Cilium
Hard
Troubleshooting
Which command lists only the flows that Cilium dropped, for example because of a network policy?
Select your answer:
Show answer and explanation
Answer: hubble observe --verdict DROPPED
Explanation
Hubble gives every flow a verdict such as FORWARDED, DROPPED, AUDIT or REDIRECTED. There is no DENIED verdict. Filtering on DROPPED shows the dropped flows with a reason such as 'Policy denied'. Add --namespace or --pod to narrow the output to the workload you're debugging.
More hard Cilium questions
- How can you roll out a new Cilium network policy without risking dropped traffic?
- You want a Cilium policy that limits which traffic can reach the Kubernetes nodes themselves. Which resource and selector do you use?
- Which of these is required to connect two clusters with Cilium ClusterMesh?
- How do you make a Service load-balance across all clusters in a Cilium ClusterMesh?
- How does Cilium's Bandwidth Manager enforce the kubernetes.io/egress-bandwidth annotation on a pod?
- Which Cilium resource defines the IP ranges that Cilium hands out to Services of type LoadBalancer?