---
title: "Get health of Cilium daemon"
method: GET
path: "/healthz"
tags: ["daemon"]
---

# Get health of Cilium daemon

`GET /healthz`

Returns health and status information of the Cilium daemon and related
components such as the connected datastore, Kubernetes integration and
Hubble.

## Headers

- `brief` boolean
- `require-k8s-connectivity` boolean

## Response `200`

Success

- StatusResponse — Health and status information of daemon +k8s:deepcopy-gen=true
  - `cilium` Status — Status of an individual component
    - `state` 'Ok' | 'Warning' | 'Failure' | 'Disabled' — State the component is in
    - `msg` string — Human readable status/error/warning message
  - `kvstore` Status — Status of an individual component
    - `state` 'Ok' | 'Warning' | 'Failure' | 'Disabled' — State the component is in
    - `msg` string — Human readable status/error/warning message
  - `cni-file` Status — Status of an individual component
    - `state` 'Ok' | 'Warning' | 'Failure' | 'Disabled' — State the component is in
    - `msg` string — Human readable status/error/warning message
  - `host-firewall` HostFirewall — Status of the host firewall +k8s:deepcopy-gen=true
    - `mode` 'Disabled' | 'Enabled'
    - `devices` string[]
  - `hubble` HubbleStatus — Status of the Hubble server +k8s:deepcopy-gen=true
    - `state` 'Ok' | 'Warning' | 'Failure' | 'Disabled' — State the component is in
    - `msg` string — Human readable status/error/warning message
    - `observer` object — Status of the Hubble observer +k8s:deepcopy-gen=true
      - `max-flows` integer — Maximum number of flows this Hubble observer is able to store
      - `current-flows` integer — Current number of flows this Hubble observer stores
      - `seen-flows` integer — Total number of flows this Hubble observer has seen
      - `uptime` string, duration — Uptime of this Hubble observer instance
  - `hubble-metrics` HubbleMetricsStatus — Status of the Hubble metrics server +k8s:deepcopy-gen=true
    - `state` 'Ok' | 'Warning' | 'Failure' | 'Disabled' — State the component is in
    - `msg` string — Human readable status/error/warning message
  - `kubernetes` K8sStatus — Status of Kubernetes integration +k8s:deepcopy-gen=true
    - `state` 'Ok' | 'Warning' | 'Failure' | 'Disabled' — State the component is in
    - `k8s-api-versions` string[]
    - `msg` string — Human readable status/error/warning message
  - `datapath-mode` 'veth' | 'netkit' | 'netkit-l2' — Operational datapath mode
  - `configured-datapath-mode` 'auto' | 'veth' | 'netkit' | 'netkit-l2' — Configured datapath mode
  - `attach-mode` 'tc' | 'tcx' — Core datapath attachment mode
  - `kube-proxy-replacement` KubeProxyReplacement — Status of kube-proxy replacement +k8s:deepcopy-gen=true
    - `mode` 'True' | 'False'
    - `devices` string[]
    - `deviceList` object[] — +k8s:deepcopy-gen=true
      - `name` string
      - `ip` string[] — +k8s:deepcopy-gen=true
    - `directRoutingDevice` string
    - `features` object — +k8s:deepcopy-gen=true
      - `nodePort` object
        - `enabled` boolean
        - `mode` 'SNAT' | 'DSR' | 'Hybrid'
        - `dsrMode` 'IP Option/Extension' | 'IPIP' | 'Geneve'
        - `algorithm` 'Random' | 'Maglev'
        - `acceleration` 'None' | 'Native' | 'Generic' | 'Best-Effort'
        - `portMin` integer
        - `portMax` integer
        - `lutSize` integer
      - `hostPort` object
        - `enabled` boolean
      - `externalIPs` object
        - `enabled` boolean
      - `hostReachableServices` object — +k8s:deepcopy-gen=true
        - `enabled` boolean
        - `protocols` string[]
      - `socketLB` object
        - `enabled` boolean
      - `sessionAffinity` object
        - `enabled` boolean
      - `gracefulTermination` object — Deprecated
        - `enabled` boolean
      - `nat46X64` object — +k8s:deepcopy-gen=true
        - `enabled` boolean
        - `service` object
          - `enabled` boolean
        - `gateway` object — +k8s:deepcopy-gen=true
          - `enabled` boolean
          - `prefixes` string[]
      - `socketLBTracing` object
        - `enabled` boolean
      - `bpfSocketLBHostnsOnly` boolean — flag bpf-lb-sock-hostns-only
      - `annotations` string[]
  - `ipam` IPAMStatus — Status of IP address management +k8s:deepcopy-gen=true
    - `allocations` AllocationMap — Map of allocated IPs
    - `ipv4` string[]
    - `ipv6` string[]
