cilium status: Check CNI and Mesh Health
cilium status (from the cilium-cli) summarizes the health of the Cilium DaemonSet, operator, Hubble, and cluster mesh in one view.
After installing or upgrading Cilium, status is the first gate: every component should be OK and every agent pod ready before workloads roll.
What it does
cilium status queries the Cilium components in the cluster and prints a rollup: the agent DaemonSet, the operator Deployment, Hubble Relay, and whether cluster mesh is enabled, with counts of ready versus desired pods and any errors or warnings each reports.
Common usage
cilium status
# block until everything is ready (CI gate)
cilium status --wait
# limit how long to wait
cilium status --wait --wait-duration 5mOptions
| Flag | What it does |
|---|---|
| --wait | Wait until all components are ready |
| --wait-duration <dur> | Maximum time to wait |
| -o json | Machine-readable output |
| -n, --namespace <ns> | Namespace Cilium is installed in (default kube-system) |
In CI
Use cilium status --wait right after install or upgrade so the pipeline blocks until the DaemonSet is fully ready, then proceeds. Without --wait you can race ahead of a rollout that is still converging.
Common errors in CI
"Error: Unable to determine status: ... no Cilium pods found" means Cilium is not installed or is in another namespace; pass -n. Component lines marked "1 errors" expand to the underlying reason (image pull, config). "context deadline exceeded" from --wait means the rollout did not finish in time, often a node that cannot schedule the agent.
Using this in CI
A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods
# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info
# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes