Cilium & Hubble Network Observability

Manage eBPF-based networking using kubectl-mcp-server's Cilium tools (8 tools).

Requires the cilium toolset: start kubectl-mcp-server with --toolsets default,cilium (or MCP_TOOLSETS=default,cilium).

When to Apply

Use this skill when:

• User mentions: "Cilium", "Hubble", "eBPF", "network policy", "flow"
• Operations: network policy management, traffic observation, L7 filtering
• Keywords: "network security", "traffic flow", "dropped packets", "connectivity"

Priority Rules

Quick Reference

Check Installation

detect_ecosystem()

Cilium Status

cilium_get_status()

Network Policies

List Policies

cilium_list_policies(namespace="default")

Get Policy Details

cilium_get_policy(name="allow-web", namespace="default")

Create Cilium Network Policy

kubectl_apply(manifest="""
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-web
  namespace: default
spec:
  endpointSelector:
    matchLabels:
      app: web
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: frontend
    toPorts:
    - ports:
      - port: "80"
        protocol: TCP
  egress:
  - toEndpoints:
    - matchLabels:
        app: database
    toPorts:
    - ports:
      - port: "5432"
        protocol: TCP
""")

Endpoints

cilium_list_endpoints(namespace="default")

Identities

cilium_list_identities()

Nodes

cilium_list_nodes()

Hubble Flow Observability

get_hubble_flows(
    namespace="default",
    pod="my-pod",
    last="5m"
)

get_hubble_flows(
    namespace="default",
    verdict="DROPPED"
)

get_hubble_flows(
    namespace="default",
    protocol="http"
)

Create L7 Policy

kubectl_apply(manifest="""
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: api-policy
  namespace: default
spec:
  endpointSelector:
    matchLabels:
      app: api
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: frontend
    toPorts:
    - ports:
      - port: "8080"
        protocol: TCP
      rules:
        http:
        - method: GET
          path: "/api/v1/.*"
        - method: POST
          path: "/api/v1/users"
""")

Cluster Mesh

kubectl_apply(manifest="""
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: allow-cross-cluster
spec:
  endpointSelector:
    matchLabels:
      app: shared-service
  ingress:
  - fromEntities:
    - cluster
    - remote-node
""")

Troubleshooting Workflows

Pod Can't Reach Service

cilium_get_status()
cilium_list_endpoints(namespace)
cilium_list_policies(namespace)
get_hubble_flows(namespace, pod, verdict="DROPPED")

Policy Not Working

cilium_get_policy(name, namespace)
cilium_list_endpoints(namespace)
get_hubble_flows(namespace)

Network Performance Issues

cilium_get_status()
cilium_list_nodes()
get_hubble_flows(namespace, protocol="http")

Best Practices

1. Start with default deny: Create baseline deny-all policy
2. Use labels consistently: Policies rely on label selectors
3. Monitor with Hubble: Observe flows before/after policy changes
4. Test in staging: Verify policies don't break connectivity

Prerequisites

• Cilium: Required for all Cilium tools

  cilium install
  

Related Skills

• k8s-networking - Standard K8s networking
• k8s-security - Security policies
• k8s-service-mesh - Istio service mesh