Kubernetes Errors
CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
Understanding Kubernetes errors
Kubernetes errors are best read as a state machine that got stuck. Pending means the scheduler could not place the pod (resources, taints, or an unbound volume). ImagePullBackOff means kubelet could not fetch the image (name, credentials, or registry). CrashLoopBackOff means the container starts and exits, so the answer is in the container's own logs. OOMKilled means the kernel killed it for exceeding its memory limit. Each state points at a different subsystem, and kubectl describe almost always contains the exact reason in its events.
How to debug Kubernetes errors
- Start with
kubectl describe pod <name>and read the Events section at the bottom. It names the precise failure, including registry errors and scheduling constraints. - For CrashLoopBackOff, read the previous container's logs:
kubectl logs <pod> --previous. The current container may not have produced output yet. - Check resource pressure with
kubectl top podandkubectl top node, and compare against the pod's requests and limits. - Test RBAC directly:
kubectl auth can-i <verb> <resource> --as=system:serviceaccount:<ns>:<sa>. This answers permission questions definitively. - For networking, confirm the Service has endpoints (
kubectl get endpoints) before suspecting DNS, Ingress or the CNI.
Tools worth reaching for
kubectl describekubectl logs --previouskubectl auth can-ikubectl topkubectl events --sort-by=.lastTimestampk9s
All 34 Kubernetes errors
- Argo CD: Application OutOfSync / DegradedThe live cluster state differs from Git (OutOfSync) or resources are unhealthy (Degraded), from drift, a failed sync…
- Helm: another operation (install/upgrade) is in progressA previous Helm operation crashed and left the release stuck in pending-install/pending-upgrade, blocking new…
- Helm: cannot patch (field is immutable) NewAn upgrade changed a field Kubernetes does not allow to be updated in place, such as a Deployment's selector, a Job's…
- Helm: release stuck in failed or pending stateA previous Helm install or upgrade failed and left the release in a state that blocks later upgrades.
- Istio: 503 upstream connect error (UH/UF/NR)Envoy returned 503 with flags like UH (no healthy upstream), UF (upstream connection failure), or NR (no route)…
- kubectl apply: metadata.annotations: Too long Newkubectl apply stores the whole previous manifest in the last-applied-configuration annotation, and annotations are…
- kubectl top: error: Metrics API not available Newkubectl top and every horizontal pod autoscaler read from metrics-server, which no upstream cluster installs by…
- kubectl: error: You must be logged in to the server (Unauthorized) NewThe API server rejected the credentials in your kubeconfig. Typically an expired token or client certificate, a cloud…
- kubectl: The connection to the server localhost:8080 was refused Newkubectl found no kubeconfig at all, so it fell back to its built-in default of localhost:8080. This is a client…
- Kubernetes: 0/N nodes are available, node(s) had untolerated taint NewThe scheduler found no node willing to accept the pod because every candidate carries a taint the pod does not…
- Kubernetes: admission webhook denied the request NewA validating or mutating admission webhook rejected the object. This is policy enforcement from Kyverno, Gatekeeper…
- Kubernetes: context deadline exceededOperation took longer than allowed timeout. API server too slow, etcd issues, or network latency.
- Kubernetes: CrashLoopBackOffContainer starts but crashes immediately, Kubernetes repeatedly tries to restart it with exponential backoff.
- Kubernetes: CreateContainerConfigError NewThe kubelet pulled the image but could not build the container's configuration, almost always because a referenced…
- Kubernetes: Deployment exceeded its progress deadline NewA rollout did not reach the required number of available replicas within progressDeadlineSeconds (600 by default). The…
- Kubernetes: exceeded quota in namespace NewA ResourceQuota caps what the namespace may request in aggregate. The create is rejected at admission time, so a…
- Kubernetes: Failed to create pod sandbox NewThe container runtime could not set up the pod's network namespace. This is a CNI-level failure: the plugin is missing…
- Kubernetes: Forbidden - RBAC denies accessUser or service account lacks required RBAC permissions for the requested operation.
- Kubernetes: HorizontalPodAutoscaler unable to get metrics for resource cpu NewThe HPA has no metrics to scale on. Either metrics-server is not installed or not serving, or the pods have no CPU or…
- Kubernetes: ImagePullBackOffKubelet cannot pull container image. Wrong image name, authentication failed, or registry unreachable.
- Kubernetes: Init:CrashLoopBackOff NewAn init container is failing, so the main containers never start. Init containers run sequentially to completion, and…
- Kubernetes: Insufficient CPU/MemoryPod cannot be scheduled because no node has enough CPU or memory resources available.
- Kubernetes: no matches for kind in version (removed API) NewThe manifest uses an apiVersion the cluster no longer serves. Kubernetes removes beta APIs on a published schedule, so…
- Kubernetes: Node status NotReadyThe kubelet stopped reporting healthy. Common causes include disk pressure, CNI failures, stopped kubelet, or lost API…
- Kubernetes: node(s) didn't match Pod's node affinity/selector NewNo node carries the labels the pod insists on, so the scheduler rejects every candidate. It turns up after an upgrade…
- Kubernetes: OOMKilledContainer exceeded memory limit and was killed by the Out Of Memory killer.
