Repository: prequel-dev/cre (go)

Issue:
Istio Ambient Troubleshooting Rules
### Turn a manual troubleshooting guide into a library of [CREs](https://docs.prequel.dev/cres/introduction)

We have a technical guide that walks through a specific set of reliability issues. Your task is to break it down into a structured set of CREs that can be shared with the community and used by `preq` to automate problem detection.

This a great opportunity to get hands-on experience with increasingly popular technologies.  

### 📌 What you’ll do

- Read the [guide](https://github.com/istio/istio/wiki/Troubleshooting-Istio-Ambient)
- Extract and document multiple CREs based on the key failure modes, signals, and remediations described.
- Submit them in the [Prequel CRE format](https://github.com/prequel-dev/cre#cre-format) following the structure of this repo.  

### ✅ What we’re looking for

- At least 10 high-quality CREs 


### 🏆 Award

**$325** if the submission hits all criteria

### ⚙️ Process
* We'll leave this bounty unassigned for 5 days [June 15 11:59 pm ET].  *We encourage anyone interested to comment /attempt #81 on the issue*
* We will then assign the bounty to a someone based on 
   * quality of plan 
   * past contributions
** The assignee will have 5 days to exclusively pursue the bounty. If the work is not completed, the bounty may be reassigned **


✅ **You must:**

1.  Reproduce the failure scenarios
2.  Share a minimal, working reproductions (e.g., Helm, Docker Compose, etc.)
3.  Write unique [CRE](https://docs.prequel.dev/cres/introduction)-format detection rules for [`preq`](https://github.com/prequel-dev/preq)
4. [Install](https://docs.prequel.dev/install) `preq` and run the rules

📦 **Deliverables:**

*  Reproduction setup and clear README
    *  create a private repo and invite the maintainers (@tonymeehan @lyndon-prequel)
*  Link to your rules in seperate [CRE playgrounds](https://play.prequel.dev/)
*  PR containing 
     * the new CRE rules
     * example logs in test.log files
     * updated tags.yaml and category.yaml files 
     * updated data-sources.yaml file
*  Demo video of 
   *  your reproductions
   *  running the rules

### 📅 Deadline

Will be assigned by June 15
Submit your pull request by **Submit by June 20 11:59 pm ET**

Questions? Open a discussion or find us on [slack](https://inviter.co/prequel). Happy hunting!

/bounty 325

Pull request description:
Add Istio Ambient critical upstream failure detection rule 
This PR adds a new CRE rule based on https://github.com/istio/istio/wiki/Troubleshooting-Istio-Ambient

