flake: allow-all/pod-to-world/http(s)-to-cilium-io fails #367
Description
Observed in #366 on EKS:
https://github.com/cilium/cilium-cli/pull/366/checks?check_run_id=2905226287
The flow logs indicate that a DNS request was made, but no TCP connection was ever established:
[.] Action [allow-all/pod-to-world/http-to-www-google: cilium-test/client-7b7bf54b85-h6qvt (10.0.1.205) -> www-google-http (www.google.com:80)]
❌ command "curl -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code} --silent --fail --show-error --connect-timeout 5 --output /dev/null http://www.google.com:80" failed: command terminated with exit code 28
📄 Matching flows for pod cilium-test/client-7b7bf54b85-h6qvt
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
⌛ Waiting (5s) for flows: Required flows not found yet
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
ℹ️ SYN and(ip(src=10.0.1.205),tcp(dstPort=80),tcpflags(syn)) not found
✅ DNS request found at 0
✅ DNS response found at 3
❌ Flow validation failed for pod cilium-test/client-7b7bf54b85-h6qvt: 1 failures (first: 0, last: 3, matched: 2)
It's not clear why there was never any TCP outgoing connection from curl. Unfortunately we don't seem to collect any L7 flows which would give us more insight into what the DNS response was.