Kubernetes

Pod Failure Troubleshooting

kubectl logs <pod> --previous

kubectl get events

kubectl describe pod

limits.memory

kubectl describe pod

Resource Configuration Gotchas

Requests vs Limits

• Requests: Scheduling guarantee. Pod won't schedule if node lacks capacity.
• Limits: Hard ceiling. Container killed (OOM) or throttled (CPU) if exceeded.
• No limits = unbounded (can consume entire node)

• requests

  >

  limits

  is invalid

Probe Timing

livenessProbe:
  initialDelaySeconds: 10  # Wait before first check
  periodSeconds: 5         # Check interval
  timeoutSeconds: 1        # Max wait for response
  failureThreshold: 3      # Failures before action

• Liveness failure → container restart
• Readiness failure → removed from service endpoints
• StartupProbe disables other probes until success (use for slow-starting apps)

Security Context Inheritance

securityContext

spec:
  securityContext:
    runAsNonRoot: true      # Pod default
  containers:
    - securityContext:
        runAsUser: 1000     # Container override

RBAC Patterns

Minimal Role for Pod Logs

rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list"]

Common API Groups

• ""

  (empty): Core resources (pods, services, configmaps)

• apps

  : Deployments, StatefulSets, DaemonSets

• networking.k8s.io

  : Ingress, NetworkPolicy

• rbac.authorization.k8s.io

  : Roles, bindings

NetworkPolicy Gotchas

• No NetworkPolicy = all traffic allowed
• Any NetworkPolicy selecting a pod = default deny for that direction
• Empty

  podSelector: {}

  selects all pods in namespace

• namespaceSelector: {}

  selects all namespaces
• Combine selectors with

  - 

  (OR) vs nested (AND)

ingress:
  - from:
      - podSelector: {matchLabels: {app: frontend}}  # AND
        namespaceSelector: {matchLabels: {env: prod}}
  - from:  # OR (separate rule)
      - podSelector: {matchLabels: {app: monitoring}}