Cilium connectivity test failures with native routing #1856

SargoDarya · 2025-08-03T10:28:30Z

SargoDarya
Aug 3, 2025

I'm trying to run a clean install for a cluster however when I try running the cilium connectivity test with Hubble enabled I receive the errors below.

main.tf

locals {
  hcloud_token = "xxxxxxxxxxx"
}

module "kube-hetzner" {
  providers = {
    hcloud = hcloud
  }
  hcloud_token = var.hcloud_token != "" ? var.hcloud_token : local.hcloud_token
  source = "kube-hetzner/kube-hetzner/hcloud"

  # * Your ssh public key
  ssh_public_key = file("~/.ssh/id_ed25519.pub")
  ssh_private_key = file("~/.ssh/id_ed25519")
  network_region = "eu-central"

  control_plane_nodepools = [
    {
      name        = "control-plane-nbg1",
      server_type = "cax11",
      location    = "nbg1",
      labels      = [],
      taints      = [],
      count       = 3,
      disable_ipv6 = true
    },
  ]

  agent_nodepools = [
    {
      name        = "agent-small",
      server_type = "cax11",
      location    = "nbg1",
      labels      = [],
      taints      = [],
      count       = 2,
      disable_ipv6 = true,

      longhorn_volume_size = 20
    }
  ]

  enable_wireguard = false
  load_balancer_type     = "lb11"
  load_balancer_location = "nbg1"

  base_domain = "cluster.capacitor.community"

  enable_longhorn = true

  hetzner_ccm_use_helm = true

  ingress_controller = "none"

  enable_klipper_metal_lb = true

  system_upgrade_use_drain = true

  kured_options = {
    "reboot-days": "su",
    "start-time": "3am",
    "end-time": "8am",
    "time-zone": "Local",
    "lock-ttl" : "30m",
  }

  cluster_name = "k3s"

  use_cluster_name_in_node_name = true

  restrict_outbound_traffic = false

  cni_plugin = "cilium"
  disable_kube_proxy = true

  cilium_version = "v1.17.0"
  cilium_routing_mode = "native"
  cilium_hubble_enabled = true
  cilium_hubble_metrics_enabled = [
    "policy:sourceContext=app|workload-name|pod|reserved-identity;destinationContext=app|workload-name|pod|dns|reserved-identity;labelsContext=source_namespace,destination_namespace"
  ]

  dns_servers = [
    "1.1.1.1",
    "8.8.8.8"
  ]
  additional_tls_sans = ["cp.cluster.capacitor.community"]

  export_values = true

  microos_arm_snapshot_id = "305195522"

  cert_manager_values = <<EOT
crds:
  enabled: true
  keep: true
config:
  apiVersion: controller.config.cert-manager.io/v1alpha1
  enableGatewayAPI: true
  kind: ControllerConfiguration
replicaCount: 3
webhook:
  replicaCount: 3
cainjector:
  replicaCount: 3
  EOT

  longhorn_values = <<EOT
defaultSettings:
  defaultDataPath: /var/longhorn
persistence:
  defaultFsType: ext4
  defaultClassReplicaCount: 3
  defaultClass: true
  EOT
}

provider "hcloud" {
  token = var.hcloud_token != "" ? var.hcloud_token : local.hcloud_token
}

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    hcloud = {
      source  = "hetznercloud/hcloud"
      version = ">= 1.51.0"
    }
  }
}

output "kubeconfig" {
  value     = module.kube-hetzner.kubeconfig
  sensitive = true
}

variable "hcloud_token" {
  sensitive = true
  default   = ""
}

With that configuration I receive the following errors when running the cilium connectivity test. Note that I opened up the firewall on Hetzner entirely.