Part of #81 
Closes #81 

## Test Environment
 **Live CRE link:** [Playground Link](https://play.prequel.dev/?data=EwBmFYFoQNk4CMAVBAOAXMA7OgzAFgDoZh9URwAtASAGcAXAQ3oFNr6BLAWxYBMACAPYBXevwDujDpwB2Ac34AzQQCcJqgNYAbQYwEByXi0WNhW%2BoSMmzYgBQBjYSq0AHQbwCU%2BpSsFd%2BAB68tNQAUKAQ0HCISKDoCAjxwIRY%2BDAgaTQMzGycPAIiYpLSHPJKquoq2roGVqbmlsb1do7Obp7eir7%2BQbRAA&rule=E4VwNgpgzgXAUAAgQWgQWwgFwIYBNs7xLEIDWAlgHa4wIAOwEAjiBGIiQuTQgEYBKAdgAeAVQBuAOQCeAGVwBxAIoAmOgBUAVgHUAXgE1SAUTocSAC2xRztAGrYAsgGYmAZVyyAYhAAadfpRo%2BnQA0gD2AFIAxmYIUYxEnNy0AML8RsgqAAwqAKzIWQCMWQAssUhQEOIQwOSY0rQq5QiYdZC0AEQAklCtYQgAgmi85BCUmC3A2ABm0%2BRRCNPY5GBQCADudeYt5Bi4CGEgE%2BvLrZQA5othwBvXpGBheIvAYWgIwrhQHc1RBBDn1waCA65F65DCyGww1G42QmBeIF4kGsYTCZ3O304CGwR3M11oAAVGCw2M1cNB4uQ6H1KLQAD7NJAALUwIEolDY6BAvUWWCi2zoYX26zuDyeVGm-WmLzePT6%2BzC1RuPgAIq4%2BBBJYwWmyOWAqOcAHSMhBdaZcCa4MLQSgAcgmjCiEHI1WxCEYUEFlEqGy2VAQAD9clAADQW90QTQQKKYNaYcwQOJhdnRmm%2B%2BOJLEAA1aewORw2pwNVxuIuA90e%2B0AZATPV7vT5Zw2m8Y1NB1TBjCaq9XksDYaRrND9k1UXDzP6msFCg5KsUKm5tqBRZNzc4gKZpgAUEENRoQBK6sgA8uoAPoqowAISPokkKSMp4GnnURn4AEpjVjftyIPSTag5XBfZQQQNlyRuBNsHEaQEBSAlRAAegwNBAXoD0oHXRNsGoBAoAedYWn6D0vVwT8sRQBBJCwMtSHoMJ9SiUY1muWDJC6bFtSRMIogoC46OACZClyIoVAQTduzfDVMHWCAxgQXRWRTMBsRwwChTIrFUAPY8zwva9b3vR9n1fA4bjRBMbiMShxDCGDyV4Q5KEYvjLDWXhZMoLgnMYKwIFI5pdjobAYz-ciKJSZMORjcFvRacwEXObYFN1TkqA7YA20wDtxjAGClhWdNtlzCBDgmGoXmAKANM4VABjoOgGIIGLB37A5eEqYBXVwF56r8iMSV6ZibkY4AohAOpAAQCXgfNIGpJipKrmky8hzia5NQvIroHAcIwVS6AYX0zGrYITHjJ3lOj9g9Q5RsTblsHOX8ECzUhEVTZTkE80E%2BmQKABw7N5MDCOhLrWb6gOQYQoazf9m09VN5MUvUEAec41i1CM6AgP59m7HYMFKxawtQKyMO1QUBIQISRIQdQ4K4Zisc89zpI87EwGUyghWgFTgKnfywvSFIj1sV99COkhUFcX5IFAkG1P2ckGtsjBxlMrz4mxn1rvXJ0ifI1B%2BCqUYCIwawIsoVdDW0k9zyvG87wfAAqXmIyVMrhCx2pVZwZT%2BWwx79ZIHA0Yl4hUHBsJYahEZO1h5KlOaRhphqMY9bDpBUHMLK6FgBCEMjw1wQQvsO16BCrSiKAEOB6v4UOJFoDxNEDQQmOYUwBCAGIlzGbBagheEZjmKJkHy1ZkE2eM4V2PzkFKyeiwuMfrkn0VKzHmVIc%2BZpsHqxqaVgWHKChJ7I8haE47CpAlSgGLOgAPgAXkKQ0VAANkNLJMWIUB2maSomAM4ICqJ2YBFQbpOloIXdunZDSoygCaIcmB%2BTgIoowR6whOjFQVAWE4dRiwYxonOBAhoXbSjrB8L4JoOSrQ7Gg1AGCIBYOBMuFM0VkxJjQA1LAEAOhAA)
 **Reproducible test setup (Maintainers invited) :**  [REPO LINK](https://github.com/varshith257/istio-repro/tree/main)

