We are using CiliumCIDRGroup resources to assign named identities to known external CIDR ranges (e.g., database subnets, monitoring services, API endpoints). The service map correctly creates separate nodes for each distinct CIDR identity — but they are all displayed as
"world". This results in multiple "world" nodes in the graph with no way to tell them apart visually.
Hubble flow details do show the correct labels (e.g., cidrgroup:io.cilium.policy.cidrgroupname/my-external-service), so the data is already there — it's just not used for the node display name.
Is this already possible through some configuration or approach we might be missing? If not, it would be great to have this supported.
Expected behavior: When a "world" node carries a cidrgroup:io.cilium.policy.cidrgroupname/ label, use as the display name instead of "world". For example, a node currently shown as "world" would appear as "my-external-service".
Looking at the current code, we believe the root cause is:
- backend/domain/labels/labels.go → Props() sets IsWorld = true when reserved:world label is present. Since CIDR identities always carry reserved:world alongside cidrgroup: labels, the name defaults to "world".
- backend/domain/service/service.go → Name() returns the "world" fallback without checking for CIDR group metadata.
A possible approach could be:
- In Props(): detect labels with prefix cidrgroup:io.cilium.policy.cidrgroupname/ and extract the group name.
- In Name(): when IsWorld is true but a CIDR group name exists, return it instead of "world".
The graph already handles the node separation correctly — this would be purely a display name change.
Environment: Cilium v1.17.9, Hubble UI v0.13.1. The cidrgroup: labels were added to ipcache in Cilium v1.17 via cilium/cilium#36087.
Many thanks and best regards,
We are using CiliumCIDRGroup resources to assign named identities to known external CIDR ranges (e.g., database subnets, monitoring services, API endpoints). The service map correctly creates separate nodes for each distinct CIDR identity — but they are all displayed as
"world". This results in multiple "world" nodes in the graph with no way to tell them apart visually.
Hubble flow details do show the correct labels (e.g., cidrgroup:io.cilium.policy.cidrgroupname/my-external-service), so the data is already there — it's just not used for the node display name.
Is this already possible through some configuration or approach we might be missing? If not, it would be great to have this supported.
Expected behavior: When a "world" node carries a cidrgroup:io.cilium.policy.cidrgroupname/ label, use as the display name instead of "world". For example, a node currently shown as "world" would appear as "my-external-service".
Looking at the current code, we believe the root cause is:
A possible approach could be:
The graph already handles the node separation correctly — this would be purely a display name change.
Environment: Cilium v1.17.9, Hubble UI v0.13.1. The cidrgroup: labels were added to ipcache in Cilium v1.17 via cilium/cilium#36087.
Many thanks and best regards,