    - `status` string
  - `nodeMonitor` MonitorStatus — Status of the node monitor
    - `cpus` integer — Number of CPUs to listen on for events.
    - `npages` integer — Number of pages used for the perf ring buffer.
    - `pagesize` integer — Pages size used for the perf ring buffer.
    - `lost` integer — Number of samples lost by perf.
    - `unknown` integer — Number of unknown samples.
  - `cluster` ClusterStatus — Status of cluster +k8s:deepcopy-gen=true
    - `ciliumHealth` Status — Status of an individual component
      - `state` 'Ok' | 'Warning' | 'Failure' | 'Disabled' — State the component is in
      - `msg` string — Human readable status/error/warning message
    - `self` string — Name of local node (if available)
    - `nodes` NodeElement[] — List of known nodes
      - `name` string — Name of the node including the cluster association. This is typically <clustername>/<hostname>.
      - `primary-address` NodeAddressing — Addressing information of a node for all address families +k8s:deepcopy-gen=true
        - `ipv6` NodeAddressingElement — Addressing information
          - `enabled` boolean — True if address family is enabled
          - `ip` string — IP address of node
          - `alloc-range` string — Address pool to be used for local endpoints
          - `address-type` string — Node address type, one of HostName, ExternalIP or InternalIP
        - `ipv4` NodeAddressingElement — Addressing information
          - `enabled` boolean — True if address family is enabled
          - `ip` string — IP address of node
          - `alloc-range` string — Address pool to be used for local endpoints
          - `address-type` string — Node address type, one of HostName, ExternalIP or InternalIP
      - `secondary-addresses` NodeAddressingElement[] — Alternative addresses assigned to the node
        - `enabled` boolean — True if address family is enabled
        - `ip` string — IP address of node
        - `alloc-range` string — Address pool to be used for local endpoints
        - `address-type` string — Node address type, one of HostName, ExternalIP or InternalIP
      - `health-endpoint-address` NodeAddressing — Addressing information of a node for all address families +k8s:deepcopy-gen=true
        - `ipv6` NodeAddressingElement — Addressing information
          - `enabled` boolean — True if address family is enabled
          - `ip` string — IP address of node
          - `alloc-range` string — Address pool to be used for local endpoints
          - `address-type` string — Node address type, one of HostName, ExternalIP or InternalIP
        - `ipv4` NodeAddressingElement — Addressing information
          - `enabled` boolean — True if address family is enabled
          - `ip` string — IP address of node
          - `alloc-range` string — Address pool to be used for local endpoints
          - `address-type` string — Node address type, one of HostName, ExternalIP or InternalIP
      - `ingress-address` NodeAddressing — Addressing information of a node for all address families +k8s:deepcopy-gen=true
        - `ipv6` NodeAddressingElement — Addressing information
          - `enabled` boolean — True if address family is enabled
          - `ip` string — IP address of node
          - `alloc-range` string — Address pool to be used for local endpoints
          - `address-type` string — Node address type, one of HostName, ExternalIP or InternalIP
        - `ipv4` NodeAddressingElement — Addressing information
          - `enabled` boolean — True if address family is enabled
          - `ip` string — IP address of node
          - `alloc-range` string — Address pool to be used for local endpoints
          - `address-type` string — Node address type, one of HostName, ExternalIP or InternalIP
      - `source` string — Source of the node configuration
  - `controllers` ControllerStatus[] — Collection of controller statuses
    - `name` string — Name of controller
    - `uuid` string, uuid — UUID of controller
    - `configuration` object — Configuration of controller +deepequal-gen=true +k8s:deepcopy-gen=true
      - `interval` string, duration — Regular synchronization interval
      - `error-retry-base` string, duration — Base error retry back-off time
      - `error-retry` boolean — Retry on error
    - `status` object — Current status of controller +k8s:deepcopy-gen=true
