cilium

Cilium status Check health of all Cilium components; wait until ready cilium status --wait #cilium#network Cilium connectivity test Run built-in end-to-end connectivity tests cilium connectivity test #cilium#network#debug List Cilium endpoints Show all Cilium-managed endpoints with security identity cilium endpoint list #cilium#network Hubble observe flows Live-stream network flows for a specific pod hubble observe --pod <ns>/<pod> -f #cilium#hubble#network#debug Hubble dropped flows Show only dropped/denied flows cluster-wide hubble observe --verdict DROPPED -f #cilium#hubble#network#debug Hubble observe namespace Show flows for all pods in a namespace over last 5 minutes hubble observe --namespace <ns> --since 5m #cilium#hubble#network List network policies All Cilium and standard NetworkPolicy resources kubectl get ciliumnetworkpolicies,networkpolicies -A #cilium#network Hubble status Show Hubble relay and observer status hubble status #cilium#hubble Monitor Cilium agent Real-time packet drops from Cilium dataplane cilium monitor --type drop #cilium#network#debug Enable Hubble UI Enable Hubble observability with the web UI cilium hubble enable --ui #cilium#cni#hubble#ui Hubble observe flows Stream live network flows through Hubble hubble observe --follow #cilium#cni#hubble#flows Test connectivity Run a full connectivity test suite in the cluster cilium connectivity test #cilium#cni#connectivity#test List endpoints Show all Cilium endpoints with their status cilium endpoint list #cilium#cni#endpoints Monitor network events Show dropped packets in real time cilium monitor --type drop #cilium#cni#monitor#drop Inspect BGP peers List BGP peers managed by Cilium BGP control plane cilium bgp peers #cilium#cni#bgp#networking Inspect endpoint internals Dump full endpoint state: identity, policy enforcement, BPF maps; run inside cilium pod cilium-dbg endpoint get <id> -o json | jq '.status.policy' #cilium#debug#k8s#network Datapath load balancer table List service VIP-to-backend mappings in BPF; verify kube-proxy-free LB programming cilium-dbg bpf lb list #cilium#network#k8s#troubleshooting Conntrack table entries Inspect BPF connection-tracking entries; spot stale/leaking flows on a node cilium-dbg bpf ct list global | head #cilium#debug#network#troubleshooting Trace policy by identity Explain allow/deny verdict between two security identities; debug NetworkPolicy drops cilium-dbg policy trace --src-identity <id> --dst-identity <id> --dport <port> #cilium#security#debug#k8s Verbose agent health Full per-node health: datapath mode, IPAM, BPF maps, controllers; first stop on issues cilium status --verbose #cilium#monitoring#troubleshooting#k8s Observe TCP egress to FQDN Live L3/L7 flows from a pod to a DNS name; validate FQDN-based egress policy hubble observe --protocol tcp --from-pod <ns>/<pod> --to-fqdn '*.example.com' #cilium#observability#dns#network ClusterMesh status Check cross-cluster connectivity and remote endpoint/identity sync health cilium clustermesh status --wait #cilium#network#troubleshooting#k8s BPF NAT table List BPF masquerade/NAT entries; debug SNAT port exhaustion or egress source IP cilium-dbg bpf nat list | head #cilium#network#debug#troubleshooting