<commit_before>Service Mesh Troubleshooting
============================


Install the Cilium CLI
----------------------

.. include:: /installation/cli-download.rst

Generic
-------

 #. Validate that the ``ds/cilium`` as well as the ``deployment/cilium-operator`` pods
    are healthy and ready.

    .. code-block:: shell-session

       $ cilium status

Manual Verification of Setup
----------------------------

 #. Validate that the ``kubeProxyReplacement`` is set to either partial or strict.

    .. code-block:: shell-session

        $ kubectl exec -n kube-system ds/cilium -- cilium status
        ...
        KVStore:                 Ok   Disabled
        Kubernetes:              Ok   1.23 (v1.23.6) [linux/amd64]
        KubeProxyReplacement:    Strict   [eth0 192.168.49.2]

 #. Validate that runtime the values of ``enable-envoy-config`` and ``enable-ingress-controller``
    are true. Ingress controller flag is optional if customer only uses ``CiliumEnvoyConfig`` or
    ``CiliumClusterwideEnvoyConfig`` CRDs.

    .. code-block:: shell-session

        $ kubectl -n kube-system get cm cilium-config -o json | egrep "enable-ingress-controller|enable-envoy-config"
                "enable-envoy-config": "true",
                "enable-ingress-controller": "true",

Ingress Troubleshooting
-----------------------

Internally, the Cilium Ingress controller will create one Load Balancer service, one
``CiliumEnvoyConfig`` and one dummy Endpoint resource for each Ingress resource.


    .. code-block:: shell-session

        $ kubectl get ingress
        NAME            CLASS    HOSTS   ADDRESS        PORTS   AGE
        basic-ingress   cilium   *       10.97.60.117   80      16m

        $ kubectl get service cilium-ingress-basic-ingress
        NAME                           TYPE           CLUSTER-IP     EXTERNAL-IP    PORT(S)        AGE
        cilium-ingress-basic-ingress   LoadBalancer   10.97.60.117   10.97.60.117   80:31911/TCP   17m

        $ kubectl get cec cilium-ingress-default-basic-ingress
        NAME                                   AGE
        cilium-ingress-default-basic-ingress   18m

 #. Validate that the Load Balancer service has either an external IP or FQDN assigned.
    If it's not available after a long time, please check the Load Balancer related
    documentation from your respective cloud provider.

 #. Check if there is any warning or error message while Cilium is trying to provision
    the ``CiliumEnvoyConfig`` resource. This is unlikely to happen for CEC resources
    originating from the Cilium Ingress controller.

    .. include:: /network/servicemesh/warning.rst


Connectivity Troubleshooting
----------------------------

This section is for troubleshooting connectivity issues mainly for Ingress resources, but
the same steps can be applied to manually configured ``CiliumEnvoyConfig`` resources as well.

It's best to have ``debug`` and ``debug-verbose`` enabled with below values. Kindly
note that any change of Cilium flags requires a restart of the Cilium agent and operator.

    .. code-block:: shell-session<commit_msg>docs: Update Ingress troubleshooting docs<commit_after>Service Mesh Troubleshooting
============================


Install the Cilium CLI
----------------------

.. include:: /installation/cli-download.rst

Generic
-------

 #. Validate that the ``ds/cilium`` as well as the ``deployment/cilium-operator`` pods
    are healthy and ready.

    .. code-block:: shell-session

       $ cilium status

Manual Verification of Setup
----------------------------

 #. Validate that the ``kubeProxyReplacement`` is set to either partial or strict.

    .. code-block:: shell-session

        $ kubectl exec -n kube-system ds/cilium -- cilium status
        ...
        KVStore:                 Ok   Disabled
        Kubernetes:              Ok   1.23 (v1.23.6) [linux/amd64]
        KubeProxyReplacement:    Strict   [eth0 192.168.49.2]

 #. Validate that runtime the values of ``enable-envoy-config`` and ``enable-ingress-controller``
    are true. Ingress controller flag is optional if customer only uses ``CiliumEnvoyConfig`` or
    ``CiliumClusterwideEnvoyConfig`` CRDs.

    .. code-block:: shell-session

        $ kubectl -n kube-system get cm cilium-config -o json | egrep "enable-ingress-controller|enable-envoy-config"
                "enable-envoy-config": "true",
                "enable-ingress-controller": "true",

Ingress Troubleshooting
-----------------------

Internally, the Cilium Ingress controller will create one Load Balancer service, one
``CiliumEnvoyConfig`` and one dummy Endpoint resource for each Ingress resource.


    .. code-block:: shell-session

        $ kubectl get ingress
        NAME            CLASS    HOSTS   ADDRESS        PORTS   AGE
        basic-ingress   cilium   *       10.97.60.117   80      16m

        # For dedicated Load Balancer mode
        $ kubectl get service cilium-ingress-basic-ingress
        NAME                           TYPE           CLUSTER-IP     EXTERNAL-IP    PORT(S)        AGE
        cilium-ingress-basic-ingress   LoadBalancer   10.97.60.117   10.97.60.117   80:31911/TCP   17m

        # For dedicated Load Balancer mode
        $ kubectl get cec cilium-ingress-default-basic-ingress
        NAME                                   AGE
        cilium-ingress-default-basic-ingress   18m

        # For shared Load Balancer mode
        $ kubectl get services -n kube-system cilium-ingress
        NAME             TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                      AGE
        cilium-ingress   LoadBalancer   10.111.109.99   10.111.109.99   80:32690/TCP,443:31566/TCP   38m

        # For shared Load Balancer mode
        $ kubectl get cec -n kube-system cilium-ingress
        NAME             AGE
        cilium-ingress   15m

 #. Validate that the Load Balancer service has either an external IP or FQDN assigned.
    If it's not available after a long time, please check the Load Balancer related
    documentation from your respective cloud provider.

 #. Check if there is any warning or error message while Cilium is trying to provision
    the ``CiliumEnvoyConfig`` resource. This is unlikely to happen for CEC resources
    originating from the Cilium Ingress controller.

    .. include:: /network/servicemesh/warning.rst


Connectivity Troubleshooting
----------------------------

This section is for troubleshooting connectivity issues mainly for Ingress resources, but
the same steps can be applied to manually configured ``CiliumEnvoyConfig`` resources as well.

It's best to have ``debug`` and ``debug-verbose`` enabled with below values. Kindly
note that any change of Cilium flags requires a restart of the Cilium agent and operator.

    .. code-block:: shell-session
{'fraction_non_alphanumeric': 0.10991601591277442, 'fraction_numerical': 0.02372182112862826, 'mean_word_length': 2.1498839907192577, 'pattern_counts': {'":': 4, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 10, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 8, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6610752', 'n_tokens_mistral': 2037, 'n_tokens_neox': 1850, 'n_words': 637}