Troubleshooting networks

Overview #

On this page: how to verify Ingress and Egress configuration. Network policy recommendations are in the Reference.

Ingress check #

1. Checking Ingress Controller pods #

kubectl get pods -n ingress -l app.kubernetes.io/name=shturval-ingress-controller

Make sure the pods are in Running state.

2. Checking Service and LoadBalancer #

kubectl get svc -n ingress

Check that the Ingress Service has an external IP (type LoadBalancer) or that it is using NodePort/other access mechanism.

3. Checking the Ingress resource #

kubectl get ingress -A
kubectl describe ingress <name> -n <namespace>

Make sure Ingress points to the correct backend (Service and port).

4. Check accessibility from outside #

curl -H "Host: app.example.com" http://<INGRESS_IP>/

Or through a browser using a domain name if DNS is configured.

5. Checking Ingress Controller logs #

kubectl logs -n ingress -l app.kubernetes.io/name=shturval-ingress-controller --tail=100

6. Network policies #

If Cilium Network Policies are enabled, make sure that incoming traffic from the Ingress Controller to the backend pods is allowed. See example allow-ingress.

Checking Egress Gateway #

1. Check Cilium Egress Gateway Policy #

kubectl get ciliumegressgatewaypolicies -A
kubectl describe ciliumegressgatewaypolicy <name>

2. Checking the node selector #

Make sure there is at least one available Worker node in the node selector. If there are no nodes or the selected node is unavailable, traffic will be denied.

kubectl get nodes -l <your-labels>

3. Checking outgoing traffic from the pod #

Launch a test pod in the target namespace and check the outgoing connection:

kubectl run test-egress --rm -it --image=curlimages/curl --restart=Never -n <namespace> -- curl -s -o /dev/null -w "%{http_code}" https://example.com

4. Checking the source IP #

If Egress Gateway is configured for a specific IP, check that traffic is leaving from this IP (for example, through an external service that logs the source IP).

5. Cilium and egress gateway #

Make sure Cilium supports egress gateway and it is enabled in the cluster configuration.