Scenario
Cross-cluster service traffic fails only from one node pool after a Cilium peering update.
A Cilium policy rollout looks correct and one namespace still drops east-west traffic because the remote-node identity cache kept the retired cluster id
Endpoints are healthy, but one node still evaluates peers against the previous cluster identity after peering changes.
What to check first
- Identify the primary failure signal in the The Policy Was New and One Node Kept Calling Its Neighbor by the Name It Used Before the Boundary Changed scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Inspect remote identity caches before widening the allow policy.
Questions worth viewing together
No. Keep commands, logs, file names, APIs, and product names unchanged, then explain the reasoning in the selected UI language.
State the root cause, the evidence that supports it, and the safest recovery direction.
The source scenario is treated as an incident artifact. Guidance, checklist, hints, and explanations can be localized around it.
Similar cases seen in the field