- Kubernetes: PersistentVolumeClaim PendingPVC cannot find matching PersistentVolume or StorageClass cannot provision volume.
- Kubernetes: Pod evicted - node was low on resourceThe kubelet evicted a pod to reclaim memory, disk, or inodes. Evictions often indicate missing resource…
- Kubernetes: pod has unbound immediate PersistentVolumeClaims NewThe scheduler will not place the pod because its claim has no volume yet. With WaitForFirstConsumer binding a moment…
- Kubernetes: Pod Security Policy violationPod violates cluster's Pod Security Policy. Running as root, privileged mode, or using restricted capabilities.
- Kubernetes: Readiness probe failed, endpoints never become ready NewThe container is running but its readiness probe never succeeds, so the Service keeps it out of the endpoint list and…
- Kubernetes: Service has no endpointsService created but no pods match the selector, traffic cannot be routed.
- Kubernetes: Unable to attach or mount volumes, timed out NewThe pod is stuck in ContainerCreating because a volume never attached. With cloud block storage the usual reason is…
- Kubernetes: violates PodSecurity restricted:latest NewPod Security Admission is enforcing the restricted profile on the namespace and the pod spec does not meet it…
Other categories
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Ansible 10Unreachable hosts, become passwords, undefined variables and Jinja2 failures.
- API 14Auth headers, payload limits, versioning, idempotency and webhook signatures.
- Apple 10Command line tools, dyld, Homebrew permissions, notarisation and Keychain.
- Auth 11OIDC, SAML, Auth0, Okta, Keycloak, passkeys and MFA failures.
- BigData 11Spark, Kafka, Airflow, Snowflake, Flink and Databricks failures.
- C# 12NuGet restore, null references, EF Core migrations, async deadlocks and Blazor…
- C++ 11Segfaults, linker errors, memory corruption and template deduction failures.
- Caching 10Cache stampedes, stale content, Varnish and CloudFront failures.
- CI/CD 18GitHub Actions, GitLab CI, Jenkins, CircleCI: permissions, runners and…
- Client 21CORS, mixed content, module resolution, memory limits and framework runtime…
- Cloud 25IAM permissions, quotas, service limits and credential failures.
- Dart 10Null safety, pub version solving and build toolchain problems.
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- DNS 10NXDOMAIN, SERVFAIL, timeouts, propagation and delegation problems.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- Elixir 9GenServer timeouts, supervision failures and Mix compilation problems.
- Email 8Delivery failures, relay denial, authentication, SPF, DKIM and DMARC.
- Frontend 23Hydration mismatches, bundler resolution, layout shift and font loading.
- Git 20Merge conflicts, rejected pushes, detached HEAD, LFS and repository corruption.
- Go 19Nil map assignment, concurrent map access, context cancellation and deadlocks.
- GraphQL 13Validation, depth limits, N+1 queries and fragment problems.
- gRPC 10Status codes, deadlines, message limits, TLS and HTTP/2 transport failures.
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- ICMP 23Destination unreachable, time exceeded, fragmentation needed and redirects.
- Ingress 8404 default backend, missing TLS secrets, IngressClass and path matching.
- Java 19Class loading, dependency resolution, connection pools and JVM version…
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Logging 9Log4j, Logback, Fluentd, Logstash and CloudWatch ingestion problems.
- MessageQueue 14Kafka, RabbitMQ, SQS, NATS and Celery: lag, rebalancing and poison messages.
- Mobile 17Gradle, CocoaPods, Xcode signing, Metro bundler and toolchain mismatches.
- Monitoring 12Prometheus scrapes, Grafana data sources, OpenTelemetry exporters and agent…
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Performance 6GC pauses, thread pool starvation and event loop blocking.
- PHP 11Memory limits, execution timeouts, autoloading, Composer and PDO connections.
- Proxy 17nginx, Envoy, HAProxy, Traefik, Caddy and Cloudflare upstream failures.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Regex 8Catastrophic backtracking, back references, escaping and engine differences.
- Ruby 11Bundler, migrations, native extensions, encoding and asset compilation.
- Rust 19Borrow checker, ownership moves, trait bounds and lifetime mismatches.
- Scala 6Dependency resolution, binary compatibility and type inference failures.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- Serverless 11Lambda timeouts, package size limits, VPC networking and cold starts.
- Shell 13Command not found, permissions, quoting, expansion and Makefile syntax.
- Storage 13S3 permissions, NFS mounts, quotas, signed URLs and volume attachment.
- Svelte 10Store subscriptions, load functions and server/client boundaries.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Terraform 18State locks, provider auth, drift, dependency cycles and plan-time unknowns.
- Testing 18Jest, pytest, JUnit, Cypress and Playwright: fixtures, snapshots and timeouts.
- TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
- TypeScript 19Assignability, missing declarations, strict null checks and generic constraints.
- Virtualization 8VirtualBox, VMware, Hyper-V, WSL, KVM and hypervisor conflicts.
- Web3 7Gas estimation, nonce management and reverted transactions.
- WebAssembly 7Compile errors, memory bounds and host binding mismatches.
- WebServer 10nginx, Apache, IIS and Caddy: binding, permissions, rewrites and TLS.
- Windows 10Installer failures, missing runtimes, update errors and permission problems.