Troubleshooting

You SSH into a control-plane node after users report that all kubectl commands fail with 'The connection to the server 10.0.1.5:6443 was refused - did you specify the right host or port?'. The node itself is up and other cluster nodes are Ready according to a monitoring dashboard cached minutes ago. The API server runs as a static pod managed by kubelet. Which command sequence will most directly help you diagnose why the API server is not responding?

You create a Deployment named 'web' with replicas set to 3, but after several minutes 'kubectl get pods' shows no pods at all for that Deployment. 'kubectl get deployment web' shows DESIRED 3 but CURRENT and AVAILABLE both 0, and no ReplicaSet exists. The scheduler and kubelets are healthy, and other existing pods run fine. Which action is the most appropriate first step to diagnose the root cause?

Pods in your cluster can resolve internal service names (e.g., my-svc.default.svc.cluster.local) but all attempts to resolve external domains (e.g., api.github.com) return NXDOMAIN. CoreDNS pods are Running with no restarts, and the CoreDNS Service has valid endpoints. You inspect the CoreDNS ConfigMap and find that the 'forward' plugin line was recently edited. What is the MOST likely cause and the correct fix?

Users report that all applications in the cluster suddenly cannot resolve any DNS names, both internal (svc.cluster.local) and external. Pods themselves start fine and node-to-node connectivity works. Running 'kubectl get pods -n kube-system' shows no CoreDNS pods listed at all, and 'kubectl get deploy coredns -n kube-system' shows READY 0/0. Recent cluster maintenance was performed by another engineer. What is the most likely cause and the correct fix?

Users report intermittent DNS resolution failures inside the cluster. Pods sometimes resolve service names correctly and sometimes time out. You run 'kubectl get endpoints kube-dns -n kube-system' and see two endpoint IPs listed. Checking the CoreDNS deployment, you find both replicas are Running, but 'kubectl get pods -n kube-system -o wide' shows both CoreDNS pods scheduled on the same node, and that node is showing high CPU pressure. What is the MOST likely cause of the intermittent failures and the best remediation?

Users report that pods in your cluster cannot resolve service names, though pod-to-pod IP connectivity works. You run 'kubectl get pods -n kube-system' and see that both CoreDNS pods are stuck in 'Pending' status. Describing one pod shows the event: '0/3 nodes are available: 3 node(s) had untolerated taint {node.kubernetes.io/not-ready: }'. What is the most likely root cause you should investigate first?

Users report that pods across the cluster cannot resolve any DNS names, both internal and external. You check the CoreDNS deployment and see two CoreDNS pods in Running state with 0 restarts, and the pods' logs show no errors. From a test pod, 'nslookup kubernetes.default' times out. You run 'kubectl get svc -n kube-system' and notice there is no service named 'kube-dns'. What is the most likely cause of the DNS failure?

A frontend Deployment reports intermittent 502 errors when calling the 'payments' Service. The Service selector matches the pods, and `kubectl get endpoints payments` shows several IPs listed. However, inspecting `kubectl get endpointslices -l kubernetes.io/service-name=payments -o yaml` reveals that some endpoints have `conditions.ready: false` while their pods show STATUS Running. What is the most likely cause of the endpoints being marked not ready?

After a maintenance reboot of a single-node control plane, `kubectl get nodes` fails with 'The connection to the server 10.0.0.5:6443 was refused'. You SSH into the control-plane node. `systemctl status kubelet` shows kubelet is active and running. You need to find out why the kube-apiserver static pod is not serving requests. What is the BEST first step to diagnose the failure?

A newly deployed pod in the 'payments' namespace remains in ImagePullBackOff. The image is hosted in a private registry at registry.internal.corp/payments/api:v2.3. Running 'kubectl describe pod' shows the event: 'Failed to pull image ... failed to authorize: 401 Unauthorized'. Other pods in the 'default' namespace pull from the same registry successfully. What is the most likely cause and correct fix?

Users report that ClusterIP Services are unreachable from Pods running on worker node-3, while the same Services work fine from Pods on other nodes. You confirm the target Service has healthy Endpoints and CoreDNS resolves the Service name correctly on all nodes. Running 'kubectl get pods -n kube-system -o wide' shows the kube-proxy Pod on node-3 is in CrashLoopBackOff, while all other kube-proxy Pods are Running. What is the most likely reason Services fail specifically on node-3?

A ClusterIP Service named 'billing-api' correctly lists healthy pod endpoints when you run 'kubectl get endpoints billing-api'. However, requests from other pods to the Service's ClusterIP consistently time out, while connecting directly to the pod IPs works fine. On the affected worker node, you notice the kube-proxy pod has been in a running state but its logs show it failed to apply rules. Which action is the MOST likely to resolve the connectivity problem?

You deploy a new Deployment with 3 replicas, but all its Pods remain in the Pending state indefinitely. Existing Pods on the cluster continue running normally. Running 'kubectl get pods -o wide' shows the new Pods have no assigned node, and 'kubectl describe pod' shows no scheduling events at all (not even FailedScheduling). Node resources are plentiful and there are no taints. Which action is the most appropriate next step to diagnose the root cause?

A pod using a PersistentVolumeClaim backed by a local PersistentVolume is stuck in Pending. The PVC is Bound, and cluster nodes have ample CPU and memory. Running 'kubectl describe pod' shows the event: '0/4 nodes are available: 4 node(s) had volume node affinity conflict.' What is the most likely cause?

A pod named `web-stack` in the `frontend` namespace runs two containers: `nginx` and `log-agent`. Users report the web page returns HTTP 502 errors. You run `kubectl logs web-stack -n frontend` and receive the error: `Error from server (BadRequest): a container name must be specified for pod web-stack`. You need to view only the logs from the `nginx` container to diagnose the 502. Which command retrieves the correct container's logs?

A frontend web application deployed as a Deployment in the 'shop' namespace is responding slowly under load. The Deployment sets a CPU limit of 200m per container. You run 'kubectl top pods -n shop --containers' and observe the frontend container consistently reporting 200m CPU usage, matching its limit exactly, while node CPU is only 40% utilized overall. Pods are Running with no restarts. What is the most likely cause of the slow responses?

A worker node suddenly shows NotReady. On the node, 'systemctl status kubelet' shows the service is active (running), but the kubelet logs repeatedly report: 'Unable to register node with API server' and 'x509: certificate has expired or is not yet valid'. The control plane and other nodes are healthy. What is the most likely root cause and appropriate first action?

A worker node suddenly reports NotReady. The kubelet logs on that node show repeated errors: 'x509: certificate has expired or is not yet valid: current time ... is before ...'. The kubelet certificates were recently rotated and are valid for another year. Other nodes are healthy. What is the MOST likely root cause and appropriate fix?

Users report that pods on node worker-2 are being terminated and rescheduled unexpectedly. Running 'kubectl describe node worker-2' shows the condition 'DiskPressure True' and events indicating 'The node had condition: [DiskPressure]'. Several pods on that node show status 'Evicted'. What is the most likely root cause and appropriate first action?

A worker node named worker-2 has recently started showing intermittent Pod failures, and kubectl commands report the node as Ready but many Pods on it are stuck in ContainerCreating. You SSH into worker-2 to investigate the kubelet directly. The kubelet runs as a systemd-managed service. Which command should you run first to inspect the kubelet's recent runtime logs and identify errors preventing container creation?