When a cluster runs a supported flow backend, a Network Flows row appears in the sidebar. Kubyl picks the backend automatically, in this order:
- Cilium Hubble Relay, over gRPC through a temporary loopback port-forward. TLS is supported.
- Calico Whisker.
- NetObserv, through Loki.
Override per cluster with netflow.clusters.<id>.backend (hubble, whisker, netobserv or off) and the matching hubble, whisker or loki endpoint settings. netflow.sidebar (default on) shows or hides the row.
| Backend | How Kubyl reaches it | Needs |
|---|---|---|
| Cilium Hubble Relay | gRPC through a temporary loopback port-forward. With server TLS (port 443) the CA is read from the ConfigMap kube-system/cilium-root-ca.crt (Cilium's tls.caBundle) or the hubble.ca_config_map, ca_file and server_name settings. | create pods/portforward in the Relay's namespace |
| Calico Whisker | A temporary port-forward to Whisker's HTTP API. The API server's service proxy does not work because Calico's policy blocks it. | create pods/portforward in calico-system |
| NetObserv | Loki and Prometheus through the API server's service proxy. | get services/proxy |
Flows and topology
The Flows table lists individual connections. The Topology is a force-directed graph you can zoom between Namespaces and Workloads. Nodes are sized by volume, edge width shows volume, and verdict styles distinguish forwarded, dropped (dashed) and no-reply traffic. Drag to pan, scroll to zoom, click to select and double-click to filter to a node or edge.
Scope a view to a cluster or a namespace (Open Namespace Network Flows on a favorite). The time window defaults to 15 minutes. Verdict chips above the table filter by forwarded, dropped and other verdicts and show counts. When the verdict is filtered on the server the other chips show no count rather than a wrong zero.
- Flow details show the connection, verdict, the policies that allowed or denied it as links, the reason for a drop, sanitized HTTP and DNS data and the backend's own fields, with Copy as hubble observe for Hubble. A plain NetworkPolicy cannot deny, it isolates: those drops are labelled "denied: isolated, no policy allows it" and have no policy name.
- Topology: a click selects a node or connection and opens a side panel. Double-click, Enter or Show flows filters the table to it. Hubble reports replies as separate flows, so the topology leaves them out like Hubble UI does, edges point from client to server and Show flows of an edge matches its count. Traffic inside one node is drawn as a loop. Nodes keep their place across refreshes.
- Where else: pods, workloads, Services and namespaces get a Flows section in their details. The palette has Network Flows: Show Network Flows, …of the Active Namespace, Show Flows for Selection and Look for a Flow Source Again. A split pane gets a compact layout.
- Empty states say why there is nothing: no source found (with a hint for your CNI), forbidden (naming the permission, for example port-forwarding), or still connecting.
| Keys | Action |
|---|---|
| Enter | Flow details (table) / show flows of the selection (topology) |
| Space | Pause |
| CorSorD | Filter to the connection / source / destination |
| T | Switch between flow table and topology |
| O | Open the pod |
| G | Jump to the newest flows |
| NorW | Topology by namespaces / workloads |
| F | Fit the graph |
| ]or[ | Next / previous connection |
Filter language
Keys: ns, pod, workload, ip, port, kind, node, service, label, proto, dir, verdict, policy, reason, bytes, packets, http.method, http.code, http.path and dns. Operators are =, !=, >, <, >= and <=. Commas mean OR, * is a glob, values can be quoted, a src. or dst. prefix restricts a term to one side, and bare words are free text. The filter box completes keys and values.
ns=payments verdict=dropped dst.port=5432,6379 src.workload=api-*Privacy
Flows are never saved to disk, only view options are. URL query values in HTTP flows are dropped unless you set netflow.keep_query_values. netflow.max_flows (20,000) and netflow.max_age_minutes (60) bound memory use.
Limitations
- Hubble with mutual TLS is reported as unsupported.
- Hubble doesn't report byte or packet counts per flow.
- NetObserv behind a LokiStack gateway shows metrics only.
- Drops on OVN-Kubernetes don't include ACL names.