## DEMO


https://github.com/user-attachments/assets/6531dd34-8c5f-4abf-8b0f-7a922d322eed







Patch:
diff --git a/VERSION b/VERSION
index a7c1539..a02af24 100644
--- a/VERSION
+++ b/VERSION
@@ -1,1 +1,1 @@
-0.3.39
+0.3.40
diff --git a/rules/cre-2024-0014/rabbitmq-busy-dist-port.yaml b/rules/cre-2024-0014/rabbitmq-busy-dist-port.yaml
index 1f42b43..dcf86b8 100644
--- a/rules/cre-2024-0014/rabbitmq-busy-dist-port.yaml
+++ b/rules/cre-2024-0014/rabbitmq-busy-dist-port.yaml
@@ -1,6 +1,6 @@
 rules:
   - cre:
-      id: CRE-2024-0008
+      id: CRE-2024-0014
       severity: 1
       title: RabbitMQ busy distribution port performance issue
       category: message-queue-performance
diff --git a/rules/cre-2024-0019/loki-entries-behind.yaml b/rules/cre-2024-0019/loki-entries-behind.yaml
index 13b5060..0804ef2 100644
--- a/rules/cre-2024-0019/loki-entries-behind.yaml
+++ b/rules/cre-2024-0019/loki-entries-behind.yaml
@@ -1,6 +1,6 @@
 rules:
 - cre:
-    id: CRE-2025-0019
+    id: CRE-2024-0019
     severity: 3
     title: Alloy entries too far behind
     category: storage-problem
diff --git a/rules/cre-2024-0020/loki-fanout-crash.yaml b/rules/cre-2024-0020/loki-fanout-crash.yaml
index cc8001a..b69d683 100644
--- a/rules/cre-2024-0020/loki-fanout-crash.yaml
+++ b/rules/cre-2024-0020/loki-fanout-crash.yaml
@@ -1,6 +1,6 @@
 rules:
 - cre:
-    id: CRE-2025-0020
+    id: CRE-2024-0020
     severity: 2
     title: Grafana alloy Loki fanout crash
     category: storage-problem
diff --git a/rules/cre-2025-0075/nginx-upstream-failure-rule.yaml b/rules/cre-2025-0075/nginx-upstream-failure-rule.yaml
index 941d451..b112841 100644
--- a/rules/cre-2025-0075/nginx-upstream-failure-rule.yaml
+++ b/rules/cre-2025-0075/nginx-upstream-failure-rule.yaml
@@ -3,7 +3,7 @@ rules:
       id: CRE-2025-0075
       severity: 0
       title: Nginx Upstream Failure Cascade Crisis
-      category: load-balancer-problem
+      category: load-balancer-problems
       author: Prequel
       description: |
         Detects critical Nginx upstream failure cascades that lead to complete service unavailability.
diff --git a/rules/cre-2025-0076/slurm.yaml b/rules/cre-2025-0076/slurm.yaml
index 7e42aa1..498c674 100644
--- a/rules/cre-2025-0076/slurm.yaml
+++ b/rules/cre-2025-0076/slurm.yaml
@@ -12,7 +12,6 @@ rules:
       tags:
         - "slurm"
         - "slurmdbd"
-        - "database-problem"
         - "mysql"
         - "high-availability"
       author: "Prequel"
diff --git a/rules/cre-2025-0077/postgresql-failed-extend-full-disk.yaml b/rules/cre-2025-0077/postgresql-failed-extend-full-disk.yaml
index c9d9c61..b529908 100644
--- a/rules/cre-2025-0077/postgresql-failed-extend-full-disk.yaml
+++ b/rules/cre-2025-0077/postgresql-failed-extend-full-disk.yaml
@@ -1,45 +1,45 @@
 rules:
-- cre:
-    id: CRE-2025-0077
-    severity: 1
-    title: PostgreSQL Fails to Extend File Due to Disk Full
-    category: database-problem
-    author: André Muta
-    description: |
-      PostgreSQL logs an error when it cannot extend a data file (table/index) because
-      the filesystem is out of disk space. This prevents writes requiring new allocation.
-    cause: |
-      The disk partition hosting PostgreSQL's data directory (PGDATA) or related tablespaces is full,
-      often due to data growth, table bloat, or insufficient initial disk allocation.
-    impact: |
-      Prevents new data writes or updates that require more disk space, leading to failed transactions.
-      May escalate to a database PANIC if critical system components are affected.
-    impactScore: 9
-    tags:
-      - postgresql
-      - disk-full
-      - write-failure
-      - public
-    mitigation: |
-      - **Verify Disk Space:** Check the disk space usage of the PostgreSQL data directory and tablespaces.
-      - **Free OS-Level Space:** Delete non-PostgreSQL files (old logs, temp files) from the full partition.