      - `success-count` integer — Total number of successful runs
      - `last-success-timestamp` string, date-time — Timestamp of last success
      - `failure-count` integer — Total number of failed runs
      - `last-failure-timestamp` string, date-time — Timestamp of last error
      - `consecutive-failure-count` integer — Number of consecutive errors since last success
      - `last-failure-msg` string — Error message of last failed run
  - `proxy` ProxyStatus — Status of proxy +k8s:deepcopy-gen=true
    - `port-range` string — Port range used for proxying
    - `ip` string — IP address that the proxy listens on
    - `total-redirects` integer — Total number of ports configured to redirect to proxies
    - `total-ports` integer — Total number of listening proxy ports
    - `redirects` ProxyRedirect[] — Detailed description of configured redirects
      - `name` string — Name of the proxy redirect
      - `proxy` string — Name of the proxy this redirect points to
      - `proxy-port` integer — Host port that this redirect points to
    - `envoy-deployment-mode` 'embedded' | 'external' — Deployment mode of Envoy L7 proxy
  - `identity-range` IdentityRange — Status of identity range of the cluster
    - `min-identity` integer — Minimum identity of the cluster
    - `max-identity` integer — Maximum identity of the cluster
  - `ipv6-big-tcp` IPV6BigTCP — Status of IPv6 BIG TCP
    - `enabled` boolean — Is IPv6 BIG TCP enabled
    - `maxGRO` integer — Maximum IPv6 GRO size
    - `maxGSO` integer — Maximum IPv6 GSO size
  - `ipv4-big-tcp` IPV4BigTCP — Status of IPv4 BIG TCP
    - `enabled` boolean — Is IPv4 BIG TCP enabled
    - `maxGRO` integer — Maximum IPv4 GRO size
    - `maxGSO` integer — Maximum IPv4 GSO size
  - `bandwidth-manager` BandwidthManager — Status of bandwidth manager +k8s:deepcopy-gen=true
    - `enabled` boolean — Is bandwidth manager enabled
    - `devices` string[]
    - `congestionControl` 'cubic' | 'bbr'
  - `masquerading` Masquerading — Status of masquerading +k8s:deepcopy-gen=true
    - `enabled` boolean
    - `enabledProtocols` object — Is masquerading enabled
      - `ipv4` boolean — Is masquerading enabled for IPv4 traffic
      - `ipv6` boolean — Is masquerading enabled for IPv6 traffic
    - `mode` 'BPF' | 'iptables'
    - `ip-masq-agent` boolean — Is BPF ip-masq-agent enabled
    - `snat-exclusion-cidr` string — IP address prefix (CIDR)
    - `snat-exclusion-cidr-v4` string — IP address prefix (CIDR)
    - `snat-exclusion-cidr-v6` string — IP address prefix (CIDR)
  - `routing` Routing — Status of routing
    - `inter-host-routing-mode` 'Native' | 'Tunnel' — Datapath routing mode for cross-cluster connectivity
    - `intra-host-routing-mode` 'BPF' | 'Legacy' — Datapath routing mode for connectivity within the host
    - `tunnel-protocol` string — Tunnel protocol in use for cross-cluster connectivity
  - `clock-source` ClockSource — Status of BPF clock source
    - `mode` 'ktime' | 'jiffies' — Datapath clock source
    - `hertz` integer — Kernel Hz
  - `srv6` Srv6 — Status of the SRv6
    - `enabled` boolean
    - `srv6EncapMode` 'SRH' | 'Reduced'
  - `stale` object — List of stale information in the status
  - `client-id` integer — When supported by the API, this client ID should be used by the client when making another request to the server. See for example "/cluster/nodes".
  - `cluster-mesh` ClusterMeshStatus — Status of ClusterMesh +k8s:deepcopy-gen=true
    - `clusters` RemoteCluster[] — List of remote clusters
      - `name` string — Name of the cluster
      - `ready` boolean — Indicates readiness of the remote cluster
      - `connected` boolean — Indicates whether the connection to the remote kvstore is established
      - `synced` RemoteClusterSynced — Status of the synchronization with the remote cluster, about each resource type. A given resource is considered to be synchronized if the initial list of entries has been completely received from the remote cluster, and new events are currently being watched. +k8s:deepcopy-gen=true
        - `nodes` boolean — Nodes synchronization status
        - `services` boolean — Services synchronization status
        - `endpoint-slices` boolean, nullable — Endpoint slices synchronization status (null means that the component is not watching endpoint slices)
