Proxy Datapath Update Timeout
criticalcilium_proxy_datapath_update_timeout increments when Envoy proxy configuration updates fail to apply within the timeout window. This causes L7 policy enforcement failures and can result in traffic being dropped or misrouted at the application layer.
Monitor cilium_proxy_datapath_update_timeout_datadog for non-zero values. When timeouts occur, L7 policies cannot be enforced correctly. Correlate with cilium_policy_l7_forwarded to determine impact on L7 traffic volumes.
Increase proxy update timeout configuration. Check Envoy logs for configuration rejection or slow processing. Verify that L7 policies are not overly complex. Monitor cilium_proxy_upstream_reply_seconds to rule out backend latency contributing to perceived timeout. Review Cilium agent CPU and memory to ensure proxy sidecar has sufficient resources.