A service mesh or sidecar rollout lands and later an egress policy stops matching destinations that look correct in application config.
A Cilium FQDN policy allows the expected hostname and traffic still fails
The destination is logically correct, yet the enforced DNS identity differs from the hostname operators think they allowed.
Scenario
What to check first
- Identify the primary failure signal in the The Policy Named the Destination and the Sidecar Asked for a Different Name Entirely scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Inspect the actual DNS query path before broadening FQDN policy or adding CIDR exceptions.
Questions worth viewing together
Community-field security problem inspired by Cilium and Kubernetes discussions where FQDN policy missed a sidecar-rewritten DNS query. FQDN policies operate on real DNS observations, not on the hostname string the application code appears to use.
Teams often blame stale DNS caches when the sidecar is rewriting the query into a different observed name.
Sidecar-induced name translation should be tested against DNS-observed egress policy enforcement, not just app configuration.
Similar cases seen in the field