release workflow via make.
   copy

   $ make release

6. v1.16.0 Jul 25, 2024 · release notes

   Hubble v1.16 adds CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. expression filters, drop-reason filtering, and node-label visibility to flow observation.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.16.0 https://github.com/cilium/hubble.git
   # already have the repo? check out this version:
   $ git checkout v1.16.0

   └──▷ TRY IT
   Filter live flows using a CEL expression to match only flows from a specific source IP and port — useful for precise, ad-hoc investigations without pre-built filter combinations.
   copy

   $ hubble observe --cel-expression 'flow.IP.source == "10.0.0.5" && flow.l4.TCP.destination_port == 443'

   • Adds --cel-expression filter flag to hubble observe for powerful, custom expression-based flow filtering using Common Expression Language.
   • Supports drop_reason_desc in flow filters, enabling filtering of flows by human-readable drop reason descriptions.
   • Exposes node labels in Hubble flow data, giving practitioners richer context for node-level traffic analysis.

   3 details in Everything

7. 1.16.0-pre.2 Prerelease May 6, 2024 · release notes

   Hubble v1.16 adds CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. filter support and drop reason descriptions to flow filtering

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.16.0-pre.2 https://github.com/cilium/hubble.git
   # already have the repo? check out this version:
   $ git checkout 1.16.0-pre.2

   • Adds --cel-expression flag to hubble observe for advanced flow filtering using Common Expression Language syntax.
   • Adds drop_reason_desc field support in hubble flow filters, allowing practitioners to match flows by descriptive drop reason rather than numeric codes.
   • Moves cilium/hubble codebase into the main cilium/cilium repository.

   3 details in Everything

8. v0.13.0 Jan 15, 2024 · release notes

   hubble v0.13.0 adds cluster, pod, service, HTTP header/URL, and timeout filters to observe

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.13.0 https://github.com/cilium/hubble.git
   # already have the repo? check out this version:
   $ git checkout v0.13.0

   └──▷ USE IT
   Filter hubble observe output to show only HTTP traffic matching a specific URL path and header combination.
   shell copy

   hubble observe --http-url '/api/v1/users' --http-headers 'Authorization: Bearer <token>'

   Limit the duration of a single hubble request to prevent hanging in slow network conditions.
   shell copy

   hubble observe --request-timeout 5s

   Narrow down flow observation to a specific Kubernetes cluster within a multi-cluster deployment.
   shell copy

   hubble observe --cluster prod-eu-west-1

   • Adds --cluster flag to filter flows by cluster name
   • Adds flags to filter by pods and services in any namespace via --namespace and --pod
   • Adds --http-headers filter to hubble observe for matching HTTP request headers
   • Adds --http-url filter to hubble observe for matching HTTP URLs
   • Adds --request-timeout flag to configure timeout for unary RPCs

   +1 more show less

   • Displays server-provided flow rates in the output

   6 details in Everything

9. v0.12.0 Jul 10, 2023 · release notes

   hubble v0.12.0 adds hubble list namespaces, basic auth, the --input-file flag, SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking. support, UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. filter, traffic direction filter, and HUBBLE_COMPAT=legacy-json-output

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.12.0 https://github.com/cilium/hubble.git
   # already have the repo? check out this version:
   $ git checkout v0.12.0

   └──▷ TRY IT
   List all Hubble namespaces available in the cluster.
   copy

   $ hubble list namespaces

   Read network flows from a file named capture.json for offline analysis.
   copy

   $ hubble observe --input-file capture.json

   Capture only SCTP traffic flows in the cluster.
   copy

   $ hubble observe --protocol sctp

   Filter observed flows to a specific UUID for debugging.
   copy

   $ hubble observe --uuid 123e4567-e89b-12d3-a456-426614174000

   View only egress traffic flows.
   copy

   $ hubble observe --direction egress

   Force legacy JSON output format for backward compatibility with old parsers.
   copy

   $ HUBBLE_COMPAT=legacy-json-output hubble observe

   • Adds hubble list namespaces command to enumerate available Hubble namespaces.
   • Introduces the --input-file flag on hubble observe, which supports reading flows from a file or stdin, replacing previous automatic stdin detection.
   • Enables SCTP protocol inspection in hubble observe via the new --protocol sctp option.
   • Adds the --uuid filter to hubble observe for narrowing results by packet UUID.
   • Adds the --direction filter to hubble observe (e.g., ingress, egress) for traffic direction filtering.

