The module is automatically enabled when cni-cilium is used. To disable this module you can add to the deckhouse ConfigMap:

ciliumHubbleEnabled: "false"


  • authobject

    Options related to authentication or authorization in the Hubble web UI.

    • allowedUserGroupsarray of strings

      An array of user groups that can access Hubble web UI.

      This parameter is used if the user-authn module is enabled or the externalAuthentication parameter is set.

      Caution! Note that you must add those groups to the appropriate field in the DexProvider config if this module is used together with the user-authn one.

    • externalAuthenticationobject

      A set of parameters to enable external authentication (it is based on the Nginx Ingress external-auth mechanism that uses the Nginx auth_request module.

      The externalAuthentication parameters are set automatically if the user-authn module is enabled.

      • authSignInURLstring

        The URL to redirect the user for authentication (if the authentication service returned a non-200 HTTP response code).


      • authURLstring

        The URL of the authentication service. If the user is authenticated, the service should return an HTTP 200 response code.


    • passwordstring

      The password for http authorization of the admin user (it is generated automatically, but you can change it).

      This parameter is used if the externalAuthentication is not enabled.

    • whitelistSourceRangesarray of strings

      An array if CIDRs that are allowed to authenticate in Hubble web UI.


  • debugLoggingboolean

    Enabled debug logging for Cilium Hubble component.

    Default: false

  • httpsobject

    What certificate type to use.

    This parameter completely overrides the global.modules.https settings.


      mode: Disabled
      mode: OnlyInURI
      mode: CustomCertificate
        secretName: foobar
      mode: CertManager
        clusterIssuerName: letsencrypt
    • certManagerobject

      Parameters for certmanager.

      • clusterIssuerNamestring

        What ClusterIssuer to use for getting an SSL certificate (currently, letsencrypt, letsencrypt-staging, selfsigned are available; also, you can define your own).

        Default: "letsencrypt"


        clusterIssuerName: letsencrypt
        clusterIssuerName: letsencrypt-staging
        clusterIssuerName: selfsigned
    • customCertificateobject

      Parameters for custom certificate usage.

      • secretNamestring

        The name of the secret in the d8-system namespace to use with the Hubble web UI.

        This secret must have the format.

    • modestring

      The HTTPS usage mode:

      • CertManager — the web UI is accessed over HTTPS using a certificate obtained from a clusterIssuer specified in the certManager.clusterIssuerName parameter;
      • CustomCertificate — the web UI is accessed over HTTPS using a certificate from the d8-system namespace;
      • Disabled — in this mode, the documentation web UI can only be accessed over HTTP;
      • OnlyInURI — the documentation web UI will work over HTTP (thinking that there is an external HTTPS load balancer in front of it that terminates HTTPS traffic). All the links in the user-authn will be generated using the HTTPS scheme.

      Default: "CertManager"

      Allowed values: Disabled, CertManager, CustomCertificate, OnlyInURI

  • nodeSelectorobject

    The same as the spec.nodeSelector pod parameter in Kubernetes.

    If the parameter is omitted or false, it will be determined automatically.

  • tolerationsarray of objects

    The same as spec.tolerations for the Kubernetes Pod.

    If the parameter is omitted or false, it will be determined automatically.

    • effectstring
    • keystring
    • operatorstring
    • tolerationSecondsinteger
    • valuestring