All authors
Claude Skills by k8s-servant
github.com/k8s-servant35 skills1 installs75 views
- K8s Aks TroubleshootingUse when a problem is specific to Azure Kubernetes Service (AKS): a cluster or node pool in "Failed" state, an upgrade or scale that fails ("UpgradeFailed", "violate the pod's disruption budget", "QuotaExceeded", "AllocationFailed"), a LoadBalancer Service stuck at <pending> ("SyncLoadBalancerFailed", "AuthorizationFailed"), an Azure Disk or Files PVC that fails ("ProvisioningFailed", "volume node affinity conflict", "Multi-Attach error", "Mount error(13)"), workload identity errors ("AADSTS7...Votes: 0GitHub stars: 35
- K8s Api TroubleshootingUse when the Kubernetes API server itself refuses or fails a request, before any controller acts on it: "failed calling webhook", "admission webhook ... denied the request", "ValidatingAdmissionPolicy ... denied request", a ReplicaSet with FailedCreate and no pods, an APIService "False (ServiceNotFound)", "FailedDiscoveryCheck" or "MissingEndpoints", "unable to retrieve the complete list of server APIs", a namespace stuck in Terminating, "no matches for kind" or "ensure CRDs are installed fir...Votes: 0GitHub stars: 35
- K8s Argocd TroubleshootingUse when Argo CD does not deploy or update an application in Kubernetes: an Application that is OutOfSync, Unknown, Degraded, Missing or Progressing, a ComparisonError ("app path does not exist", "unable to resolve ... to a commit SHA"), an InvalidSpecError ("do not match any of the allowed destinations in project"), a sync that fails ("one or more objects failed to apply"), auto-sync that never runs, resources that stay OutOfSync after a sync, or ApplicationSets that generate nothing. Invest...Votes: 0GitHub stars: 35
- K8s Autoscaling TroubleshootingUse when Kubernetes autoscaling does not scale as expected: a HorizontalPodAutoscaler whose TARGETS show "<unknown>", "missing request for cpu", "unable to get metrics for resource cpu" or "FailedGetResourceMetric", an HPA stuck at maxReplicas ("TooManyReplicas") or not scaling down, "Metrics API not available" from kubectl top, metrics-server not Ready, a KEDA ScaledObject that is not Ready ("ScaledObjectCheckFailed") or creates no HPA, KEDA scalers failing, two autoscalers on one workload, ...Votes: 0GitHub stars: 35
- K8s Cert Manager TroubleshootingUse when cert-manager does not issue or renew a certificate in Kubernetes: a Certificate that stays READY False, a CertificateRequest that is Pending, Denied or Failed, an Issuer or ClusterIssuer that is not Ready ("Error getting keypair for CA issuer"), "Referenced \"Issuer\" not found", ACME Orders or Challenges stuck pending (HTTP-01, DNS-01, rate limits), a certificate that expired or did not renew, or "failed calling webhook \"webhook.cert-manager.io\"" when applying resources. Investiga...Votes: 0GitHub stars: 35
- K8s Cilium TroubleshootingUse when networking fails on a Kubernetes cluster that runs Cilium as its CNI: traffic between pods dropped or timing out after a CiliumNetworkPolicy or CiliumClusterwideNetworkPolicy, "Policy denied" drops in Hubble, DNS that stops resolving after an egress policy, HTTP 403 "Access denied" from an L7 rule, toFQDNs rules that do not match, pods stuck ContainerCreating with "unable to connect to Cilium agent", Cilium agent or operator pods not ready, CiliumEndpoints not ready, or IPAM exhausti...Votes: 0GitHub stars: 35
- K8s Coredns TroubleshootingUse when cluster DNS itself misbehaves on Kubernetes: CoreDNS pods in CrashLoopBackOff ("Error during parsing: Unknown directive", "plugin/loop: Loop ... detected"), "reload failed" after a Corefile edit, external names failing while Service names resolve (";; connection timed out; no servers could be reached", SERVFAIL, "plugin/errors: 2 ... i/o timeout"), one domain or stub domain failing, rewrite or hosts entries that do not work, "Plugins not ready: \"kubernetes\"", REFUSED or "concurrent...Votes: 0GitHub stars: 35
- K8s Envoy Gateway TroubleshootingUse when Envoy Gateway (the Gateway API implementation by the Envoy project) does not route traffic in Kubernetes: a Gateway that is not Programmed ("AddressNotAssigned"), an HTTPRoute that is not Accepted ("NoMatchingListenerHostname", "NotAllowedByListeners") or whose ResolvedRefs is False ("BackendNotFound", "RefNotPermitted" without a ReferenceGrant), clients getting 404, 500 or 503 "no healthy upstream" from the gateway, a GatewayClass that is not Accepted, or BackendTrafficPolicy, Clien...Votes: 0GitHub stars: 35
