diff --git a/pkg/apis/kops/networking.go b/pkg/apis/kops/networking.go
index 638ca02136..fd97620b50 100644
--- a/pkg/apis/kops/networking.go
+++ b/pkg/apis/kops/networking.go
@@ -441,7 +441,7 @@ type CiliumNetworkingSpec struct {
 	// Default: false
 	EnableRemoteNodeIdentity *bool `json:"enableRemoteNodeIdentity,omitempty"`
 	// Hubble configures the Hubble service on the Cilium agent.
-	Hubble HubbleSpec `json:"hubble,omitempty"`
+	Hubble *HubbleSpec `json:"hubble,omitempty"`
 
 	// RemoveCbrBridge is not implemented and may be removed in the future.
 	// Setting this has no effect.
diff --git a/pkg/apis/kops/v1alpha2/networking.go b/pkg/apis/kops/v1alpha2/networking.go
index a868f1f584..f1e9a94eec 100644
--- a/pkg/apis/kops/v1alpha2/networking.go
+++ b/pkg/apis/kops/v1alpha2/networking.go
@@ -439,7 +439,7 @@ type CiliumNetworkingSpec struct {
 	// Default: false
 	EnableRemoteNodeIdentity *bool `json:"enableRemoteNodeIdentity,omitempty"`
 	// Hubble configures the Hubble service on the Cilium agent.
-	Hubble HubbleSpec `json:"hubble,omitempty"`
+	Hubble *HubbleSpec `json:"hubble,omitempty"`
 
 	// RemoveCbrBridge is not implemented and may be removed in the future.
 	// Setting this has no effect.
diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go
index a78f57a14e..e4a77b4433 100644
--- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go
+++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go
@@ -1484,8 +1484,14 @@ func autoConvert_v1alpha2_CiliumNetworkingSpec_To_kops_CiliumNetworkingSpec(in *
 	out.EnableNodePort = in.EnableNodePort
 	out.EtcdManaged = in.EtcdManaged
 	out.EnableRemoteNodeIdentity = in.EnableRemoteNodeIdentity
-	if err := Convert_v1alpha2_HubbleSpec_To_kops_HubbleSpec(&in.Hubble, &out.Hubble, s); err != nil {
-		return err
+	if in.Hubble != nil {
+		in, out := &in.Hubble, &out.Hubble
+		*out = new(kops.HubbleSpec)
+		if err := Convert_v1alpha2_HubbleSpec_To_kops_HubbleSpec(*in, *out, s); err != nil {
+			return err
+		}
+	} else {
+		out.Hubble = nil
 	}
 	out.RemoveCbrBridge = in.RemoveCbrBridge
 	out.RestartPods = in.RestartPods
@@ -1570,8 +1576,14 @@ func autoConvert_kops_CiliumNetworkingSpec_To_v1alpha2_CiliumNetworkingSpec(in *
 	out.EnableNodePort = in.EnableNodePort
 	out.EtcdManaged = in.EtcdManaged
 	out.EnableRemoteNodeIdentity = in.EnableRemoteNodeIdentity
-	if err := Convert_kops_HubbleSpec_To_v1alpha2_HubbleSpec(&in.Hubble, &out.Hubble, s); err != nil {
-		return err
+	if in.Hubble != nil {
+		in, out := &in.Hubble, &out.Hubble
+		*out = new(HubbleSpec)
+		if err := Convert_kops_HubbleSpec_To_v1alpha2_HubbleSpec(*in, *out, s); err != nil {
+			return err
+		}
+	} else {
+		out.Hubble = nil
 	}
 	out.RemoveCbrBridge = in.RemoveCbrBridge
 	out.RestartPods = in.RestartPods
diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
index 90bde7c02e..ca20fa0715 100644
--- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
+++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go
@@ -386,7 +386,11 @@ func (in *CiliumNetworkingSpec) DeepCopyInto(out *CiliumNetworkingSpec) {
 		*out = new(bool)
 		**out = **in
 	}
-	in.Hubble.DeepCopyInto(&out.Hubble)
+	if in.Hubble != nil {
+		in, out := &in.Hubble, &out.Hubble
+		*out = new(HubbleSpec)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
diff --git a/pkg/apis/kops/validation/validation.go b/pkg/apis/kops/validation/validation.go
index a43ca3a1ca..90c1b75b33 100644
--- a/pkg/apis/kops/validation/validation.go
+++ b/pkg/apis/kops/validation/validation.go
@@ -709,7 +709,7 @@ func validateNetworkingCilium(cluster *kops.Cluster, v *kops.CiliumNetworkingSpe
 			allErrs = append(allErrs, field.Forbidden(versionFld, "Version 1.8 requires kubernetesVersion 1.12 or newer"))
 		}
 