-      - **Free PostgreSQL Space:** If accessible, `TRUNCATE` unneeded tables, `DELETE` old data and `VACUUM`, or `DROP` unused objects. `VACUUM FULL` reclaims more space but needs some free space to run and locks tables.
-      - **Expand Storage:** Increase the disk volume size at the OS or cloud provider level.
-      - **Preventative Measures:** Implement disk space monitoring with alerts (e.g., >80%), schedule regular `VACUUM` operations, and perform capacity planning.
-    mitigationScore: 7
-    references:
-      - https://www.postgresql.org/docs/current/storage-file-layout.html
-      - https://www.postgresql.org/docs/current/routine-vacuuming.html
-    applications:
-      - name: postgresql
-        version: '>=9.6'
-  metadata:
-    kind: prequel
-    id: CCz3K8qTkJAhHVBDjaESMa
-    gen: 1
-  rule:
-    set:
-      event:
-        source: cre.log.postgresql
-      match:
-      - regex: 'ERROR:  could not extend file "[^"]+": (No space left on device|wrote only \d+ of \d+ bytes at block \d+)'
+  - cre:
+      id: CRE-2025-0077
+      severity: 1
+      title: PostgreSQL Fails to Extend File Due to Disk Full
+      category: database-problem
+      author: André Muta
+      description: |
+        PostgreSQL logs an error when it cannot extend a data file (table/index) because
+        the filesystem is out of disk space. This prevents writes requiring new allocation.
+      cause: |
+        The disk partition hosting PostgreSQL's data directory (PGDATA) or related tablespaces is full,
+        often due to data growth, table bloat, or insufficient initial disk allocation.
+      impact: |
+        Prevents new data writes or updates that require more disk space, leading to failed transactions.
+        May escalate to a database PANIC if critical system components are affected.
+      impactScore: 9
+      tags:
+        - postgresql
+        - disk-full
+        - write-failure
+        - public
+      mitigation: |
+        - **Verify Disk Space:** Check the disk space usage of the PostgreSQL data directory and tablespaces.
+        - **Free OS-Level Space:** Delete non-PostgreSQL files (old logs, temp files) from the full partition.
+        - **Free PostgreSQL Space:** If accessible, `TRUNCATE` unneeded tables, `DELETE` old data and `VACUUM`, or `DROP` unused objects. `VACUUM FULL` reclaims more space but needs some free space to run and locks tables.
+        - **Expand Storage:** Increase the disk volume size at the OS or cloud provider level.
+        - **Preventative Measures:** Implement disk space monitoring with alerts (e.g., >80%), schedule regular `VACUUM` operations, and perform capacity planning.
+      mitigationScore: 7
+      references:
+        - https://www.postgresql.org/docs/current/storage-file-layout.html
+        - https://www.postgresql.org/docs/current/routine-vacuuming.html
+      applications:
+        - name: postgresql
+          version: '>=9.6'
+    metadata:
+      kind: prequel
+      id: CCz3K8qTkJAhHVBDjaESMa
+      gen: 1
+    rule:
+      set:
+        event:
+          source: cre.log.postgresql
+        match:
+        - regex: 'ERROR:  could not extend file "[^"]+": (No space left on device|wrote only \d+ of \d+ bytes at block \d+)'
diff --git a/rules/CRE-2025-0088/nats-slow-consumer-concise.yaml b/rules/cre-2025-0088/nats-slow-consumer-concise.yaml
similarity index 93%
rename from rules/CRE-2025-0088/nats-slow-consumer-concise.yaml
rename to rules/cre-2025-0088/nats-slow-consumer-concise.yaml
index 7377ca7..347388a 100644
--- a/rules/CRE-2025-0088/nats-slow-consumer-concise.yaml
+++ b/rules/cre-2025-0088/nats-slow-consumer-concise.yaml
@@ -7,7 +7,7 @@ rules:
       id: CRE-2025-0088
       severity: 1
       title: NATS JetStream Storage Exhaustion Detection
-      category: message-queue-problems
+      category: message-queue-problem
       author: Community
       description: |
         Detects NATS JetStream storage exhaustion conditions when streams reach configured
@@ -50,4 +50,5 @@ rules:
           source: cre.log.nats.jetstream
         match:
