/home/jenkins/workspace/Cilium-PR-Ginkgo-Tests-Kernel/k8s-1.17-gopath/src/github.com/cilium/cilium/test/ginkgo-ext/scopes.go:512
Unable to connect from "reviews-v1-75cfdb45f-5z5kq" to "ratings.default.svc.cluster.local:9080/health"
Expected command: kubectl exec -n default reviews-v1-75cfdb45f-5z5kq -- wget --tries=2 --connect-timeout 5 ratings.default.svc.cluster.local:9080/health
To succeed, but it failed:
Exitcode: 4
Stdout:
Stderr:
--2020-06-16 20:47:44-- http://ratings.default.svc.cluster.local:9080/health
Resolving ratings.default.svc.cluster.local (ratings.default.svc.cluster.local)... 10.100.69.129
Connecting to ratings.default.svc.cluster.local (ratings.default.svc.cluster.local)|10.100.69.129|:9080... failed: Connection timed out.
Retrying.
--2020-06-16 20:47:50-- (try: 2) http://ratings.default.svc.cluster.local:9080/health
Connecting to ratings.default.svc.cluster.local (ratings.default.svc.cluster.local)|10.100.69.129|:9080... failed: Connection timed out.
Giving up.
command terminated with exit code 4
/home/jenkins/workspace/Cilium-PR-Ginkgo-Tests-Kernel/k8s-1.17-gopath/src/github.com/cilium/cilium/test/k8sT/Services.go:1710
First wget that is allowed fails after policy import. Logs indicate that policy has been loaded and waited for. Same traffic succeeded before policy import. While the policy is an L7 policy, bpf policy map indicates no bytes/packets have been redirected to the proxy port, i.e., the packets have been dropped:
/sys/fs/bpf/tc/globals/cilium_policy_03066:
DIRECTION IDENTITY PORT/PROTO PROXY PORT BYTES PACKETS
Ingress 1 ANY NONE 0 0
Ingress 1665 9080/TCP 12076 0 0
Ingress 17588 9080/TCP 12076 0 0
Ingress 19077 9080/TCP 12076 0 0
Egress 0 ANY NONE 1850 16
The remote identity is 19077, and ipcache should have made the correct identity mapping:
10.10.1.43/32 19077 0 192.168.36.12
9f1afa3c_K8sServicesTest_Bookinfo_Demo_Tests_bookinfo_demo.zip
First
wgetthat is allowed fails after policy import. Logs indicate that policy has been loaded and waited for. Same traffic succeeded before policy import. While the policy is an L7 policy, bpf policy map indicates no bytes/packets have been redirected to the proxy port, i.e., the packets have been dropped:The remote identity is
19077, and ipcache should have made the correct identity mapping:9f1afa3c_K8sServicesTest_Bookinfo_Demo_Tests_bookinfo_demo.zip