The Hubble UI
The Hubble UI draws the live service map: which workloads talk to which, and where traffic is dropped, updating as connections happen. It is the quickest way to see a namespace's real dependencies. It also has no login, so how you reach it matters more than usual.
Warning
The Hubble UI shows the full cluster flow data to anyone who can reach it, with no login screen. Never expose it on a type: LoadBalancer Service on a cluster shared by more than one team or reachable from the internet. That publishes your entire service map, unauthenticated, to anyone who reaches the IP.
How to reach it#
Port-forward, so nothing is exposed to the network:
$ kubectl port-forward -n kube-system svc/hubble-ui 12000:80
Then open http://localhost:12000. This is the right choice for a quick investigation by one person.
Put the UI behind an ingress with authentication, using the same OIDC or SSO your organization already uses, so people sign in with their own accounts. See Configure OIDC login . Scope who can reach it to the people who should see cluster-wide traffic.
Per-namespace views#
The UI filters by namespace, so once it is reachable, a team can look at their own namespace's flows without needing the whole cluster's map. Combined with authenticated ingress, that lets you give a team visibility into their own services without exposing everyone else's.
Combine it with the other signals#
Hubble shows network activity. For the full picture of what happened, put it next to audit logs (who did what to the Kubernetes API) and node integrity (whether a file changed on a node). A dropped flow in Hubble, an audit entry showing who changed the policy, and a clean integrity check together tell you far more than any one alone.
Alert on dropped packets
A rise in dropped packets means a workload is being blocked or probed, so alert on hubble_drop_total and keep a queryable flow log.
Monitor cluster and machine health
Syself runs the management cluster and heals your clusters, but the Cluster API objects it reconciles are yours to watch, so alert on their status.