Kubernetes
Pod failures, probes, scheduling and reading what the cluster is actually telling you.
25 articles
ArgoCD Stuck on 'Waiting for Completion of Hook': Breaking the Deadlock
Your ArgoCD sync has waited on a PreSync Job for forty minutes and Terminate changes nothing. Here is why the hook never completes and the exact steps that clear it.
CrashLoopBackOff with no logs: a systematic way to find the real cause
CrashLoopBackOff is a retry policy, not a diagnosis. Four categories, two commands to tell them apart, and why three of the four are not application bugs at all.
Fixing Helm's "another operation is in progress" Without Nuking the Release
An interrupted helm upgrade leaves the release Secret stuck at pending-upgrade and blocks every deploy. Here is the safe unstick order, and why the label patch fails.
Helm 'has no deployed releases': recovering a broken release history
When every Helm revision is failed or pending, upgrade and rollback both refuse to run. Here is how the release Secrets work, how to repair the history safely, and how to stop it recurring.
Helm Upgrade Stuck in PENDING_UPGRADE After a Hook Timeout: The Cleanup Path
A pre-upgrade hook outran --timeout, and now Helm refuses every retry and shows two deployed revisions. Here is why the release state froze and how to clear it safely.
kubectl Unauthorized on EKS: Check the IAM Identity, Not RBAC
EKS returns Unauthorized when it cannot map your IAM principal to a Kubernetes user, so no ClusterRoleBinding will fix it. Here is the diagnosis order that actually resolves it.
Kubernetes DNS Timeouts That Come and Go: ndots, conntrack and the Five Second Stall
Intermittent i/o timeout errors on Kubernetes DNS are three different bugs wearing one shirt. How to tell ndots amplification, a kernel conntrack race and a starved CoreDNS apart.
Kubernetes Has No Cross-Namespace Secrets: Why Manual Copies Always Drift
A Pod cannot reference a Secret in another namespace and Kubernetes will not sync copies for you. Here is why, and the three mechanisms that actually hold up.
The Shared /health Endpoint That Kills Healthy Kubernetes Pods
Pointing liveness and readiness at one /health endpoint that checks your database turns a 30 second blip into a cluster-wide crash loop. Here is the correct split.
Kubernetes HPA Not Scaling: The Conditions You Are Not Reading
Your HPA reports an unknown target and never scales. kubectl describe hpa already told you why: how to read AbleToScale, ScalingActive and ScalingLimited, and fix each one.
Postgres 'Could Not Resize Shared Memory Segment' Is Not Your Disk
No space left on device from Postgres in Docker means a 64MB /dev/shm, not a full volume. Here is the mechanism, the shm-size fix, and how to size it without inviting the OOM killer.
Pod Has Unbound PersistentVolumeClaims: The Real Checklist
One Kubernetes error covers four unrelated storage failures. Here is how to tell them apart from the PVC events, and why deleting the PVC can destroy your data.
ArgoCD StatefulSet Stuck OutOfSync With ServerSideApply: Fix the Diff, Not the Manifest
ArgoCD reports permanent drift on a StatefulSet after you enable ServerSideApply. Every field in the diff is an API server default, not your change. Here is the real fix.
x509 Certificate Signed by Unknown Authority on the ingress-nginx Admission Webhook: The Real Fix
An x509 trust error on the ingress-nginx or cert-manager admission webhook blocks every Ingress cluster-wide. The cause is a drifted caBundle. Patch it, do not delete the webhook.
kubectl 'did you specify the right host or port?': read the address first
localhost:8080 means kubectl found no kubeconfig at all. A real address means a real network failure. How to tell them apart in ten seconds and fix each one properly.
Why Kubernetes Pods and Namespaces Get Stuck Terminating (and When Force-Delete Makes It Worse)
A pod or namespace stuck in Terminating is almost never fixed by --force. Here is what the finalizers are actually waiting for, and the finalizer surgery to do only after you have checked.
OOMKilled and Nothing Else: Finding What Really Ate Your Pod
Kubernetes records OOMKilled and exit code 137, then deletes the evidence. Here is how to read cgroup counters, kernel logs and working set to find the actual cause.
Your kubectl edit Keeps Getting Reverted in GitOps: The Right Way to Hotfix
ArgoCD self-heal and Flux reconciliation undo manual kubectl edits within minutes, so the incident looks like it came back. Here is the correct emergency runbook that does not disable GitOps cluster-wide.
Kubernetes Rolling Updates Still Return Connection Refused: The preStop Fix
Your rollout shows zero unavailable replicas and still drops a burst of connection refused errors. The SIGTERM-versus-endpoint-removal race, and the preStop hook that closes it.
Kubernetes Secrets Are base64, Not Encrypted: What Actually Protects Them
A Kubernetes Secret is base64-encoded plaintext, not a vault. Here is what actually protects it: encryption at rest, tight RBAC, and an external secrets manager.
Kubernetes Won't Restart Pods When a ConfigMap Changes: The checksum/config Pattern
Kubernetes never restarts pods when a ConfigMap or Secret changes, and env-var config never updates at all. Here is why that is deliberate and the checksum/config annotation that forces a rollout.
'0/3 nodes are available: Insufficient memory' - requests, not usage
Your nodes look idle in Grafana but the scheduler says Insufficient memory. That is because it counts requests, not usage - and taints and volume affinity hide behind the same message.
OOMKilled Exit Code 137: Leak, Bad Limit, or JVM Off-Heap?
Exit code 137 looks the same whether it is a leak, a limit set too low, or JVM off-heap memory. Here is how to read the memory curve and tell the three apart.
One Bad Request Killed Your Whole vLLM Server: AsyncEngineDeadError Explained
AsyncEngineDeadError means one request crashed vLLM's shared background loop and took every other request down with it. Here is the architecture behind it and the mitigations that actually contain it.
ImagePullBackOff in Kubernetes: The Five Real Causes and How to Tell Them Apart
ImagePullBackOff is one status hiding five unrelated causes. Read the Events reason string, match it to the cause, and stop restarting the pod.