[Repo Assist] [feature]: add eBPF traffic observability via Hubble (ksail workload network)

[github-actions]

🤖 This issue was created by Repo Assist from the weekly roadmap.

User Story

As a KSail user running Cilium CNI,
I want a ksail workload network command that exposes Hubble traffic observability,
So that I can inspect live cluster traffic flows, debug connectivity issues, and visualize service dependencies without leaving the terminal.

Context

KSail already supports Cilium as a CNI option. Cilium ships with Hubble — a built-in eBPF-powered observability layer — but KSail does not currently expose it. Cilium/Hubble integration would:

• Close a significant UX gap vs. tools like Lens and k9s that surface network traffic
• Leverage an already-embedded dependency (Cilium CNI installer) with no new external deps
• Provide --format json output for AI/MCP consumption (structured flows → ksail chat context)

Identified in Weekly Strategy #4776 as a "Later" roadmap item.

Acceptance Criteria

• ksail workload network subcommand added (or ksail workload observe)
• When Cilium CNI is active and Hubble is enabled, streams or queries flow data via the Hubble API (gRPC observer.ObserverClient)
• Supports at least --namespace, --pod, --protocol, and --format json flags
• Graceful error when Cilium/Hubble is not the active CNI or Hubble is disabled
• Unit tests for command flag parsing; integration test notes in PR (requires Cilium cluster)
• Documentation added under docs/src/content/docs/ for the new command

Notes

• Complexity: Medium — Hubble gRPC client is in github.com/cilium/cilium (already in go.mod via Cilium CNI installer); no new dependencies expected
• Related: Cilium CNI installer in pkg/svc/installer/; Hubble relay is deployed by the Cilium Helm chart when hubble.relay.enabled=true
• The Hubble Observer API (hubble/api/v1/flow/flow.pb.go) provides structured Flow objects ideal for JSON serialization and AI consumption

Generated by 🤖 Repo Assist, see workflow run.

[devantler]

🤖 Generated by the Daily AI Assistant

Delivery-refresh triage (2026-06-30): all acceptance criteria are now met — recommend closing.

The ksail workload network command shipped across two merged increments and satisfies every AC:

AC	Status
ksail workload network subcommand	✅ pkg/cli/cmd/workload/network.go
Queries/streams flows via Hubble gRPC ObserverClient	✅ one-shot (#5530) + --follow live streaming (#5539)
--namespace, --pod, --protocol, --output json flags	✅ all present (plus --last, --server, --follow)
Graceful error when Cilium/Hubble not active	✅
Unit tests for flag parsing	✅ network_test.go + pkg/client/hubble/*_test.go
Documentation under docs/src/content/docs/	✅ workload-network.mdx

The remaining epic acceptance is integration-only (a real Cilium-cluster relay dial, which CI can't exercise). Recommend closing this issue as completed. Any further niceties — e.g. --since/--until time-window flags (Hubble's GetFlowsRequest supports since/until) — are beyond this issue's stated scope and, if wanted, are better filed as their own small enhancement rather than held open here.

[devantler]

🤖 Generated by the Daily AI Assistant

Closing as completed. All acceptance criteria are delivered on main (full evidence in the 2026-06-29 delivery-refresh triage above): ksail workload network shipped as one-shot (#5530) + --follow streaming (#5539), with the --namespace/--pod/--protocol/--output/--last/--server/--follow flags, graceful errors, unit tests (network_test.go + hubble/*_test.go), and docs (workload-network.mdx). The only remaining epic item is integration-only (a live Cilium-relay dial, which CI cannot run); --since/--until would be out-of-scope gold-plating and can be filed separately if wanted. Reopen if any gap remains.