❌ 19/74 tests failed (158/789 actions), 49 tests skipped, 0 scenarios skipped:
Test [no-policies]:
  🟥 no-policies/pod-to-service:curl-ipv4-0: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-same-node (10.43.181.48:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 2 failures (first: -1, last: -1, matched: 0)
  🟥 no-policies/pod-to-service:curl-ipv4-1: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-other-node (10.43.69.255:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 2 failures (first: -1, last: -1, matched: 0)
  🟥 no-policies/pod-to-service:curl-ipv4-2: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> cilium-test-1/echo-same-node (10.43.181.48:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 2 failures (first: -1, last: -1, matched: 0)
  🟥 no-policies/pod-to-service:curl-ipv4-3: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> cilium-test-1/echo-other-node (10.43.69.255:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 2 failures (first: -1, last: -1, matched: 0)
  🟥 no-policies/pod-to-service:curl-ipv4-4: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-other-node (10.43.69.255:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 2 failures (first: -1, last: -1, matched: 0)
  🟥 no-policies/pod-to-service:curl-ipv4-5: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-same-node (10.43.181.48:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 2 failures (first: -1, last: -1, matched: 0)
Test [allow-all-except-world]:
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> 78.47.165.87 (78.47.165.87:0): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> 49.13.160.168 (49.13.160.168:0): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> 91.98.22.229 (91.98.22.229:0): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> 91.99.231.125 (91.99.231.125:0): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> 91.98.22.229 (91.98.22.229:0): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> 91.99.231.125 (91.99.231.125:0): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> 78.47.165.87 (78.47.165.87:0): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> 49.13.160.168 (49.13.160.168:0): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> 91.99.231.125 (91.99.231.125:0): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> 78.47.165.87 (78.47.165.87:0): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> 162.55.187.188 (162.55.187.188:0): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> 91.98.22.229 (91.98.22.229:0): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-service:curl-ipv4-0: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-other-node (10.43.69.255:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 2 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-service:curl-ipv4-1: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-same-node (10.43.181.48:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 2 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-service:curl-ipv4-2: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> cilium-test-1/echo-same-node (10.43.181.48:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 2 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-service:curl-ipv4-3: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> cilium-test-1/echo-other-node (10.43.69.255:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 2 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-service:curl-ipv4-4: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-same-node (10.43.181.48:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 2 failures (first: -1, last: -1, matched: 0)
  🟥 allow-all-except-world/pod-to-service:curl-ipv4-5: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-other-node (10.43.69.255:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 2 failures (first: -1, last: -1, matched: 0)
Test [host-entity-egress]:
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> 91.99.231.125 (91.99.231.125:0): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> 78.47.165.87 (78.47.165.87:0): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> 49.13.160.168 (49.13.160.168:0): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> 91.98.22.229 (91.98.22.229:0): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> 49.13.160.168 (49.13.160.168:0): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> 91.98.22.229 (91.98.22.229:0): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> 91.99.231.125 (91.99.231.125:0): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> 78.47.165.87 (78.47.165.87:0): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> 78.47.165.87 (78.47.165.87:0): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> 162.55.187.188 (162.55.187.188:0): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> 91.98.22.229 (91.98.22.229:0): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 host-entity-egress/pod-to-host:ping-ipv4-external-ip: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> 91.99.231.125 (91.99.231.125:0): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
Test [client-egress-to-cidrgroup-deny]:
Test [client-egress-to-cidrgroup-deny-by-label]:
Test [client-egress-to-cidr-deny-default]:
  🟥 client-egress-to-cidr-deny-default/pod-to-cidr:external-1111-0: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> external-1111 (1.1.1.1:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-to-cidr-deny-default/pod-to-cidr:external-1111-1: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> external-1111 (1.1.1.1:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-to-cidr-deny-default/pod-to-cidr:external-1111-2: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> external-1111 (1.1.1.1:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
Test [node-to-node-encryption]:
  🟥 node-to-node-encryption/node-to-node-encryption:ping-ipv4: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/host-netns-8mjcl (10.0.0.102:0): Expected to capture packets, but none found. This check might be broken.
Test [echo-ingress-l7-via-hostport]:
  🟥 echo-ingress-l7-via-hostport/pod-to-hostport:curl-ipv4-2: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> cilium-test-1/echo-other-node-757d5b66fd-488mg (10.0.0.102:4000): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 2 failures (first: -1, last: -1, matched: 0)
Test [client-egress-l7-method]:
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-0-public: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-0-public (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-0-private: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-0-private (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-0-privatewith-header: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-0-privatewith-header (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-1-public: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-1-public (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-1-private: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-1-private (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-1-privatewith-header: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-1-privatewith-header (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-0-public: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-0-public (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-0-private: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-0-private (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-0-privatewith-header: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-0-privatewith-header (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-1-public: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-1-public (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-1-private: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-1-private (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-1-privatewith-header: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-1-privatewith-header (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-2-public: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> curl-ipv4-2-public (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 15, matched: 2)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-2-private: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> curl-ipv4-2-private (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 15, matched: 2)
