Scenario
One node bypasses egress policy after identity translation rules change.
A Cilium policy rollout finishes and one node still bypasses egress rules because a pinned map entry kept the pre-translation identity
The new policy is active, but one node still matches traffic against an older security identity in a pinned BPF map.
What to check first
- Identify the primary failure signal in the The New Rulebook Reached the Node and One Guard Kept Reading the Guest Badge Number From the Card That Had Been Pinned to the Wall scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Inspect pinned BPF identities before restarting the agent.
Questions worth viewing together
No. Keep commands, logs, file names, APIs, and product names unchanged, then explain the reasoning in the selected UI language.
State the root cause, the evidence that supports it, and the safest recovery direction.
The source scenario is treated as an incident artifact. Guidance, checklist, hints, and explanations can be localized around it.
Similar cases seen in the field