           - regex: '(?i)jetstream\s+failed\s+to\s+store.*maximum\s+bytes\s+exceeded'
-            count: 1%                                                                                               
\ No newline at end of file
+            count: 1
+     
\ No newline at end of file
diff --git a/rules/CRE-2025-0088/test.log b/rules/cre-2025-0088/test.log
similarity index 100%
rename from rules/CRE-2025-0088/test.log
rename to rules/cre-2025-0088/test.log
diff --git a/rules/cre-2025-0104/istio-ambient-xds.yaml b/rules/cre-2025-0104/istio-ambient-xds.yaml
new file mode 100644
index 0000000..49488dd
--- /dev/null
+++ b/rules/cre-2025-0104/istio-ambient-xds.yaml
@@ -0,0 +1,47 @@
+rules:
+  - metadata:
+      kind: prequel
+      id: kL4vRf5JnZh8Xy3WpQsVd2
+    cre:
+      id: CRE-2025-0104
+      severity: 2
+      title: "Istio Ambient traffic fails with timed out waiting for workload from xds"
+      category: "istio-ambient-troubleshooting"
+      author: Prequel
+      description: |
+        Ztunnel must fetch pod workload info from Istiod over XDS before tunneling.
+        If it doesn't receive a response within ~5s, it rejects the connection with:
+        `timed out waiting for workload … from xds`. Intermittent XDS delays may
+        indicate Istiod overload or misconfiguration (e.g. PILOT_DEBOUNCE_AFTER).
+      cause: |
+        - Istiod is under heavy CPU/memory pressure and slow to respond.
+        - Network policies or CNI are blocking port 15012 (XDS) between ztunnel and Istiod.
+        - PILOT_DEBOUNCE_AFTER or other Envoy debouncing has been increased.
+      impact: |
+        - Connections through ztunnel intermittently fail with timeout errors.
+        - Applications may observe dropped requests or circuit‐breaker trips.
+      mitigation: |
+        IMMEDIATE:
+        - Check Istiod pod resource usage: `kubectl -n istio-system top pods istiod-xxx`
+        - Inspect ztunnel logs for repeated XDS timeouts.
+        - Ensure port 15012 TCP is open between all nodes and istiod.
+        RECOVERY:
+        - Scale up Istiod deployment or increase resources.
+        - Review meshConfig.PILOT_DEBOUNCE_* and revert experimental changes.
+      tags:
+        - istio
+        - ambient
+        - ztunnel
+      references:
+        - https://github.com/istio/istio/wiki/Troubleshooting-Istio-Ambient#scenario-traffic-fails-with-timed-out-waiting-for-workload-from-xds
+      applications:
+        - name: istio-ambient
+          version: ">=1.26.0"
+    rule:
+      set:
+        event:
+          source: cre.log.ambient
+        match:
+          - regex: "timed out waiting for workload .* from xds"
+        negate:
+          - regex: "connection complete"
diff --git a/rules/cre-2025-0106/ambient-cni-sandbox-creation-failure.yaml b/rules/cre-2025-0106/ambient-cni-sandbox-creation-failure.yaml
new file mode 100644
index 0000000..a6232f5
--- /dev/null
+++ b/rules/cre-2025-0106/ambient-cni-sandbox-creation-failure.yaml
@@ -0,0 +1,53 @@
+rules:
+  - metadata:
+      kind: prequel
+      id: bK4nZmLxPdTQ8vHjsYUxVb
+      hash: QrT5yGdKWeXrTbnYpLsHcN
+    cre:
+      id: CRE-2025-0106
+      severity: 1
+      title: "Ambient CNI Sandbox Creation Failure"
+      category: "istio-ambient-troubleshooting"
+      author: Prequel
+      description: |
+        Detects when the Istio CNI plugin fails to set up a pod's network sandbox
+        in Ambient mode. Two common root causes are:
+        
+        1. **No ztunnel connection** (CNI cannot contact the node-level ztunnel agent).  
+      cause: |
+        - ztunnel DaemonSet is unscheduled or unhealthy on the node
+        - CNI plugin cannot dial the ztunnel Unix socket `/var/run/istio-cni/cni.sock`
+      impact: |
+        - Pods stuck in ContainerCreating or Pending
+        - Workloads cannot start, leading to application downtime
+      mitigation: |
+        IMMEDIATE:
+        - Verify ztunnel DaemonSet health: `kubectl -n istio-system get pods -l app=ztunnel`