-		if fi.BoolValue(v.Hubble.Enabled) {
+		if v.Hubble != nil && fi.BoolValue(v.Hubble.Enabled) {
 			if version.Minor < 8 {
 				allErrs = append(allErrs, field.Forbidden(fldPath.Root().Child("hubble", "enabled"), "Hubble requires Cilium 1.8 or newer"))
 			}
diff --git a/pkg/apis/kops/validation/validation_test.go b/pkg/apis/kops/validation/validation_test.go
index 1df10af153..fa73bca92e 100644
--- a/pkg/apis/kops/validation/validation_test.go
+++ b/pkg/apis/kops/validation/validation_test.go
@@ -630,7 +630,7 @@ func Test_Validate_Cilium(t *testing.T) {
 		{
 			Cilium: kops.CiliumNetworkingSpec{
 				Version: "v1.7.0",
-				Hubble: kops.HubbleSpec{
+				Hubble: &kops.HubbleSpec{
 					Enabled: fi.Bool(true),
 				},
 			},
@@ -639,7 +639,7 @@ func Test_Validate_Cilium(t *testing.T) {
 		{
 			Cilium: kops.CiliumNetworkingSpec{
 				Version: "v1.8.0",
-				Hubble: kops.HubbleSpec{
+				Hubble: &kops.HubbleSpec{
 					Enabled: fi.Bool(true),
 				},
 			},
diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go
index e51f78ba67..7cc4d1e603 100644
--- a/pkg/apis/kops/zz_generated.deepcopy.go
+++ b/pkg/apis/kops/zz_generated.deepcopy.go
@@ -486,7 +486,11 @@ func (in *CiliumNetworkingSpec) DeepCopyInto(out *CiliumNetworkingSpec) {
 		*out = new(bool)
 		**out = **in
 	}
-	in.Hubble.DeepCopyInto(&out.Hubble)
+	if in.Hubble != nil {
+		in, out := &in.Hubble, &out.Hubble
+		*out = new(HubbleSpec)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
diff --git a/pkg/model/components/cilium.go b/pkg/model/components/cilium.go
index 2f923dc666..2fb8f0e1bd 100644
--- a/pkg/model/components/cilium.go
+++ b/pkg/model/components/cilium.go
@@ -96,6 +96,17 @@ func (b *CiliumOptionsBuilder) BuildOptions(o interface{}) error {
 		c.EnableRemoteNodeIdentity = fi.Bool(true)
 	}
 
+	hubble := c.Hubble
+	if hubble != nil {
+		if hubble.Enabled == nil {
+			hubble.Enabled = fi.Bool(true)
+		}
+	} else {
+		c.Hubble = &kops.HubbleSpec{
+			Enabled: fi.Bool(false),
+		}
+	}
+
 	return nil
 
 }
diff --git a/upup/models/bindata.go b/upup/models/bindata.go
index 48bd5a1bba..c00299fa41 100644
--- a/upup/models/bindata.go
+++ b/upup/models/bindata.go
@@ -4553,7 +4553,7 @@ data:
   {{ end }}
   {{ end }}
 
-  {{ if .Hubble.Enabled }}
+  {{ if WithDefaultBool .Hubble.Enabled false }}
   # Enable Hubble gRPC service.
   enable-hubble: "true"
   # UNIX domain socket for Hubble server to listen to.
@@ -5222,7 +5222,7 @@ spec:
       {{ end }}
 {{ end }}
 
-{{ if .Networking.Cilium.Hubble.Enabled }}
+{{ if WithDefaultBool .Networking.Cilium.Hubble.Enabled false }}
 ---
 # Source: cilium/charts/hubble-relay/templates/service.yaml
 kind: Service
diff --git a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.8.yaml.template b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.8.yaml.template
index 51c946d6e3..52dacb4977 100644
--- a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.8.yaml.template
+++ b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.12-v1.8.yaml.template
@@ -166,7 +166,7 @@ data:
   {{ end }}
   {{ end }}
 
-  {{ if .Hubble.Enabled }}
+  {{ if WithDefaultBool .Hubble.Enabled false }}
   # Enable Hubble gRPC service.
   enable-hubble: "true"
   # UNIX domain socket for Hubble server to listen to.
@@ -835,7 +835,7 @@ spec:
       {{ end }}
 {{ end }}
 
-{{ if .Networking.Cilium.Hubble.Enabled }}
+{{ if WithDefaultBool .Networking.Cilium.Hubble.Enabled false }}
 ---
 # Source: cilium/charts/hubble-relay/templates/service.yaml
 kind: Service
diff --git a/upup/pkg/fi/cloudup/new_cluster_test.go b/upup/pkg/fi/cloudup/new_cluster_test.go
index df796956d5..379db86a5c 100644
--- a/upup/pkg/fi/cloudup/new_cluster_test.go
+++ b/upup/pkg/fi/cloudup/new_cluster_test.go
@@ -276,7 +276,6 @@ func TestSetupNetworking(t *testing.T) {
 					Networking: &api.NetworkingSpec{
 						Cilium: &api.CiliumNetworkingSpec{
 							EnableNodePort: true,
-							Hubble:         api.HubbleSpec{},
 						},
 					},
 				},
@@ -295,7 +294,6 @@ func TestSetupNetworking(t *testing.T) {
 						Cilium: &api.CiliumNetworkingSpec{
 							EnableNodePort: true,
 							EtcdManaged:    true,
-							Hubble:         api.HubbleSpec{},
 						},
 					},
 				},