  🟥 client-egress-l7-method/pod-to-pod-with-endpoints:curl-ipv4-2-privatewith-header: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> curl-ipv4-2-privatewith-header (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 15, matched: 2)
Test [client-egress-l7-method-port-range]:
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-0-public: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-0-public (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-0-private: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-0-private (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-0-privatewith-header: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-0-privatewith-header (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-2-public: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-2-public (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-2-private: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-2-private (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-2-privatewith-header: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-2-privatewith-header (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-0-public: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> curl-ipv4-0-public (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 15, matched: 2)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-0-private: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> curl-ipv4-0-private (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 15, matched: 2)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-0-privatewith-header: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> curl-ipv4-0-privatewith-header (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 15, matched: 2)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-1-public: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-1-public (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-1-private: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-1-private (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-1-privatewith-header: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> curl-ipv4-1-privatewith-header (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-2-public: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-2-public (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-2-private: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-2-private (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-method-port-range/pod-to-pod-with-endpoints:curl-ipv4-2-privatewith-header: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> curl-ipv4-2-privatewith-header (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
Test [client-egress-l7]:
  🟥 client-egress-l7/pod-to-pod:curl-ipv4-0: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-other-node-757d5b66fd-488mg (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7/pod-to-pod:curl-ipv4-1: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-same-node-799fbb4f76-tcppq (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7/pod-to-pod:curl-ipv4-4: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-same-node-799fbb4f76-tcppq (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7/pod-to-pod:curl-ipv4-5: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-other-node-757d5b66fd-488mg (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7/pod-to-world:https-to-one.one.one.one.-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7/pod-to-world:https-to-one.one.one.one.-index-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7/pod-to-world:http-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7/pod-to-world:https-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7/pod-to-world:https-to-one.one.one.one.-index-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7/pod-to-world:http-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7/pod-to-world:https-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7/pod-to-world:https-to-one.one.one.one.-index-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
Test [client-egress-l7-port-range]:
  🟥 client-egress-l7-port-range/pod-to-pod:curl-ipv4-2: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-other-node-757d5b66fd-488mg (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-port-range/pod-to-pod:curl-ipv4-3: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-same-node-799fbb4f76-tcppq (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-port-range/pod-to-pod:curl-ipv4-4: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-other-node-757d5b66fd-488mg (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-port-range/pod-to-pod:curl-ipv4-5: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-same-node-799fbb4f76-tcppq (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-port-range/pod-to-world:http-to-one.one.one.one.-ipv4-0: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-port-range/pod-to-world:https-to-one.one.one.one.-ipv4-0: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-port-range/pod-to-world:https-to-one.one.one.one.-index-ipv4-0: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-port-range/pod-to-world:http-to-one.one.one.one.-ipv4-1: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-port-range/pod-to-world:https-to-one.one.one.one.-ipv4-1: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-port-range/pod-to-world:https-to-one.one.one.one.-index-ipv4-1: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-port-range/pod-to-world:https-to-one.one.one.one.-ipv4-2: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-port-range/pod-to-world:https-to-one.one.one.one.-index-ipv4-2: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
Test [client-egress-l7-named-port]:
  🟥 client-egress-l7-named-port/pod-to-pod:curl-ipv4-0: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-other-node-757d5b66fd-488mg (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-named-port/pod-to-pod:curl-ipv4-1: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-same-node-799fbb4f76-tcppq (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-named-port/pod-to-pod:curl-ipv4-4: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-other-node-757d5b66fd-488mg (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-named-port/pod-to-pod:curl-ipv4-5: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-same-node-799fbb4f76-tcppq (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 client-egress-l7-named-port/pod-to-world:https-to-one.one.one.one.-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-named-port/pod-to-world:https-to-one.one.one.one.-index-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-named-port/pod-to-world:http-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-named-port/pod-to-world:https-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-named-port/pod-to-world:https-to-one.one.one.one.-index-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-named-port/pod-to-world:http-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-named-port/pod-to-world:https-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-l7-named-port/pod-to-world:https-to-one.one.one.one.-index-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
Test [client-egress-tls-sni]:
  🟥 client-egress-tls-sni/pod-to-world:http-to-one.one.one.one.-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-tls-sni/pod-to-world:http-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-tls-sni/pod-to-world:http-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
Test [client-egress-tls-sni-denied]:
  🟥 client-egress-tls-sni-denied/pod-to-world:http-to-one.one.one.one.-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-tls-sni-denied/pod-to-world:https-to-one.one.one.one.-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https (one.one.one.one.:443): command "curl --silent --fail --show-error --connect-timeout 2 --max-time 10 -4 -H Host: one.one.one.one -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code}\n --output /dev/null https://one.one.one.one.:443" succeeded while it should have failed: 10.42.0.81:45510 -> 1.1.1.1:443 = 200

