Procedure

1. Check the pod logs for exhausted_retries events where error_class is RateLimitedError and error_message starts with Network error on:

   kubectl -n "$NS" logs --selector=job-name="$LATEST_JOB" \
     | jq -c 'select(.event=="exhausted_retries" and .error_class=="RateLimitedError"
       and (.error_message | startswith("Network error on")))'

   The error_message field indicates the source of the issue:

   • Network error on POST https://<your-ai-guard-host>/... — The pod cannot reach the AI Guard endpoint.
   • Network error on GET https://api.anthropic.com/... — The pod cannot reach the Anthropic Compliance API.

   Note Plain 429 rate-limit errors show error_message starting with Rate limited (429) on, not Network error on. If you do not see Network error on, the issue is not a connectivity problem.

2. If you enabled networkPolicy.enabled, confirm your cluster's CNI enforces NetworkPolicy resources and that the policy is configured correctly.
   When true, the policy restricts pod egress to cluster DNS (port 53) plus all TCP to any destination, excluding the cloud metadata IP (169.254.169.254). This requires a CNI that enforces NetworkPolicy resources, such as Cilium or Calico.

   A NetworkPolicy that is silently unenforced (for example, on a CNI without policy support) will not block traffic, but a misconfigured one can produce the same Network error on symptoms shown above.