Troubleshooting
Triage order
Start with the symptom scope: one Pod, one Service, one node, or the whole cluster. Use kubectl get pods -o wide, describe, events, and logs. describe shows scheduling, image pull, probe, and mount failures. logs --previous reads the crashed container's prior logs. exec and kubectl debug (ephemeral containers) test DNS, ports, and filesystem from inside the Pod.
Common states
Pending: unschedulable (requests, taints, affinity, PVC). ImagePullBackOff: wrong image/tag or registry auth. CrashLoopBackOff: app exit, bad config, missing secret. OOMKilled: memory limit. Evicted: node pressure. NotReady node: kubelet, runtime, CNI, or disk/memory pressure. Service failures: check EndpointSlices, targetPort, NetworkPolicy, and DNS. Control-plane issues: check static Pod logs, etcd health, certificates, and API server connectivity.
Traps
Events are namespaced and expire; look in the Pod's namespace. A failing readiness probe removes endpoints even though the container runs. A NetworkPolicy can block traffic that works from the node. Node conditions such as DiskPressure and MemoryPressure cause evictions. Certificate expiry can break kubelet-to-API communication.
Worked example: a Pod is CrashLoopBackOff. Run kubectl describe pod to see restart count and events, then kubectl logs pod --previous for the last exit, then kubectl exec (if it stays up) or debug to test config. Rule: Pod -> ReplicaSet/Deployment -> node -> control plane.