        - `service-exports` boolean, nullable — MCS-API service exports synchronization status (null means that the component is not watching service exports)
        - `endpoints` boolean — Endpoints synchronization status
        - `identities` boolean — Identities synchronization status
      - `config` RemoteClusterConfig — Cluster configuration exposed by the remote cluster +k8s:deepcopy-gen=true
        - `required` boolean — Whether the configuration is required to be present
        - `retrieved` boolean — Whether the configuration has been correctly retrieved
        - `cluster-id` integer — The Cluster ID advertised by the remote cluster
        - `kvstoremesh` boolean — Whether the remote cluster information is locally cached by kvstoremesh
        - `sync-canaries` boolean — Whether the remote cluster supports per-prefix "synced" canaries
        - `service-exports-enabled` boolean, nullable — Whether or not MCS-API ServiceExports is enabled by the cluster (null means unsupported).
        - `endpoint-slices-export-mode` 'services-and-endpointslices' | 'endpointslices-only' — EndpointSlices export mode advertised by the remote cluster
      - `num-nodes` integer — Number of nodes in the cluster
      - `num-shared-services` integer — Number of services in the cluster
      - `num-endpoint-slices` integer — Number of endpoint slices in the cluster
      - `num-service-exports` integer — Number of MCS-API service exports in the cluster
      - `num-identities` integer — Number of identities in the cluster
      - `num-endpoints` integer — Number of endpoints in the cluster
      - `status` string — Status of the control plane
      - `num-failures` integer — Number of failures reaching the cluster
      - `last-failure` string, date-time — Time of last failure that occurred while attempting to reach the cluster
  - `bpf-maps` BPFMapStatus — BPF map status +k8s:deepcopy-gen=true
    - `dynamic-size-ratio` number — Ratio of total system memory to use for dynamic sizing of BPF maps
    - `maps` BPFMapProperties[] — BPF maps
      - `name` string — Name of the BPF map
      - `size` integer — Size of the BPF map
  - `encryption` EncryptionStatus — Status of transparent encryption +k8s:deepcopy-gen=true
    - `mode` 'Disabled' | 'IPsec' | 'Wireguard' | 'Ztunnel'
    - `msg` string — Human readable error/warning message
    - `ipsec` IPsecStatus — Status of the IPsec agent +k8s:deepcopy-gen=true
      - `decrypt-interfaces` string[] — IPsec decryption interfaces
      - `max-seq-number` string — IPsec max sequence number
      - `keys-in-use` integer — IPsec keys in use
      - `error-count` integer — IPsec error count
      - `xfrm-errors` object — IPsec XFRM errors
    - `wireguard` WireguardStatus — Status of the WireGuard agent +k8s:deepcopy-gen=true
      - `node-encryption` string — Node Encryption status
      - `node-encrypt-opt-out-labels` string — Label selector for nodes which will opt-out of node-to-node encryption
      - `interfaces` WireguardInterface[] — WireGuard interfaces managed by this Cilium instance
        - `name` string — Name of the interface
        - `public-key` string — Public key of this interface
        - `listen-port` integer — Port on which the WireGuard endpoint is exposed
        - `peer-count` integer — Number of peers configured on this interface
        - `peers` WireguardPeer[] — Optional list of WireGuard peers
          - `public-key` string — Public key of this peer
          - `endpoint` string — Endpoint on which we are connected to this peer
          - `last-handshake-time` string, date-time — Timestamp of the last handshake with this peer
          - `transfer-tx` integer — Number of sent bytes
          - `transfer-rx` integer — Number of received bytes
          - `allowed-ips` string[] — List of IPs which may be routed through this peer
  - `cni-chaining` CNIChainingStatus — Status of CNI chaining
    - `mode` 'none' | 'aws-cni' | 'flannel' | 'generic-veth' | 'portmap'
  - `auth-certificate-provider` Status — Status of an individual component
    - `state` 'Ok' | 'Warning' | 'Failure' | 'Disabled' — State the component is in
    - `msg` string — Human readable status/error/warning message

---

[API](https://skmtc.net/cilium/apis/cilium-api.md) · [All operations](https://skmtc.net/cilium/apis/cilium-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cilium/cilium-api/revisions/c287d434d8b2/schema)