I85PREP
⌘ K
CKA study materials
CKA study resources

CKA (Other exams): Troubleshooting

CKA · Work through your exam, one topic at a time.

All guide sections

Troubleshooting

Troubleshooting is the largest CKA domain. It tests a repeatable method for finding faults in Pods, controllers, nodes, networking, and the control plane, using events, logs, describe output, and node-level tools.

Core rules

  • Start with scope: is one Pod, one Service, one node, or the whole cluster affected? kubectl get pods -A -o wide, kubectl get nodes, and kubectl get events -A --sort-by=.lastTimestamp narrow the fault.
  • kubectl describe shows scheduling events, probe failures, image pulls, and volume mount errors. kubectl logs shows container output; add --previous for the last crashed instance and -c for a specific container.
  • For node problems, check systemctl status kubelet, journalctl -u kubelet -n 100, and crictl ps -a. Static control-plane Pods are defined in /etc/kubernetes/manifests; a bad manifest removes that component.
  • For Service failures, compare the Service selector with Pod labels, then check kubectl get endpoints. Readiness failures remove endpoints even when the Pod is Running.
  • Use kubectl exec for DNS and connectivity tests: nslookup kubernetes.default and wget to a Service.

Worked example

Users report that web is unreachable through Service web-svc. kubectl get svc web-svc shows a ClusterIP, but kubectl get endpoints web-svc shows <none>. kubectl describe svc web-svc shows selector app=web; kubectl get pods --show-labels shows the running Pods are labeled app=web-app. The Service selects nothing, so no endpoints exist. Patch the selector to app=web-app or relabel the Pods, then confirm endpoints populate. The reasoning: a Service does not route to Pods by name or by Deployment; it routes only through matching labels and Ready endpoints.

Traps

  • Reading kubectl logs for a Pod stuck in CreateContainerConfigError or FailedMount; those failures appear in describe events, and no container logs exist.
  • Ignoring namespace: a Service and its Pods must be in the same namespace for a short-name selector check.
  • Assuming a Running Pod is Ready; readiness gates endpoints.
  • Restarting kubelet before reading its journal, losing the evidence.
  • Treating a Pending Pod as an application crash; Pending is usually scheduling, taints, or unbound storage.