+        - Inspect ztunnel logs for connectivity errors: 
+          `kubectl -n istio-system logs <ztunnel-pod>`
+
+        RECOVERY:
+        - Patch ztunnel to run on all nodes:
+          `kubectl -n istio-system patch daemonset ztunnel --patch '{"spec":{"template":{"spec":{"nodeSelector":{}}}}}'`
+        - Delete and recreate the affected pods
+        
+        PREVENTION:
+        - Monitor Istio CNI and ztunnel agent metrics
+        - Alert on repeated CNI plugin failures in control-plane logs
+      tags:
+        - istio
+        - cni
+        - ambient
+      references:
+        - https://github.com/istio/istio/wiki/Troubleshooting-Istio-Ambient#scenario-pod-fails-to-run-with-failed-to-create-pod-sandbox
+      applications:
+        - name: istio-cni
+          version: ">=1.26.0"
+    rule:
+      set:
+        window: 60s
+        event:
+          source: cre.log.ambient
+        match:
+          - regex: "FailedCreatePodSandBox"
+          - regex: "no ztunnel connection"
diff --git a/rules/cre-2025-0110/ztunnel-traffic.yaml b/rules/cre-2025-0110/ztunnel-traffic.yaml
index c8f8db2..f26d917 100644
--- a/rules/cre-2025-0110/ztunnel-traffic.yaml
+++ b/rules/cre-2025-0110/ztunnel-traffic.yaml
@@ -1,47 +1,47 @@
 rules:
-- metadata:
-    kind: prequel
-    id: bR7xUvNyLdGQ2pTjWzYkEp
-    hash: Bas4rDdGBqCLTnmYpKoJc
-  cre:
-    id: CRE-2025-0110
-    severity: 1
-    title: "Ztunnel Traffic timeouts in Istio Ambient Mode"
-    category: "istio-ambient-troubleshooting"
-    author: Prequel
-    description: |
-      Detects when Istio Ambient-mode HBONE (mTLS) traffic is blocked or dropped—
-      resulting in Ztunnel logging timeouts such as `io error: deadline has elapsed`
-      or `connection timed out, maybe a NetworkPolicy is blocking HBONE port 15008`.
-    cause: |
-      - NetworkPolicy or firewall rules blocking outbound port 15008
-      - Misconfigured CNI or host-level iptables preventing HBONE tunnels
-      - Node-level network segmentation or security groups dropping traffic
-    impact: |
-      - Pod-to-pod calls via ambient mode hang until timeout
-      - Application requests fail silently or with long delays
-      - Service reliability degraded due to hidden networking issues
-    tags:
-      - istio
-      - ambient
-      - ztunnel
-    mitigation: |
-      **IMMEDIATE:**
-      - Inspect/allow egress on port 15008 in NetworkPolicies or firewalls
-      - Verify host iptables aren't dropping HBONE traffic
-      - From a ztunnel pod:  
-        `kubectl exec -n istio-system <ztunnel-pod> -- nc -vz <pod-ip> 15008`
+  - metadata:
+      kind: prequel
+      id: bR7xUvNyLdGQ2pTjWzYkEp
+      hash: Bas4rDdGBqCLTnmYpKoJc
+    cre:
+      id: CRE-2025-0110
+      severity: 1
+      title: "Ztunnel Traffic timeouts in Istio Ambient Mode"
+      category: "istio-ambient-troubleshooting"
+      author: Prequel
+      description: |
+        Detects when Istio Ambient-mode HBONE (mTLS) traffic is blocked or dropped—
+        resulting in Ztunnel logging timeouts such as `io error: deadline has elapsed`
+        or `connection timed out, maybe a NetworkPolicy is blocking HBONE port 15008`.
+      cause: |
+        - NetworkPolicy or firewall rules blocking outbound port 15008
+        - Misconfigured CNI or host-level iptables preventing HBONE tunnels
+        - Node-level network segmentation or security groups dropping traffic
+      impact: |
+        - Pod-to-pod calls via ambient mode hang until timeout
+        - Application requests fail silently or with long delays
+        - Service reliability degraded due to hidden networking issues
+      tags:
+        - istio
+        - ambient
+        - ztunnel
+      mitigation: |
+        **IMMEDIATE:**
+        - Inspect/allow egress on port 15008 in NetworkPolicies or firewalls
+        - Verify host iptables aren't dropping HBONE traffic
+        - From a ztunnel pod:  
+          `kubectl exec -n istio-system <ztunnel-pod> -- nc -vz <pod-ip> 15008`
 
