Hubble
The observability layer on top of Cilium, showing which traffic actually flows in the cluster — and which rule stopped the traffic that doesn't.
Because Cilium already has eBPF programs in the datapath, the information is available without anything being added: no sidecars, no instrumentation in the applications, no measurable overhead. Hubble exposes it as flows with source, destination, protocol and verdict, and can parse HTTP, gRPC, Kafka and DNS at the application layer. From that it builds an automatic service map of what talks to what. The feature people actually install it for, though, is the verdict: debugging why a connection is denied in Kubernetes is otherwise a miserable process of guessing among network policies. The parts are the Hubble CLI, Hubble Relay for cluster-wide aggregation, and Hubble UI.