  🟥 client-egress-tls-sni-denied/pod-to-world:https-to-one.one.one.one.-index-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https-index (one.one.one.one.:443): command "curl --silent --fail --show-error --connect-timeout 2 --max-time 10 -4 -H Host: one.one.one.one -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code}\n --output /dev/null https://one.one.one.one.:443/index.html" succeeded while it should have failed: 10.42.0.81:45514 -> 1.1.1.1:443 = 308

  🟥 client-egress-tls-sni-denied/pod-to-world:http-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-tls-sni-denied/pod-to-world:https-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https (one.one.one.one.:443): command "curl --silent --fail --show-error --connect-timeout 2 --max-time 10 -4 -H Host: one.one.one.one -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code}\n --output /dev/null https://one.one.one.one.:443" succeeded while it should have failed: 10.42.1.44:60638 -> 1.0.0.1:443 = 200

  🟥 client-egress-tls-sni-denied/pod-to-world:https-to-one.one.one.one.-index-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https-index (one.one.one.one.:443): command "curl --silent --fail --show-error --connect-timeout 2 --max-time 10 -4 -H Host: one.one.one.one -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code}\n --output /dev/null https://one.one.one.one.:443/index.html" succeeded while it should have failed: 10.42.1.44:58136 -> 1.1.1.1:443 = 308

  🟥 client-egress-tls-sni-denied/pod-to-world:http-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 client-egress-tls-sni-denied/pod-to-world:https-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https (one.one.one.one.:443): command "curl --silent --fail --show-error --connect-timeout 2 --max-time 10 -4 -H Host: one.one.one.one -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code}\n --output /dev/null https://one.one.one.one.:443" succeeded while it should have failed: 10.42.0.15:52158 -> 1.0.0.1:443 = 200

  🟥 client-egress-tls-sni-denied/pod-to-world:https-to-one.one.one.one.-index-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https-index (one.one.one.one.:443): command "curl --silent --fail --show-error --connect-timeout 2 --max-time 10 -4 -H Host: one.one.one.one -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code}\n --output /dev/null https://one.one.one.one.:443/index.html" succeeded while it should have failed: 10.42.0.15:51884 -> 1.0.0.1:443 = 308

Test [dns-only]:
  🟥 dns-only/pod-to-pod:curl-ipv4-0: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-other-node-757d5b66fd-488mg (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 dns-only/pod-to-pod:curl-ipv4-1: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> cilium-test-1/echo-same-node-799fbb4f76-tcppq (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: -1, last: -1, matched: 0)
  🟥 dns-only/pod-to-pod:curl-ipv4-2: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> cilium-test-1/echo-other-node-757d5b66fd-488mg (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 dns-only/pod-to-pod:curl-ipv4-3: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> cilium-test-1/echo-same-node-799fbb4f76-tcppq (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: -1, last: -1, matched: 0)
  🟥 dns-only/pod-to-pod:curl-ipv4-4: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-other-node-757d5b66fd-488mg (10.42.1.128:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 dns-only/pod-to-pod:curl-ipv4-5: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> cilium-test-1/echo-same-node-799fbb4f76-tcppq (10.42.0.84:8080): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: -1, last: -1, matched: 0)
  🟥 dns-only/pod-to-world:http-to-one.one.one.one.-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 dns-only/pod-to-world:https-to-one.one.one.one.-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 dns-only/pod-to-world:https-to-one.one.one.one.-index-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 dns-only/pod-to-world:http-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 dns-only/pod-to-world:https-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 dns-only/pod-to-world:https-to-one.one.one.one.-index-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 dns-only/pod-to-world:http-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 dns-only/pod-to-world:https-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 dns-only/pod-to-world:https-to-one.one.one.one.-index-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
Test [to-fqdns]:
  🟥 to-fqdns/pod-to-world-2:https-k8s.io.-ipv4-0: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> k8s.io.-https (k8s.io.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 to-fqdns/pod-to-world-2:https-k8s.io.-ipv4-1: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> k8s.io.-https (k8s.io.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
  🟥 to-fqdns/pod-to-world-2:https-k8s.io.-ipv4-2: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> k8s.io.-https (k8s.io.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 to-fqdns/pod-to-world:http-to-one.one.one.one.-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 2, last: 13, matched: 4)
  🟥 to-fqdns/pod-to-world:https-to-one.one.one.one.-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 2, last: 10, matched: 3)
  🟥 to-fqdns/pod-to-world:https-to-one.one.one.one.-index-ipv4-0: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 2, last: 10, matched: 3)
  🟥 to-fqdns/pod-to-world:http-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 2, last: 13, matched: 4)
  🟥 to-fqdns/pod-to-world:https-to-one.one.one.one.-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 2, last: 10, matched: 3)
  🟥 to-fqdns/pod-to-world:https-to-one.one.one.one.-index-ipv4-1: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 2, last: 10, matched: 3)
  🟥 to-fqdns/pod-to-world:http-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-http (one.one.one.one.:80): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 2, last: 13, matched: 4)
  🟥 to-fqdns/pod-to-world:https-to-one.one.one.one.-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 2, last: 10, matched: 3)
  🟥 to-fqdns/pod-to-world:https-to-one.one.one.one.-index-ipv4-2: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 2, last: 10, matched: 3)
Test [to-fqdns-with-proxy]:
  🟥 to-fqdns-with-proxy/pod-to-world:https-to-one.one.one.one.-ipv4-0: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 2, last: 10, matched: 3)
  🟥 to-fqdns-with-proxy/pod-to-world:https-to-one.one.one.one.-index-ipv4-0: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 2, last: 9, matched: 3)
  🟥 to-fqdns-with-proxy/pod-to-world:https-to-one.one.one.one.-ipv4-1: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 2, last: 10, matched: 3)
  🟥 to-fqdns-with-proxy/pod-to-world:https-to-one.one.one.one.-index-ipv4-1: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 2, last: 10, matched: 3)
  🟥 to-fqdns-with-proxy/pod-to-world:https-to-one.one.one.one.-ipv4-2: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 2, last: 9, matched: 3)
  🟥 to-fqdns-with-proxy/pod-to-world:https-to-one.one.one.one.-index-ipv4-2: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https-index (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 2, last: 10, matched: 3)
  🟥 to-fqdns-with-proxy/pod-to-world-2:https-k8s.io.-ipv4-0: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> k8s.io.-https (k8s.io.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 11, matched: 2)
  🟥 to-fqdns-with-proxy/pod-to-world-2:https-k8s.io.-ipv4-1: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> k8s.io.-https (k8s.io.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 11, matched: 2)
  🟥 to-fqdns-with-proxy/pod-to-world-2:https-k8s.io.-ipv4-2: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> k8s.io.-https (k8s.io.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 11, matched: 2)
Test [seq-client-egress-l7-tls-deny-without-headers]:
  🟥 seq-client-egress-l7-tls-deny-without-headers/pod-to-world-with-tls-intercept:https-to-one.one.one.one.-0: cilium-test-1/client-b65598b6f-mnfsj (10.42.0.15) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client-b65598b6f-mnfsj: 1 failures (first: 0, last: 19, matched: 3)
  🟥 seq-client-egress-l7-tls-deny-without-headers/pod-to-world-with-tls-intercept:https-to-one.one.one.one.-1: cilium-test-1/client2-84576868b4-5hvw2 (10.42.0.81) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client2-84576868b4-5hvw2: 1 failures (first: 0, last: 19, matched: 3)
  🟥 seq-client-egress-l7-tls-deny-without-headers/pod-to-world-with-tls-intercept:https-to-one.one.one.one.-2: cilium-test-1/client3-75555c5f5-5sdk6 (10.42.1.44) -> one.one.one.one.-https (one.one.one.one.:443): Flow validation failed for peer cilium-test-1/client3-75555c5f5-5sdk6: 1 failures (first: 0, last: 19, matched: 3)
[cilium-test-1] 19 tests failed

