k8s-cilium-troubleshooting
Use when networking fails on a Kubernetes cluster that runs Cilium as its CNI: traffic between pods dropped or timing out after a CiliumNetworkPolicy or CiliumClusterwideNetworkPolicy, "Policy denied" drops in Hubble, DNS that stops resolving after an egress policy, HTTP 403 "Access denied" from an L7 rule, toFQDNs rules that do not match, pods stuck ContainerCreating with "unable to connect to Cilium agent", Cilium agent or operator pods not ready, CiliumEndpoints not ready, or IPAM exhaustion. Investigates with kubectl get, describe, events and logs, asks before running cilium-dbg or hubble inside the agent, and proposes fixes. Reads first and asks before changing anything.
- License
- Apache-2.0
Pinned to revision ce7de97330d7, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/k8s-cilium-troubleshooting/SKILL.md
- skills/k8s-cilium-troubleshooting/.claude-plugin/plugin.json
- skills/k8s-cilium-troubleshooting/references/agent-and-datapath.md
- skills/k8s-cilium-troubleshooting/references/policies.md
Every link opens the file at its source, pinned to the revision this page describes.