An egress lockdown looks complete and later a bootstrap path still manages to fetch external content during pod start.
A Cilium egress deny policy appears tight and one init container still...
The policy is correct for steady-state pods, yet the short init lifecycle finishes before the enforcement point catches up.
Scenario
What to check first
- Identify the primary failure signal in the The Deny Was Real and the Init Container Lived Too Briefly to Meet It scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Measure enforcement timing for init lifecycle paths before adding broad deny exceptions or disabling the init container.
Questions worth viewing together
Community-field security problem inspired by Cilium policy discussions where an init container outran egress deny enforcement. Short-lived container phases can expose timing windows that steady-state policy checks never reveal.
Teams often blame stale policy application broadly when the real issue is a lifecycle race on an init path.
Security validation should include init containers and bootstrap phases, not only long-running app containers.
Similar cases seen in the field