Skip to content
Tool

kubectl

Official site

Playbooks for kubectl

  1. Triaging CrashLoopBackOff to its actual cause

    Uses kubectl describe pod's Last State reason, exit code and Events to sort a CrashLoopBackOff into one of five common causes and points at the right next step for each. It deliberately does not fix any of them in depth — the OOM branch, for instance, defers to the dedicated OOMKilled playbook — and it does not cover ImagePullBackOff, FailedScheduling or CreateContainerConfigError, which are different pod conditions with their own playbooks.

    Unverifiedno reproductions yetWhy this confidence?

  2. Diagnosing and fixing an OOMKilled container

    Confirms a genuine OOM kill from kubectl describe pod, then distinguishes a memory limit that's simply undersized from a leak-shaped growth pattern that raising the limit would only delay. Covers raising the memory request/limit as a concrete fix; it does not do in-app memory profiling or cover node-level memory pressure evictions, which are a different mechanism from a per-container limit kill.

    Unverifiedno reproductions yetWhy this confidence?

  3. Fixing ImagePullBackOff caused by private-registry credentials

    Walks from the exact pull error through the pod's imagePullSecrets to the actual Secret content, fixing a missing secret reference, an expired token, or a wrong registry host/namespace. It explicitly does not cover a missing or mistyped image tag ('manifest unknown', 'repository does not exist') — that's a different error and a different fix — and it is not a general Docker registry-login guide: a successful `docker pull` on a developer's laptop proves the credentials are valid outside the cluster, it does not prove the pod itself has them wired up.

    Unverifiedno reproductions yetWhy this confidence?

  4. Diagnosing FailedScheduling / Insufficient cpu

    Separates a transient shortfall from nodes still rejoining after an upgrade, genuine cluster-wide CPU contention needing more capacity, and a pod whose CPU request is simply too large to fit on any node in the pool at all. It does not cover FailedScheduling caused by node affinity, taints/tolerations, or Insufficient memory/pods — the same describe-pod approach applies, but the resource name in the message and the fix differ.

    Unverifiedno reproductions yetWhy this confidence?

  5. Fixing kubectl 'the server doesn't have a resource type'

    Rules out the wrong-cluster case first, then checks whether the resource is a CRD that was never applied, isn't yet Established, or is being hidden from discovery by RBAC or a broken aggregated API. It does not cover ordinary typos in a resource name that IS registered — kubectl's own suggestion output usually catches those — and it is not a guide to writing CRDs.

    Unverifiedno reproductions yetWhy this confidence?

  6. Clearing a Helm release stuck pending-upgrade / pending-install

    Confirms the release really is stuck in a pending-* state with nothing genuinely in flight, then clears it — via helm rollback when a prior successful revision exists, or by removing the stuck release record when there isn't one (a first install that never completed). It does not cover a helm upgrade that is genuinely still running, or Helm 2's separate Tiller-based failure modes.

    Unverifiedno reproductions yetWhy this confidence?

  7. Fixing CoreDNS SERVFAIL from a detected forwarding loop

    Confirms the crash is genuinely the loop plugin (not an unrelated SERVFAIL cause), traces it to the node's resolv.conf in the common case, and fixes it by forwarding to explicit upstream resolvers instead. It does not cover SERVFAIL caused by an actually-unreachable upstream DNS server, NetworkPolicy blocking egress from CoreDNS, or CoreDNS being resource-starved — those don't log the loop-plugin message and need a different diagnosis.

    Unverifiedno reproductions yetWhy this confidence?

  8. Diagnosing ingress-nginx 504 Gateway Time-out

    Splits 504s into a slow-backend branch (raise the per-Ingress timeout for a legitimately slow endpoint, or fix backend contention if it's overload-shaped) and a no-live-upstream branch (no Ready endpoints, or a Service/NetworkPolicy blocking traffic to an otherwise-healthy pod). It does not cover 502/503 responses, which usually mean the backend actively refused or reset the connection rather than never answering, or client-side timeouts that never reach the ingress at all.

    Unverifiedno reproductions yetWhy this confidence?

  9. Diagnosing containerd task-creation timeouts

    Narrows a context-deadline-exceeded failure to node-level resource pressure versus containerd being slowed by a large pile-up of stale containers/images on one node. It does not cover a genuinely crashed containerd daemon (a different, more obvious failure mode) or CNI-level sandbox failures that don't mention containerd task creation specifically.

    Unverifiedno reproductions yetWhy this confidence?

Versions