-      **LONG-TERM:**
-      - Enforce HBONE port rules in CI/CD
-      - Monitor ztunnel logs for frequent timeouts & alert
-    references:
-      - https://github.com/istio/istio/wiki/Troubleshooting-Istio-Ambient#scenario-traffic-timeout-with-ztunnel
-  rule:
-    set:
-      window: 180s
-      event:
-        source: cre.log.ambient
-      match:
-      - regex: 'error +access +connection +complete +.*error="io error: deadline has elapsed"'
-      - regex: 'error +access +connection +complete +.*error="connection timed out, maybe a NetworkPolicy is blocking HBONE port 15008: deadline has elapsed"'
+        **LONG-TERM:**
+        - Enforce HBONE port rules in CI/CD
+        - Monitor ztunnel logs for frequent timeouts & alert
+      references:
+        - https://github.com/istio/istio/wiki/Troubleshooting-Istio-Ambient#scenario-traffic-timeout-with-ztunnel
+    rule:
+      set:
+        window: 180s
+        event:
+          source: cre.log.ambient
+        match:
+        - regex: 'error +access +connection +complete +.*error="io error: deadline has elapsed"'
+        - regex: 'error +access +connection +complete +.*error="connection timed out, maybe a NetworkPolicy is blocking HBONE port 15008: deadline has elapsed"'
diff --git a/rules/cre-2025-0111/istio-ambient-troubleshoot.yaml b/rules/cre-2025-0111/istio-ambient-troubleshoot.yaml
new file mode 100644
index 0000000..d9ca9cc
--- /dev/null
+++ b/rules/cre-2025-0111/istio-ambient-troubleshoot.yaml
@@ -0,0 +1,54 @@
+rules:
+  - metadata:
+      kind: prequel
+      id: bT9zPmQwXdFvUr1EaGh2J
+      hash: AbC3dEfGh1JkLmN2PqRsT
+    cre:
+      id: CRE-2025-0111
+      severity: 2
+      title: "Ztunnel IPv6 Bind Failure"
+      category: "istio-ambient-troubleshooting"
+      author: Prequel
+      description: |
+        Detects when Ztunnel's DNS proxy or control-plane component attempts to bind
+        to the IPv6 loopback address `[::1]:15053` on a node where IPv6 is disabled,
+        resulting in an `Address family not supported` error.
+      cause: |
+        - Kernel-level IPv6 support is disabled on the node
+        - `IPV6_ENABLED` not set to `false` in the Ztunnel configuration
+      impact: |
+        - Ztunnel's DNS proxy cannot start, preventing DNS-capture functionality
+        - Ambient traffic may fail to resolve service names or be misrouted
+      mitigation: |
+        IMMEDIATE:
+        - Re-enable IPv6 on the node if IPv6 is required:
+          ```bash
+          sudo sysctl -w net.ipv6.conf.all.disable_ipv6=0
+          sudo sysctl -w net.ipv6.conf.default.disable_ipv6=0
+          ```
+        - Or disable IPv6 binding in Ztunnel by setting in your IstioOperator:
+          ```yaml
+          values:
+            ztunnel:
+              IPV6_ENABLED: false
+          ```
+        - Restart the Ztunnel DaemonSet:
+          ```bash
+          kubectl -n istio-system rollout restart daemonset ztunnel
+          ```
+        LONG-TERM:
+        - Incorporate node-level IPv6 capability checks into your cluster provisioning
+        - Validate the `IPV6_ENABLED` flag in your IstioOperator CI pipelines
+      tags:
+        - istio
+        - ambient
+        - ztunnel
+        - network
+      references:
+        - https://github.com/istio/istio/wiki/Troubleshooting-Istio-Ambient#scenario-ztunnel-fails-with-failed-to-bind-to-address-115053-address-family-not-supported
+    rule:
+      set:
+        event:
+          source: cre.log.ambient
+        match:
+          - regex: 'failed to bind to address \[::1\]:15053: Address family not supported(?: \(os error \d+\))?'
diff --git a/rules/tags/categories.yaml b/rules/tags/categories.yaml
index 62e9ef2..469cb1d 100644
--- a/rules/tags/categories.yaml
+++ b/rules/tags/categories.yaml
@@ -197,3 +197,4 @@ categories:
       Problems related to troubleshooting Istio's Ambient service mesh mode,
       including CNI sandbox creation failures, ztunnel connectivity issues,
       traffic capture errors, and waypoint configuration problems.
+
diff --git a/rules/tags/tags.yaml b/rules/tags/tags.yaml
index 56340d0..1d2334b 100644
--- a/rules/tags/tags.yaml
+++ b/rules/tags/tags.yaml
@@ -719,4 +719,4 @@ tags:
     description: Problems where system capacity limits (storage, memory, connections) are exceeded
   - name: data-loss-risk
     displayName: Data Loss Risk
-    description: Conditions that may lead to data loss if not addressed promptly
+    description: Conditions that may lead to data loss if not addressed promptly
\ No newline at end of file


