Transit app docs say traffic is newly allowed, Endpoints look healthy, yet connections from a client Pod time out. What should administrators suspect?
Select an answer to reveal the explanation.
Short Explanation
Docs can say the bridge is open while the NetworkPolicy boom gate is still down. When Endpoints look fine but packets vanish, suspect policy drops.
Full Explanation
When transit docs say traffic is newly allowed, Endpoints look healthy, yet connections from a client Pod time out, administrators should suspect a NetworkPolicy (or similar policy layer) dropping traffic because Pod labels or rules do not actually permit the path. Docs can claim the bridge is open while the boom gate stays down. Services do not automatically refuse traffic when documentation strings change; docs are not an enforcement plane. ClusterIP addresses do not expire hourly and need recreation after every doc update; that invents a false lifecycle. kubectl logs --previous does not need to be run or else TCP timeouts are expected; log flags are unrelated to policy drops. Exam caveat: Also consider Calico/Cilium global policies and adminNetworkPolicies. Prove with connectivity from a labeled allow-listed debug pod versus a denied one. Operational check: Review NetworkPolicies in source and destination namespaces, fix selectors/ports/rules, retest from the client Pod, and update the transit runbook with the working policy. In municipal production practice, record the finding in the incident ticket with command output snippets, confirm the fix under change control, and re-validate the user-facing civic service before closing the change window.