Menu

Individual skill

k8s-cilium-troubleshooting

0upvotes

Use when networking fails on a Kubernetes cluster that runs Cilium as its CNI: traffic between pods dropped or timing out after a CiliumNetworkPolicy or CiliumClusterwideNetworkPolicy, "Policy denied" drops in Hubble, DNS that stops resolving after an egress policy, HTTP 403 "Access denied" from an L7 rule, toFQDNs rules that do not match, pods stuck ContainerCreating with "unable to connect to Cilium agent", Cilium agent or operator pods not ready, CiliumEndpoints not ready, or IPAM exhaustion. Investigates with kubectl get, describe, events and logs, asks before running cilium-dbg or hubble inside the agent, and proposes fixes. Reads first and asks before changing anything.

skills/k8s-cilium-troubleshooting/SKILL.md

Read pinned source

Source commit 6919c56810a3995714beecedaa8b516db82f41bc

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
No
Observed behavior
Not checked yet
Last checked
Nov 5, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
36
Repository last updated
Nov 8, 2026
License
Apache-2.0

Observed agent integration: claude-code

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Cilium troubleshooting

Find out why traffic fails on a cluster that runs Cilium, and propose a fix. **Read
first, ask before changing.** Run the investigation commands freely. Run a command under
an "Ask first" line only after the user approves that exact command; if your
credentials do not allow it, give it to the user to run. Never run a "Proposed fix";
hand it to the user.

Cilium gives each pod a **CiliumEndpoint** with a security **identity** derived from its
labels, and enforces Kubernetes NetworkPolicies, **CiliumNetworkPolicies** (one
namespace) and **CiliumClusterwideNetworkPolicies** by identity. Once any policy selects
an endpoint for a direction (ingress or egress), only what some policy allows gets
through in that direction. L7 rules (HTTP, DNS) send the traffic through Cilium's Envoy
proxy. **Hubble** records each flow with its verdict.
Back to top