CertGrid CertGrid
Hands-on Lab·Kubernetes and Cloud Native Security Associate

Network Flow Observability

Observability is a security control when it answers who talked to whom and whether it was allowed. This cluster's CNI already records that for every connection. This guide reads real flows, breaks the traffic with a policy, and reads the drop - then looks at what a flow record deliberately does not contain.

Platform Security Guide 36 of 42 Intermediate

Hubble is part of Cilium and is enabled here. Each agent sees only its own node's traffic; hubble-relay is what joins them. This is network observability and is not a substitute for API audit logging.

The cka5001 cluster: one control plane and 3 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA5001192.168.0.41Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA5001-NODE01192.168.0.42Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE02192.168.0.43Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE03192.168.0.44Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

This guide includes

Use this when a policy has to be proved rather than assumed. This matters because observability becomes a security control the moment it answers who talked to whom and whether it was allowed - a verdict, not merely a packet count.

Before you start

  1. What this cluster can already see

  2. Two Pods, one request, and the flows it made

  3. The same request after a policy says no

  4. What a flow record contains, and what it does not

Official sources

← All KCSA guides