Test patch:
diff --git a/rules/cre-2025-0104/test.log b/rules/cre-2025-0104/test.log
new file mode 100644
index 0000000..05ce2e2
--- /dev/null
+++ b/rules/cre-2025-0104/test.log
@@ -0,0 +1,2 @@
+2025-06-21T18:27:34.624805Z	state	timed out waiting for workload 'default.default (curlpod)' from xds	
+2025-06-21T20:11:12.746046Z	state	timed out waiting for workload 'default.default (curlpod)' from xds	
diff --git a/rules/cre-2025-0106/test.log b/rules/cre-2025-0106/test.log
new file mode 100644
index 0000000..9035717
--- /dev/null
+++ b/rules/cre-2025-0106/test.log
@@ -0,0 +1,9 @@
+2025-06-21T16:42:03Z   Started                  Started container istio-proxy
+2025-06-21T16:42:46Z   Killing                  Stopping container istio-proxy
+2025-06-21T16:42:46Z   Killing                  Stopping container sandbox-fail
+2025-06-21T16:43:26Z   Scheduled                Successfully assigned default/sandbox-fail to istio-demo-control-plane
+2025-06-21T16:43:26Z   FailedCreatePodSandBox   Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "80a85c307b25f18b974eb09330ea2ff6314efe11f61e68dd8fea371b73733548": plugin type="istio-cni" name="istio-cni" failed (add): istio-cni cmdAdd failed to contact node Istio CNI agent: unable to push CNI event (status code 500): no ztunnel connection
+2025-06-21T16:43:27Z   FailedCreatePodSandBox   Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "13853d2b00499e8aa51d26ebbaa7f2e3e59fccc304c14e0a1032845c34aee110": plugin type="istio-cni" name="istio-cni" failed (add): istio-cni cmdAdd failed to contact node Istio CNI agent: unable to push CNI event (status code 500): no ztunnel connection
+2025-06-21T16:43:40Z   FailedCreatePodSandBox   Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "309f97949da8394a071a4de6034aade4a5078669ee32812c55d57fe5eaa48f01": plugin type="istio-cni" name="istio-cni" failed (add): istio-cni cmdAdd failed to contact node Istio CNI agent: unable to push CNI event (status code 500): no ztunnel connection
+2025-06-21T16:43:55Z   FailedCreatePodSandBox   Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "6b96ed5fa17f7ba7227d420206f51f5d7cfded6616fa6a50dfa7b84752921819": plugin type="istio-cni" name="istio-cni" failed (add): istio-cni cmdAdd failed to contact node Istio CNI agent: unable to push CNI event (status code 500): no ztunnel connection
+2025-06-21T16:44:08Z   FailedCreatePodSandBox   Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "6db8f71122ff23e2cfe01a6cc87e70e51b504893d19d6d24273429585e4a9677": plugin type="istio-cni" name="istio-cni" failed (add): istio-cni cmdAdd failed to contact node Istio CNI agent: unable to push CNI event (status code 500): no ztunnel connection
\ No newline at end of file
diff --git a/rules/cre-2025-0111/test.log b/rules/cre-2025-0111/test.log
new file mode 100644
index 0000000..5a3bf35
--- /dev/null
+++ b/rules/cre-2025-0111/test.log
@@ -0,0 +1,1 @@
+2025-06-26T14:18:39.324185Z    error    inpod::dnsproxy    failed to bind to address [::1]:15053: Address family not supported (os error 97)