Cilium config:

#### Read-only configurations ####
ARPPingKernelManaged              : true
ARPPingRefreshPeriod              : 30000000000
AddressScopeMax                   : 252
AgentHealthPort                   : 9879
AgentLabels                       : []
AgentNotReadyNodeTaintKey         : node.cilium.io/agent-not-ready
AllocatorListTimeout              : 180000000000
AllowICMPFragNeeded               : true
AllowLocalhost                    : always
AnnotateK8sNode                   : false
AuthMapEntries                    : 524288
AutoCreateCiliumNodeResource      : true
BGPSecretsNamespace               : 
BPFCompileDebug                   : 
BPFConntrackAccounting            : false
BPFEventsDefaultBurstLimit        : 0
BPFEventsDefaultRateLimit         : 0
BPFEventsDropEnabled              : true
BPFEventsPolicyVerdictEnabled     : true
BPFEventsTraceEnabled             : true
BPFMapEventBuffers                : <nil>
BPFMapsDynamicSizeRatio           : 0.0025
BPFRoot                           : /sys/fs/bpf
BPFSocketLBHostnsOnly             : false
BootIDFile                        : /proc/sys/kernel/random/boot_id
BpfDir                            : /var/lib/cilium/bpf
BypassIPAvailabilityUponRestore   : false
CGroupRoot                        : /run/cilium/cgroupv2
CRDWaitTimeout                    : 300000000000
CTMapEntriesGlobalAny             : 65536
CTMapEntriesGlobalTCP             : 131072
CTMapEntriesTimeoutAny            : 60000000000
CTMapEntriesTimeoutFIN            : 10000000000
CTMapEntriesTimeoutSVCAny         : 60000000000
CTMapEntriesTimeoutSVCTCP         : 8000000000000
CTMapEntriesTimeoutSVCTCPGrace    : 60000000000
CTMapEntriesTimeoutSYN            : 60000000000
CTMapEntriesTimeoutTCP            : 8000000000000
CgroupPathMKE                     : 
ClockSource                       : 0
ClusterHealthPort                 : 4240
ClusterID                         : 0
ClusterMeshHealthPort             : 0
ClusterName                       : default
CompilerFlags                     : []
ConfigDir                         : /tmp/cilium/config-map
ConfigFile                        : 
ConntrackGCInterval               : 0
ConntrackGCMaxInterval            : 0
ContainerIPLocalReservedPorts     : auto
CreationTime                      : 2025-08-03T08:26:54.881372967Z
DNSMaxIPsPerRestoredRule          : 1000
DNSPolicyUnloadOnShutdown         : false
DNSProxyConcurrencyLimit          : 0
DNSProxyConcurrencyProcessingGracePeriod: 0
DNSProxyEnableTransparentMode     : true
DNSProxyInsecureSkipTransparentModeCheck: false
DNSProxyLockCount                 : 131
DNSProxyLockTimeout               : 500000000
DNSProxySocketLingerTimeout       : 10
DatapathMode                      : veth
Debug                             : false
DebugVerbose                      : []
Devices                           : [eth0 eth1]
DirectRoutingSkipUnreachable      : false
DisableCiliumEndpointCRD          : false
DisableExternalIPMitigation       : false
DryMode                           : false
EgressMultiHomeIPRuleCompat       : false
EnableAutoDirectRouting           : false
EnableAutoProtectNodePortRange    : true
EnableBGPControlPlane             : false
EnableBGPControlPlaneStatusReport : true
EnableBPFClockProbe               : false
EnableBPFMasquerade               : true
EnableBPFTProxy                   : false
EnableCiliumClusterwideNetworkPolicy: true
EnableCiliumEndpointSlice         : false
EnableCiliumNetworkPolicy         : true
EnableCustomCalls                 : false
EnableEncryptionStrictMode        : false
EnableEndpointHealthChecking      : true
EnableEndpointLockdownOnPolicyOverflow: false
EnableEndpointRoutes              : true
EnableEnvoyConfig                 : false
EnableExternalIPs                 : true
EnableHealthCheckLoadBalancerIP   : false
EnableHealthCheckNodePort         : true
EnableHealthChecking              : true
EnableHealthDatapath              : false
EnableHighScaleIPcache            : false
EnableHostFirewall                : false
EnableHostLegacyRouting           : false
EnableHostPort                    : true
EnableICMPRules                   : true
EnableIPIPTermination             : false
EnableIPMasqAgent                 : false
EnableIPSec                       : false
EnableIPSecEncryptedOverlay       : false
EnableIPSecXfrmStateCaching       : true
EnableIPsecKeyWatcher             : true
EnableIPv4                        : true
EnableIPv4EgressGateway           : false
EnableIPv4FragmentsTracking       : true
EnableIPv4Masquerade              : true
EnableIPv6                        : false
EnableIPv6Masquerade              : false
EnableIPv6NDP                     : false
EnableIdentityMark                : true
EnableInternalTrafficPolicy       : true
EnableK8sNetworkPolicy            : true
EnableK8sTerminatingEndpoint      : true
EnableL2Announcements             : false
EnableL2NeighDiscovery            : true
EnableL7Proxy                     : true
EnableLocalNodeRoute              : false
EnableLocalRedirectPolicy         : false
EnableMKE                         : false
EnableMasqueradeRouteSource       : false
EnableNat46X64Gateway             : false
EnableNodePort                    : true
EnableNodeSelectorLabels          : false
EnableNonDefaultDenyPolicies      : true
EnablePMTUDiscovery               : false
EnablePolicy                      : default
EnableRecorder                    : false
EnableRuntimeDeviceDetection      : true
EnableSCTP                        : false
EnableSRv6                        : false
EnableSVCSourceRangeCheck         : true
EnableSessionAffinity             : true
EnableSocketLB                    : true
EnableSocketLBPeer                : true
EnableSocketLBPodConnectionTermination: true
EnableSocketLBTracing             : true
EnableSourceIPVerification        : true
EnableTCX                         : true
EnableTracing                     : false
EnableUnreachableRoutes           : false
EnableVTEP                        : false
EnableWellKnownIdentities         : false
EnableWireguard                   : false
EnableXDPPrefilter                : false
EncryptInterface                  : []
EncryptNode                       : false
EncryptionStrictModeAllowRemoteNodeIdentities: false
EncryptionStrictModeCIDR          : 
EndpointQueueSize                 : 25
ExcludeLocalAddresses             : <nil>
ExcludeNodeLabelPatterns          : <nil>
ExternalClusterIP                 : false
ExternalEnvoyProxy                : true
FQDNProxyResponseMaxDelay         : 100000000
FQDNRegexCompileLRUSize           : 1024
FQDNRejectResponse                : refused
FixedIdentityMapping
FixedZoneMapping                  : <nil>
ForceDeviceRequired               : false
FragmentsMapEntries               : 8192
HTTP403Message                    : 
HealthCheckICMPFailureThreshold   : 3
HostV4Addr                        : 
HostV6Addr                        : 
IPAM                              : kubernetes
