Cilium
Hard
Troubleshooting
An egress CiliumNetworkPolicy allows toFQDNs with matchName: api.example.com, but connections to that host are still dropped. The policy has no other rules. What is missing?
Select your answer:
Show answer and explanation
Answer: An egress rule allowing DNS to kube-dns with an L7 dns rule
Explanation
toFQDNs works by watching DNS answers. Cilium's DNS proxy reads the responses and adds the returned IPs to the policy. That only happens if the pod's DNS traffic to kube-dns is allowed and sent through the proxy with a rule such as 'rules: dns: - matchPattern: "*"'. Without it the policy never learns the IPs, and because the policy makes egress default-deny, the DNS queries themselves are blocked too.
More hard Cilium questions
- What does enabling Maglev consistent hashing in Cilium's kube-proxy replacement give you?
- What does Direct Server Return (DSR) mode change in Cilium's NodePort and LoadBalancer handling?
- How are encryption keys distributed when Cilium's transparent encryption uses WireGuard, compared with IPsec?
- Which command lists only the flows that Cilium dropped, for example because of a network policy?
- How can you roll out a new Cilium network policy without risking dropped traffic?
- You want a Cilium policy that limits which traffic can reach the Kubernetes nodes themselves. Which resource and selector do you use?