Cilium
Hard
Troubleshooting
How does a client experience a request blocked by an L3/L4 Cilium policy, compared with one blocked by an L7 HTTP rule?
Select your answer:
Show answer and explanation
Answer: L3/L4: the connection times out. L7: an HTTP 403 response
Explanation
At L3/L4 the eBPF datapath drops the packets, so a TCP client usually retries its SYN until it times out. An L7 denial happens in Envoy after the connection is set up, and Envoy answers with '403 Access denied'. The symptom tells you which layer to look at. 'hubble observe --verdict DROPPED' lists the L3/L4 drops.
More hard Cilium questions
- With Cilium's default policy enforcement mode, when does a pod go from allowing all ingress traffic to denying everything that isn't explicitly allowed?
- In a CiliumNetworkPolicy, what does the entity 'world' match?
- An egress CiliumNetworkPolicy allows toFQDNs with matchName: api.example.com, but connections to that host are still dropped. The policy has no other rules. What is missing?
- What does enabling Maglev consistent hashing in Cilium's kube-proxy replacement give you?
- What does Direct Server Return (DSR) mode change in Cilium's NodePort and LoadBalancer handling?
- How are encryption keys distributed when Cilium's transparent encryption uses WireGuard, compared with IPsec?