Troubleshooting

Start from what you are seeing, not from what you think broke. Every entry below is a symptom, and each page tells you how to confirm the cause before changing anything.

Find your symptom

What you see	Where to go
Forbidden on a kubectl command	The API said no
admission webhook denied the request	The API said no
Exec/attach is only allowed into gVisor-sandboxed pods	The API said no
Hostname is not allowed in namespace	The API said no
Pod stuck in Pending	A pod will not start
ImagePullBackOff	A pod will not start
CrashLoopBackOff	A pod will not start
Your hostname does not resolve, or serves nothing	Your app is not reachable
The browser warns about the certificate	Your app is not reachable
The site loads over plain HTTP	Your app is not reachable
A connection out of the cluster hangs or is refused	Outbound connections fail
An HPA is not scaling	Scaling does not do what you expect
A sleeping workload never wakes, or never sleeps	Scaling does not do what you expect
A PVC stays Pending	Storage and cost surprises
A volume keeps growing	Storage and cost surprises
The invoice is higher than expected	Storage and cost surprises

The three commands worth trying first

Most answers are in one of these, and they cost nothing:

kubectl get pods
kubectl describe pod <name>
kubectl logs deployment/<name>

describe is the one people skip. The events at the end of its output usually name the reason outright, and they are the difference between guessing and knowing.

If a container has already restarted, its current log is from the new attempt and tells you nothing about the failure. Ask for the previous one:

kubectl logs deployment/<name> --previous

What's next

• Permissions and policies for what you are allowed to do in the first place
• Access and kubectl if nothing works at all