Is it possible to use Cilium just for network observability?

You could potentially run Cilium in a chained mode to manage just the network policies, and that should be sufficient for observability. However, it's a significant alteration in your cluster setup, so I'd caution against it unless necessary.

Nope, if you want visibility, you also need to enable the networking features. Without those, there won't be anything to observe.

If you're looking for something similar but more agnostic, you might want to check out 'netobserv.' It works independently of CNI and can report things like NXDomain errors. Just ask if you need any help getting it set up!

You can actually use Cilium just for observability, but it can feel a bit heavy! If you enable Hubble, you'll gain per-pod DNS visibility, which might be exactly what you're missing right now instead of just those aggregated metrics. Just keep in mind that it's not a lightweight add-on; it's like replacing your entire networking stack. It could also be worthwhile to check the CoreDNS logs or enable more detailed metrics before going down that path.