IPAMCiliumNodeUpdateRate          : 15000000000
IPAMDefaultIPPool                 : default
IPAMMultiPoolPreAllocation
        default                   : 8
IPMasqAgentConfigPath             : /etc/config/ip-masq-agent
IPSecKeyFile                      : 
IPsecKeyRotationDuration          : 300000000000
IPv4NativeRoutingCIDR
        IP                        : 10.42.0.0
        Mask                      : //8AAA==
IPv4NodeAddr                      : auto
IPv4PodSubnets                    : []
IPv4Range                         : auto
IPv4ServiceRange                  : auto
IPv6ClusterAllocCIDR              : f00d::/64
IPv6ClusterAllocCIDRBase          : f00d::
IPv6MCastDevice                   : 
IPv6NAT46x64CIDR                  : 64:ff9b::/96
IPv6NAT46x64CIDRBase              : 64:ff9b::
IPv6NativeRoutingCIDR             : <nil>
IPv6NodeAddr                      : auto
IPv6PodSubnets                    : []
IPv6Range                         : auto
IPv6ServiceRange                  : auto
IdentityAllocationMode            : crd
IdentityChangeGracePeriod         : 5000000000
IdentityRestoreGracePeriod        : 30000000000
InstallIptRules                   : true
InstallNoConntrackIptRules        : true
InstallUplinkRoutesForDelegatedIPAM: false
JoinCluster                       : false
K8sEnableLeasesFallbackDiscovery  : false
K8sNamespace                      : kube-system
K8sRequireIPv4PodCIDR             : true
K8sRequireIPv6PodCIDR             : false
K8sServiceCacheSize               : 128
K8sSyncTimeout                    : 180000000000
K8sWatcherEndpointSelector        : metadata.name!=kube-scheduler,metadata.name!=kube-controller-manager,metadata.name!=etcd-operator,metadata.name!=gcp-controller-manager
KVStore                           : 
KVStoreOpt
KVstoreConnectivityTimeout        : 120000000000
KVstoreKeepAliveInterval          : 300000000000
KVstoreLeaseTTL                   : 900000000000
KVstoreMaxConsecutiveQuorumErrors : 2
KVstorePeriodicSync               : 300000000000
KVstorePodNetworkSupport          : false
KeepConfig                        : false
KernelHz                          : 250
KubeProxyReplacement              : true
KubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
L2AnnouncerLeaseDuration          : 15000000000
L2AnnouncerRenewDeadline          : 5000000000
L2AnnouncerRetryPeriod            : 2000000000
LBAffinityMapEntries              : 0
LBBackendMapEntries               : 0
LBDevInheritIPAddr                : 
LBMaglevMapEntries                : 0
LBMapEntries                      : 65536
LBRevNatEntries                   : 0
LBServiceMapEntries               : 0
LBSourceRangeAllTypes             : false
LBSourceRangeMapEntries           : 0
LabelPrefixFile                   : 
Labels                            : []
LibDir                            : /var/lib/cilium
LoadBalancerAlgorithmAnnotation   : false
LoadBalancerDSRDispatch           : opt
LoadBalancerExternalControlPlane  : false
LoadBalancerModeAnnotation        : false
LoadBalancerProtocolDifferentiation: true
LoadBalancerRSSv4
        IP                        : 
        Mask                      : <nil>
LoadBalancerRSSv4CIDR             : 
LoadBalancerRSSv6
        IP                        : 
        Mask                      : <nil>
LoadBalancerRSSv6CIDR             : 
LocalRouterIPv4                   : 
LocalRouterIPv6                   : 
LogDriver                         : []
LogOpt
LogSystemLoadConfig               : false
LoopbackIPv4                      : 169.254.42.1
MTU                               : 1450
MasqueradeInterfaces              : []
MaxConnectedClusters              : 255
MaxControllerInterval             : 0
MaxInternalTimerDelay             : 0
Monitor
        cpus                      : 2
        npages                    : 64
        pagesize                  : 4096
MonitorAggregation                : medium
MonitorAggregationFlags           : 255
MonitorAggregationInterval        : 5000000000
NATMapEntriesGlobal               : 131072
NeighMapEntriesGlobal             : 131072
NodeEncryptionOptOutLabels        : [map[]]
NodeEncryptionOptOutLabelsString  : node-role.kubernetes.io/control-plane
NodeLabels                        : []
NodePortAcceleration              : native
NodePortAlg                       : random
NodePortBindProtection            : true
NodePortMax                       : 32767
NodePortMin                       : 30000
NodePortMode                      : snat
NodePortNat46X64                  : false
PolicyAccounting                  : true
PolicyAuditMode                   : false
PolicyCIDRMatchMode               : []
PolicyMapEntries                  : 16384
PolicyMapFullReconciliationInterval: 900000000000
PolicyTriggerInterval             : 1000000000
PreAllocateMaps                   : false
ProcFs                            : /host/proc
PrometheusServeAddr               : 
RestoreState                      : true
ReverseFixedZoneMapping           : <nil>
RouteMetric                       : 0
RoutingMode                       : native
RunDir                            : /var/run/cilium
SRv6EncapMode                     : reduced
ServiceNoBackendResponse          : reject
SizeofCTElement                   : 94
SizeofNATElement                  : 94
SizeofNeighElement                : 24
SizeofSockRevElement              : 52
SockRevNatEntries                 : 65536
SocketPath                        : /var/run/cilium/cilium.sock
StateDir                          : /var/run/cilium/state
TCFilterPriority                  : 1
ToFQDNsEnableDNSCompression       : true
ToFQDNsIdleConnectionGracePeriod  : 0
ToFQDNsMaxDeferredConnectionDeletes: 10000
ToFQDNsMaxIPsPerHost              : 1000
ToFQDNsMinTTL                     : 0
ToFQDNsPreCache                   : 
ToFQDNsProxyPort                  : 0
TracePayloadlen                   : 128
UseCiliumInternalIPForIPsec       : false
VLANBPFBypass                     : []
Version                           : false
VtepCIDRs                         : <nil>
VtepCidrMask                      : 
VtepEndpoints                     : <nil>
VtepMACs                          : <nil>
WireguardPersistentKeepalive      : 0
XDPMode                           : 
k8s-configuration                 : 
k8s-endpoint                      : 
##### Read-write configurations #####
ConntrackAccounting               : Disabled
ConntrackLocal                    : Disabled
Debug                             : Disabled
DebugLB                           : Disabled
DropNotification                  : Enabled
MonitorAggregationLevel           : Medium
PolicyAccounting                  : Enabled
PolicyAuditMode                   : Disabled
PolicyTracing                     : Disabled
PolicyVerdictNotification         : Enabled
SourceIPVerification              : Enabled
TraceNotification                 : Enabled
MonitorNumPages                   : 64
PolicyEnforcement                 : default

