← Problem Library
K8s L6 K8S 1341 · 16 min

A Cilium cluster upgrade passes smoke tests and one namespace loses DNS egress

Policies look correct, yet selected workloads cannot reach one dependency because cached name-to-IP state outlives the assumptions of the new rule set.

K8sPlatform ReliabilityLevel 6Pro16 min
Scenario

After a network policy cleanup, only one namespace intermittently loses external access even though name resolution appears healthy from test pods.

What to check first
  • Identify the primary failure signal in the The Policy Expected Fresh DNS and the Node Still Remembered Yesterday scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Compare policy expectations with actual DNS cache lifetime before broadening egress rules.

Questions worth viewing together
What should you verify first when A Cilium cluster upgrade passes smoke tests and one namespace loses DNS egress appears?

Community-field Kubernetes problem inspired by Cilium and Discuss Kubernetes patterns where toFQDN policies collided with stale node-local DNS cache beh... Name-based egress policy can fail when stale DNS state survives longer than the new policy assumes.

What usually causes A Cilium cluster upgrade passes smoke tests and one namespace loses DNS egress in production?

Teams often blame policy syntax when stale DNS cache data is what still drives the decision.

What should you document after resolving A Cilium cluster upgrade passes smoke tests and one namespace loses DNS egress?

Cilium FQDN policies should be validated alongside node-local DNS caching behavior, not independently.