Containers, Kubernetes & Platform Engineering

An autoscaler may not add capacity if metrics are absent, limits are reached, or workload requests are poorly sized. Checks to make Inspect autoscaler events, metric availability, target utilization, min and max settings, pod requests, and node capacity. Generate controlled load in a test environment and confirm both scale-up and scale-down behavior...

A secret can update in the cluster while running processes continue using cached credentials or old mounted values. Checks to make Check the secret version, how the application consumes it, pod restart or reload behavior, and downstream authentication errors. Roll out a controlled restart if required and verify all replicas before retiring the previous...

Outbound failures may come from DNS, network policy, proxy settings, egress controls, or the external provider. Checks to make Test name resolution and connectivity from the affected pod, inspect namespace policies and node egress, and compare with a known-good workload. Check provider allowlists and TLS errors separately; avoid opening unrestricted...

Private image pulls can fail because of registry credentials, image paths, network access, or expired tokens. Checks to make Inspect pod events and image reference, verify the image pull secret in the correct namespace, confirm registry permissions and network reachability, and check token expiry. Do not place registry passwords in manifests or logs....

Traffic may reach old replicas due to endpoint readiness, selector overlap, connection pooling, or incomplete rollout cleanup. Checks to make Inspect service selectors and EndpointSlices, compare pod labels and readiness, review rollout status, and check client keepalive behavior. Confirm old pods have terminated and observe traffic across replicas...

Node-specific failures may come from local storage, runtime version, networking, resource pressure, or configuration drift. Checks to make Compare node conditions, runtime and kernel versions, pod events, mounts, and network plugin status. Check whether other workloads fail on the same node, then cordon or drain only under the approved operational...

Pods may fail TLS because of missing CA bundles, incorrect trust configuration, hostname mismatch, or certificates not mounted as expected. Checks to make Capture the exact TLS error, verify endpoint hostname and certificate chain from the pod, check CA bundle and mounted secret versions, and compare node or image differences. Avoid disabling...

Container logs, caches, or temporary files can grow beyond ephemeral storage requests and trigger eviction. Checks to make Inspect pod events and node disk pressure, identify which container paths are growing, and review log and cache cleanup. Set realistic requests and limits based on measurements and move persistent data to appropriate storage. When...