Cilium status:

KVStore:                Disabled   
Kubernetes:             Ok         1.31 (v1.31.11+k3s1) [linux/arm64]
Kubernetes APIs:        ["EndpointSliceOrEndpoint", "cilium/v2::CiliumClusterwideNetworkPolicy", "cilium/v2::CiliumEndpoint", "cilium/v2::CiliumNetworkPolicy", "cilium/v2::CiliumNode", "cilium/v2alpha1::CiliumCIDRGroup", "core/v1::Namespace", "core/v1::Pods", "core/v1::Service", "networking.k8s.io/v1::NetworkPolicy"]
KubeProxyReplacement:   True   [eth0   91.99.231.125 fe80::9000:6ff:fe4f:9bfe, eth1   10.255.0.101 fe80::8400:ff:feae:3a3 (Direct Routing)]
Host firewall:          Disabled
SRv6:                   Disabled
CNI Chaining:           none
CNI Config file:        successfully wrote CNI configuration file to /host/etc/cni/net.d/05-cilium.conflist
Cilium:                 Ok   1.17.0 (v1.17.0-c2bbf787)
NodeMonitor:            Listening for events on 2 CPUs with 64x4096 of shared memory
Cilium health daemon:   Ok   
IPAM:                   IPv4: 4/254 allocated from 10.42.2.0/24, 
Allocated addresses:
  10.42.2.103 (health)
  10.42.2.149 (router)
  10.42.2.188 (kube-system/kured-bh5s9)
  10.42.2.85 (kube-system/coredns-54856c55b8-t6rkw)
IPv4 BIG TCP:           Disabled
IPv6 BIG TCP:           Disabled
BandwidthManager:       Disabled
Routing:                Network: Native   Host: BPF
Attach Mode:            TCX
Device Mode:            veth
Masquerading:           BPF   [eth0, eth1]   10.42.0.0/16 [IPv4: Enabled, IPv6: Disabled]
Clock Source for BPF:   ktime
Controller Status:      32/32 healthy
  Name                                                  Last success   Last error   Count   Message
  cilium-health-ep                                      14s ago        never        0       no error   
  ct-map-pressure                                       15s ago        never        0       no error   
  daemon-validate-config                                21s ago        never        0       no error   
  dns-garbage-collector-job                             17s ago        never        0       no error   
  endpoint-1394-regeneration-recovery                   never          never        0       no error   
  endpoint-2452-regeneration-recovery                   never          never        0       no error   
  endpoint-432-regeneration-recovery                    never          never        0       no error   
  endpoint-991-regeneration-recovery                    never          never        0       no error   
  endpoint-gc                                           1m18s ago      never        0       no error   
  endpoint-periodic-regeneration                        17s ago        never        0       no error   
  ep-bpf-prog-watchdog                                  15s ago        never        0       no error   
  ipcache-inject-labels                                 16s ago        never        0       no error   
  k8s-heartbeat                                         17s ago        never        0       no error   
  link-cache                                            2s ago         never        0       no error   
  local-identity-checkpoint                             1h3m4s ago     never        0       no error   
  node-neighbor-link-updater                            5s ago         never        0       no error   
  proxy-ports-checkpoint                                1h56m16s ago   never        0       no error   
  resolve-identity-1394                                 1m3s ago       never        0       no error   
  resolve-identity-2452                                 1m15s ago      never        0       no error   
  resolve-identity-432                                  4m59s ago      never        0       no error   
  resolve-identity-991                                  21s ago        never        0       no error   
  resolve-labels-kube-system/coredns-54856c55b8-t6rkw   1h54m59s ago   never        0       no error   
  resolve-labels-kube-system/kured-bh5s9                1h56m3s ago    never        0       no error   
  sync-lb-maps-with-k8s-services                        1h56m16s ago   never        0       no error   
  sync-policymap-1394                                   11m1s ago      never        0       no error   
  sync-policymap-2452                                   11m9s ago      never        0       no error   
  sync-policymap-432                                    9m59s ago      never        0       no error   
  sync-policymap-991                                    11m9s ago      never        0       no error   
  sync-to-k8s-ciliumendpoint (1394)                     2s ago         never        0       no error   
  sync-to-k8s-ciliumendpoint (432)                      9s ago         never        0       no error   
  sync-utime                                            16s ago        never        0       no error   
  write-cni-file                                        1h56m18s ago   never        0       no error   
Proxy Status:            OK, ip 10.42.2.149, 0 redirects active on ports 10000-20000, Envoy: external
Global Identity Range:   min 256, max 65535
Hubble:                  Ok   Current/Max Flows: 4095/4095 (100.00%), Flows/s: 13.57   Metrics: Ok
KubeProxyReplacement Details:
  Status:                 True
  Socket LB:              Enabled
  Socket LB Tracing:      Enabled
  Socket LB Coverage:     Full
  Devices:                eth0   91.99.231.125 fe80::9000:6ff:fe4f:9bfe, eth1   10.255.0.101 fe80::8400:ff:feae:3a3 (Direct Routing)
  Mode:                   SNAT
  Backend Selection:      Random
  Session Affinity:       Enabled
  Graceful Termination:   Enabled
  NAT46/64 Support:       Disabled
  XDP Acceleration:       Native
  Services:
  - ClusterIP:      Enabled
  - NodePort:       Enabled (Range: 30000-32767) 
  - LoadBalancer:   Enabled 
  - externalIPs:    Enabled 
  - HostPort:       Enabled
  Annotations:
  - service.cilium.io/node
  - service.cilium.io/src-ranges-policy
  - service.cilium.io/type
BPF Maps:   dynamic sizing: on (ratio: 0.002500)
  Name                          Size
  Auth                          524288
  Non-TCP connection tracking   65536
  TCP connection tracking       131072
  Endpoint policy               65535
  IP cache                      512000
  IPv4 masquerading agent       16384
  IPv6 masquerading agent       16384
  IPv4 fragmentation            8192
  IPv4 service                  65536
  IPv6 service                  65536
  IPv4 service backend          65536
  IPv6 service backend          65536
  IPv4 service reverse NAT      65536
  IPv6 service reverse NAT      65536
  Metrics                       1024
  Ratelimit metrics             64
  NAT                           131072
  Neighbor table                131072
  Global policy                 16384
  Session affinity              65536
  Sock reverse NAT              65536
  Tunnel                        65536
Encryption:       Disabled        
Cluster health:   5/5 reachable   (2025-08-03T10:22:04Z)
Name              IP              Node   Endpoints
  k3s-control-plane-nbg1-ifx (localhost):
    Host connectivity to 10.255.0.101:
      ICMP to stack:   OK, RTT=143.322µs
      HTTP to agent:   OK, RTT=317.125µs
    Endpoint connectivity to 10.42.2.103:
      ICMP to stack:   OK, RTT=237.603µs
      HTTP to agent:   OK, RTT=755.171µs
  k3s-agent-small-oeg:
    Host connectivity to 10.0.0.101:
      ICMP to stack:   OK, RTT=1.321539ms
      HTTP to agent:   OK, RTT=956.654µs
    Endpoint connectivity to 10.42.0.1:
      ICMP to stack:   OK, RTT=1.344899ms
      HTTP to agent:   OK, RTT=1.180017ms
  k3s-agent-small-rzg:
    Host connectivity to 10.0.0.102:
      ICMP to stack:   OK, RTT=1.241418ms
      HTTP to agent:   OK, RTT=995.975µs
    Endpoint connectivity to 10.42.1.194:
      ICMP to stack:   OK, RTT=4.580506ms
      HTTP to agent:   OK, RTT=1.771586ms
  k3s-control-plane-nbg1-bse:
    Host connectivity to 10.255.0.103:
      ICMP to stack:   OK, RTT=653.61µs
      HTTP to agent:   OK, RTT=901.853µs
    Endpoint connectivity to 10.42.3.240:
      ICMP to stack:   OK, RTT=1.306819ms
      HTTP to agent:   OK, RTT=1.295178ms
  k3s-control-plane-nbg1-vme:
    Host connectivity to 10.255.0.102:
      ICMP to stack:   OK, RTT=4.976271ms
      HTTP to agent:   OK, RTT=1.016614ms
    Endpoint connectivity to 10.42.4.210:
      ICMP to stack:   OK, RTT=3.530331ms
      HTTP to agent:   OK, RTT=1.547543ms
Modules Health:
      agent
      ├── controlplane
      │   ├── auth
      │   │   ├── observer-job-auth-gc-identity-events            [OK] OK (2.2µs) [38] (41m, x1)
      │   │   ├── observer-job-auth-request-authentication        [OK] Primed (116m, x1)
      │   │   └── timer-job-auth-gc-cleanup                       [OK] OK (8.6µs) (78s, x1)
      │   ├── bgp-control-plane
      │   │   └── job-diffstore-events                            [OK] Running (116m, x2)
      │   ├── ciliumenvoyconfig
      │   │   └── experimental
      │   │       ├── job-reconcile                               [OK] OK, 0 object(s) (116m, x3)
      │   │       └── job-refresh                                 [OK] Next refresh in 30m0s (26m, x4)
      │   ├── daemon
      │   │   ├──                                                 [OK] daemon-validate-config (21s, x115)
      │   │   ├── ep-bpf-prog-watchdog
      │   │   │   └── ep-bpf-prog-watchdog                        [OK] ep-bpf-prog-watchdog (15s, x233)
      │   │   └── job-sync-hostips                                [OK] Synchronized (16s, x118)
      │   ├── dynamic-lifecycle-manager
      │   │   ├── job-reconcile                                   [OK] OK, 0 object(s) (56m, x4)
      │   │   └── job-refresh                                     [OK] Next refresh in 30m0s (26m, x4)
      │   ├── enabled-features
      │   │   └── job-update-config-metric                        [OK] Waiting for agent config (116m, x1)
      │   ├── endpoint-manager
      │   │   ├── cilium-endpoint-1394 (kube-system/kured-bh5s9)
      │   │   │   ├── cep-k8s-sync                                [OK] sync-to-k8s-ciliumendpoint (1394) (2s, x698)
      │   │   │   ├── datapath-regenerate                         [OK] Endpoint regeneration successful (17s, x59)
      │   │   │   └── policymap-sync                              [OK] sync-policymap-1394 (11m, x8)
      │   │   ├── cilium-endpoint-2452 (/)
      │   │   │   ├── datapath-regenerate                         [OK] Endpoint regeneration successful (17s, x61)
      │   │   │   └── policymap-sync                              [OK] sync-policymap-2452 (11m, x8)
      │   │   ├── cilium-endpoint-432 (kube-system/coredns-54856c55b8-t6rkw)
      │   │   │   ├── cep-k8s-sync                                [OK] sync-to-k8s-ciliumendpoint (432) (9s, x691)
      │   │   │   ├── datapath-regenerate                         [OK] Endpoint regeneration successful (17s, x59)
      │   │   │   └── policymap-sync                              [OK] sync-policymap-432 (9m59s, x8)
      │   │   ├── cilium-endpoint-991 (/)
      │   │   │   ├── datapath-regenerate                         [OK] Endpoint regeneration successful (17s, x63)
      │   │   │   └── policymap-sync                              [OK] sync-policymap-991 (11m, x8)
      │   │   └── endpoint-gc                                     [OK] endpoint-gc (78s, x24)
      │   ├── envoy-proxy
      │   │   ├── observer-job-k8s-secrets-resource-events-cilium-secrets    [OK] OK (27.28µs) [27] (37m, x1)
      │   │   └── timer-job-version-check                         [OK] OK (8.242118ms) (76s, x1)
      │   ├── hubble
      │   │   └── job-hubble                                      [OK] Running (116m, x1)
      │   ├── identity
      │   │   └── timer-job-id-alloc-update-policy-maps           [OK] OK (103.561µs) (41m, x1)
      │   ├── l2-announcer
      │   │   └── job-l2-announcer-lease-gc                       [OK] Running (116m, x1)
      │   ├── nat-stats
      │   │   └── timer-job-nat-stats                             [OK] OK (1.976349ms) (16s, x1)
      │   ├── node-manager
      │   │   ├── background-sync                                 [OK] Node validation successful (37s, x65)
      │   │   ├── neighbor-link-updater
      │   │   │   ├── k3s-agent-small-oeg                         [OK] Node neighbor link update successful (55s, x68)
      │   │   │   ├── k3s-agent-small-rzg                         [OK] Node neighbor link update successful (95s, x68)
      │   │   │   ├── k3s-control-plane-nbg1-bse                  [OK] Node neighbor link update successful (75s, x67)
      │   │   │   └── k3s-control-plane-nbg1-vme                  [OK] Node neighbor link update successful (35s, x68)
      │   │   ├── node-checkpoint-writer                          [OK] node checkpoint written (112m, x5)
      │   │   ├── nodes-add                                       [OK] Node adds successful (116m, x5)
      │   │   └── nodes-update                                    [OK] Node updates successful (113m, x12)
      │   ├── policy
      │   │   └── observer-job-policy-importer                    [OK] OK (294.324µs) [204] (36m, x1)
      │   ├── service-manager
      │   │   ├── job-health-check-event-watcher                  [OK] Waiting for health check events (116m, x1)
      │   │   └── job-service-reconciler                          [OK] 2 NodePort frontend addresses (116m, x1)
      │   ├── service-resolver
      │   │   └── job-service-reloader-initializer                [OK] Running (116m, x1)
      │   └── stale-endpoint-cleanup
      │       └── job-endpoint-cleanup                            [OK] Running (116m, x1)
      ├── datapath
      │   ├── agent-liveness-updater
      │   │   └── timer-job-agent-liveness-updater                [OK] OK (36.521µs) (0s, x1)
      │   ├── iptables
      │   │   ├── ipset
      │   │   │   ├── job-ipset-init-finalizer                    [OK] Running (116m, x1)
      │   │   │   ├── job-reconcile                               [OK] OK, 0 object(s) (56m, x3)
      │   │   │   └── job-refresh                                 [OK] Next refresh in 30m0s (26m, x4)
      │   │   └── job-iptables-reconciliation-loop                [OK] iptables rules full reconciliation completed (26m, x4)
      │   ├── l2-responder
      │   │   └── job-l2-responder-reconciler                     [OK] Running (116m, x1)
      │   ├── maps
      │   │   └── bwmap
      │   │       └── timer-job-pressure-metric-throttle          [OK] OK (2.72µs) (16s, x1)
      │   ├── mtu
      │   │   └── job-endpoint-mtu-updater                        [OK] Endpoint MTU updated (116m, x1)
      │   ├── node-address
      │   │   └── job-node-address-update                         [OK] 10.42.2.149 (primary), fe80::7c42:2cff:feb6:bfd6 (primary) (116m, x1)
      │   ├── orchestrator
      │   │   └── job-reinitialize                                [OK] OK (116m, x2)
      │   └── sysctl
      │       ├── job-reconcile                                   [OK] OK, 16 object(s) (6m8s, x216)
      │       └── job-refresh                                     [OK] Next refresh in 9m50.797146975s (6m8s, x1)
      └── infra
          ├── k8s-synced-crdsync
          │   └── job-sync-crds                                   [OK] Running (116m, x1)
          ├── metrics
          │   ├── job-collect                                     [OK] Sampled 24 metrics in 2.7584ms, next collection at 2025-08-03 10:26:57.339000392 +0000 UTC m=+7202.504440122 (76s, x1)
          │   └── timer-job-cleanup                               [OK] OK (2.187472ms) (56m, x1)
          └── shell
              ├── job-listener                                    [OK] Listening on /var/run/cilium/shell.sock (116m, x1)
              └── job-shell-0                                     [OK] Running (36m, x1)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Cilium connectivity test failures with native routing #1856

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Uh oh!

Cilium connectivity test failures with native routing #1856

Uh oh!

SargoDarya Aug 3, 2025

Replies: 0 comments

SargoDarya
Aug 3, 2025