   +1 more show less

   • Introduces the HUBBLE_COMPAT=legacy-json-output environment variable to restore legacy JSON output format.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Automatic stdin detection is removed; use --input-file - explicitly if you were relying on it.
10. v0.11.1 Jan 24, 2023 · release notes

    Adds HUBBLE_COMPAT=legacy-json-output env var to enable legacy JSON output format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.1 https://github.com/cilium/hubble.git
    # already have the repo? check out this version:
    $ git checkout v0.11.1

    └──▷ TRY IT
    Output hubble events in the legacy JSON format for backward compatibility with existing tools.
    copy

    $ HUBBLE_COMPAT=legacy-json-output hubble flow --output json

11. v0.11.0 Jan 11, 2023 · release notes

    Hubble v0.11 adds SockLB visibility, workload/traceID filters, and -o jsonpb format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/cilium/hubble.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    └──▷ USE IT
    Parse JSON output with the new jsonpb field paths.
    shell copy

    hubble observe -o json | jq '.flow.source'

    • Adds support for Cilium SockLB events to observe socket-level service address translations
    • Displays traffic direction in -o compact output for policy verdict events

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated JSON formatter is removed; JSON output now uses jsonpb, requiring jq queries like .source to be rewritten as .flow.source
12. v0.10.0 Jun 22, 2022 · release notes

    Hubble v0.10 adds --first for earlier flows, named identity filters, and -o jsonpb output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/cilium/hubble.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    └──▷ USE IT
    Retrieve the most recent flows using the new --first flag
    shell copy

    hubble observe --first

    Filter traffic by a named identity group instead of numeric IDs
    shell copy

    hubble observe --from-identity reserved:world

    Export flows in the new Protocol Buffers format
    shell copy

    hubble observe -o jsonpb > flows.pb

    • Adds --first flag to query for earlier flows and events
    • Supports named reserved identities for {,from-,to-}identity filters
    • Deprecates -o json in favor of -o jsonpb

    3 details in Everything

13. v0.9.0 Nov 30, 2021 · release notes

    hubble v0.9.0 adds colored CLI output, custom flow filters via --allowlist/--denylist, new hubble status formats, and hubble record stop conditions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/cilium/hubble.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    └──▷ USE IT
    Visualize the current status of your Hubble deployment with multiple available formatting options, such as JSON for programmatic analysis.
    shell copy

    hubble status --output json

    • cmd/observe now produces colored terminal output by default when connected to a compatible Cilium agent.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default value for the --last flag in hubble observe follow mode is removed (it no longer defaults to displaying only the last 20 flows).
14. v0.8.2 Sep 10, 2021 · release notes

    Adds color output and --output flag for controlling observation flow formatting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.2 https://github.com/cilium/hubble.git
    # already have the repo? check out this version:
    $ git checkout v0.8.2

    • Updates Go build toolchain to v1.16.8 and Cilium dependency to v1.10.4

    1 detail in Everything

15. v0.8.0 May 3, 2021 · release notes

    Hubble v0.8.0 adds hubble watch peers subcommand, agent/debug event filtering, and stdin flow support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/cilium/hubble.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

    └──▷ TRY IT
    Filter observed traffic to only include SYN packets for initial connection analysis.
    copy

    $ hubble observe --tcp-flags=syn

    Capture recorder events using the new experimental recorder API subcommand.
    copy

    $ hubble record

    • Support for reading flows from stdin via hubble observe --from-stdin or piping directly into the command
    • Filtering events by TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. flags using the --tcp-flags flag in hubble observe
    • New hubble record subcommand for capturing recorder data (preliminary support for the Hubble Recorder API)
    • Support for filtering events by IP version using the --ip-version flag
    • Addition of the --node-name filter to hubble observe

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default Hubble API endpoint specified with --server is now localhost:4245; use --server unix:///var/run/cilium/hubble.sock or set the HUBBLE_SERVER environment variable to connect to the local unix domain socket
    • !The default output format for hubble observe is now compact; use --output=table to obtain the previous table output
    • !The hubble peers watch command has been renamed to hubble watch peers
16. v0.7.0 Oct 19, 2020 · release notes

    hubble v0.7.0 adds config and reflect subcommands, TLS/mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. support, and HTTP flow filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/cilium/hubble.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    └──▷ TRY IT
    Observe only POST requests to a specific API path for debugging.
    copy

    $ hubble observe --http-method POST --http-path /api/v1/nodes

    Connect to Hubble Relay using client certificates for mTLS authentication.
    copy

    $ hubble observe --tls --client-cert ~/.hubble/cert.pem --client-key ~/.hubble/key.pem

    • Adds the config subcommand to manage the configuration file stored in the user config directory
    • Adds the reflect subcommand for inspecting Hubble Relay topology and peer information
    • Adds TLS and mTLS support via CLI flags for connecting to Hubble Relay
    • Adds HTTP method and path filters to the observe command

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drop support for darwin/386 architecture
17. v0.6.0 May 29, 2020 · release notes

    v0.6.0 adds the peer command and l7 Error verdict support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/cilium/hubble.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    └──▷ USE IT
    Observe Layer 7 traffic where the policy explicitly rejected or dropped the connection (verdict: Error).
    shell copy

    hubble observe --from-l4-port 80 --policy-verdict error

    • Enables observation of l7 events with Error policy verdicts
    • Removes port translation from observe output by default (dropping the --port-translation flag)

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --port-translation flag for the hubble observe command is removed; port translation is no longer performed or configurable.