Easy
The site is down
A Deployment that never became ready after a small change.
ImagePullBackOff · kubectl describe
Connection refused
Healthy Pods, a Service in front of them, and no traffic getting through.
Service · Selectors · EndpointSlices
Stuck before it starts
Pods that never get as far as running their container.
ConfigMap · CreateContainerConfigError
Never got started
A new Deployment whose containers are never created.
Secret · secretKeyRef · CreateContainerConfigError
Restarting for no reason
Workers that restart every few seconds while their logs look fine.
OOMKilled · Memory limits · kubectl describe
Waiting for the fast disk
A Deployment pinned to a Node that doesn't seem to exist.
nodeSelector · Node labels · FailedScheduling
404 at the front door
An Ingress that the cluster's controller never picks up.
Ingress · IngressClass · ingress-nginx
Non-root, non-starting
A new non-root policy, and Pods that never get as far as starting.
securityContext · runAsNonRoot · CreateContainerConfigError
Medium
The database won't stay up
A database that crashes a few seconds after every start.
CrashLoopBackOff · Secret · kubectl logs --previous
Health checks gone wrong
Every Pod is Running, none is Ready, and the Service is empty.
Readiness probe · EndpointSlices
Pending forever
A small app that the scheduler can't find room for.
Resource requests · FailedScheduling
Copied from another cluster
A Pod waiting on a claim that can never be provisioned.
PersistentVolumeClaim · StorageClass · ProvisioningFailed
The pipeline is Forbidden
RBAC that looks right, for a ServiceAccount that still can't do its job.
RBAC · RoleBinding · kubectl auth can-i
The backfill failed
A one-off Job that gave up overnight and has to run again.
Job · backoffLimit · Immutable fields
The cleanup never happens
A scheduled job that hasn't run once since it was deployed.
CronJob · Cron schedule · suspend
Cold cache after every deploy
A cache that comes back empty whenever its Pod is replaced.
emptyDir · PersistentVolumeClaim · Volumes
Lockdown broke checkout
A default-deny policy did its job a little too well.
NetworkPolicy · Default deny · Ingress rules
No logs from worker-2
A DaemonSet that quietly skips one Node.
DaemonSet · Taints · Tolerations
The autoscaler that never scales
Heavy load, an HPA in place, and still a single Pod.
HorizontalPodAutoscaler · Resource requests · Sidecars
Read-only, never Ready
A hardened container that can no longer write the one file it needs.
securityContext · readOnlyRootFilesystem · emptyDir · Readiness probe
Nodes are forbidden
RBAC that grants Node access in a namespace, where Nodes don't live.
RBAC · ClusterRole · ClusterRoleBinding · kubectl auth can-i
Hard
Locked down too far
An egress policy that blocks more than it meant to.
NetworkPolicy · Egress · DNS
Nothing schedules after maintenance
Two Nodes left half-finished by last night's maintenance.
Taints · Cordon · FailedScheduling
No report since this morning
A CronJob that stopped producing runs after one bad night.
CronJob · concurrencyPolicy · activeDeadlineSeconds · Job
Yesterday's page
A ConfigMap edit that the site never picked up.
ConfigMap volumes · subPath · Rollout restart
The third replica
Scaling up hits a placement rule that can't be met.
Pod anti-affinity · Topology spread constraints · FailedScheduling
The shop won't load
An Ingress, a Service and a locked-down namespace, and no page at the end of it.
Ingress · Named ports · NetworkPolicy · namespaceSelector
Hardened into an outage
A weekend security hardening change that broke three things at once.
NetworkPolicy · RBAC · API groups · runAsNonRoot
The new team can't launch
An onboarding script that set a new namespace up wrong in three places.
RoleBinding · Namespaces · Secret volume · FailedMount · targetPort
After the security audit
Least privilege and Secret hygiene, applied a little too quickly.
RoleBinding · roleRef · ClusterRole · Service selector · secretKeyRef