cilium policy trace

Trace a policy decision

Synopsis

Verifies if the source is allowed to consume destination. Source / destination can be provided as endpoint ID, security ID, Kubernetes Pod, YAML file, set of LABELs. LABEL is represented as SOURCE:KEY[=VALUE]. dports can be can be for example: 80/tcp, 53 or 23/udp. If multiple sources and / or destinations are provided, each source is tested whether there is a policy allowing traffic between it and each destination. –src-k8s-pod and –dst-k8s-pod requires cilium-agent to be running with disable-endpoint-crd option set to “false”.

  1. cilium policy trace ( -s <label context> | --src-identity <security identity> | --src-endpoint <endpoint ID> | --src-k8s-pod <namespace:pod-name> | --src-k8s-yaml <path to YAML file> ) ( -d <label context> | --dst-identity <security identity> | --dst-endpoint <endpoint ID> | --dst-k8s-pod <namespace:pod-name> | --dst-k8s-yaml <path to YAML file>) [--dport <port>[/<protocol>] [flags]

Options

  1.       --dport strings         L4 destination port to search on outgoing traffic of the source label context and on incoming traffic of the destination label context
  2.   -d, --dst strings           Destination label context
  3.       --dst-endpoint string   Destination endpoint
  4.       --dst-identity int      Destination identity (default -1)
  5.       --dst-k8s-pod string    Destination k8s pod ([namespace:]podname)
  6.       --dst-k8s-yaml string   Path to YAML file for destination
  7.   -h, --help                  help for trace
  8.   -o, --output string         json| jsonpath='{}'
  9.   -s, --src strings           Source label context
  10.       --src-endpoint string   Source endpoint
  11.       --src-identity int      Source identity (default -1)
  12.       --src-k8s-pod string    Source k8s pod ([namespace:]podname)
  13.       --src-k8s-yaml string   Path to YAML file for source
  14.   -v, --verbose               Set tracing to TRACE_VERBOSE

Options inherited from parent commands

  1.       --config string   config file (default is $HOME/.cilium.yaml)
  2.   -D, --debug           Enable debug messages
  3.   -H, --host string     URI to server-side API

SEE ALSO