- K8s Envoy TroubleshootingUse when an Envoy proxy on Kubernetes fails requests: clients get 503 "no healthy upstream", 503 "upstream connect error or disconnect/reset before headers. reset reason: remote connection failure", 404 with an empty body, or 504 "upstream request timeout", access logs show response flags (UH, UF, NR, NC, UT, UO, URX, UC), or Envoy crashes at start ("has unknown fields", "no such field", "route: unknown cluster"). Covers Envoy run directly (a Deployment with its own bootstrap, a front proxy, ...Votes: 0GitHub stars: 35
- K8s External Secrets TroubleshootingUse when External Secrets Operator does not create or update a Kubernetes Secret: an ExternalSecret with SecretSyncedError ("could not get secret data from provider"), SecretOwnedByOther ("target is owned by another ExternalSecret"), SecretMissing or SecretImmutable, a SecretStore or ClusterSecretStore that is not Ready (InvalidProviderConfig, "unable to validate store"), a ClusterSecretStore not allowed from a namespace, a ClusterExternalSecret with failed namespaces, a value that does not r...Votes: 0GitHub stars: 35
- K8s Fluent Bit TroubleshootingUse when Fluent Bit on Kubernetes does not deliver logs: the DaemonSet crashes on a config error ("tried to instance a plugin name that doesn't exist", "unknown configuration property", "configuration file contains errors"), an output fails ("failed to flush chunk", "cannot be retried", "no upstream connections available", "getaddrinfo", "Connection refused"), records arrive without Kubernetes metadata ("could not get meta for POD"), lines arrive unparsed or not at all (tail path, parser, CRI...Votes: 0GitHub stars: 35
- K8s Flux TroubleshootingUse when Flux does not deploy or update something in Kubernetes: a GitRepository, OCIRepository or HelmRepository that is not Ready ("couldn't find remote ref", "authentication required"), a Kustomization that is not Ready ("kustomization path not found", "kustomize build failed", "dependency ... is not ready", health check timeouts), a HelmRelease that is not Ready (HelmChart "invalid chart reference", InstallFailed, UpgradeFailed, RetriesExceeded), changes in Git that never reach the cluste...Votes: 0GitHub stars: 35
- K8s Gatekeeper TroubleshootingUse when OPA Gatekeeper blocks, warns about or fails to police resources in Kubernetes: "admission webhook \"validation.gatekeeper.sh\" denied the request: [constraint] message", warnings from constraints in warn mode, a constraint that should block but only shows violations in audit (dryrun), a ConstraintTemplate that does not compile (ingest_error, rego_parse_error), "no matches for kind" when applying a constraint, referential policies that never fire (sync), mutations that do not apply, o...Votes: 0GitHub stars: 35
- K8s Grafana TroubleshootingUse when Grafana on Kubernetes fails: the Grafana pod crash-loops after a change to its provisioning ("Datasource provisioning error", "Only one datasource per organization can be marked as default", "failed to parse"), a provisioned dashboard or datasource does not appear ("failed to load dashboard from", sidecar ConfigMap labels), panels show "No data" or the datasource returns "Bad Gateway" or "connection refused", "database is locked" with several replicas, permission errors on the data v...Votes: 0GitHub stars: 35
- K8s Helm TroubleshootingUse when a Helm install, upgrade or rollback fails or a release is stuck: "UPGRADE FAILED" or "INSTALLATION FAILED", "context deadline exceeded" or "resource ... not ready" after --wait, "another operation (install/upgrade/rollback) is in progress", a release in pending-install, pending-upgrade or failed state, "exists and cannot be imported into the current release: invalid ownership metadata", "cannot reuse a name that is still in use", "has no deployed releases", hook failures, "field is i...Votes: 0GitHub stars: 35
- K8s Istio TroubleshootingUse when traffic fails in an Istio service mesh on Kubernetes: HTTP 403 "RBAC: access denied" from an AuthorizationPolicy, 503 "no healthy upstream" or "upstream connect error or disconnect/reset before headers", 404 from a route that does not match, "Connection reset by peer" after PeerAuthentication STRICT, sidecars that are not injected, VirtualService, DestinationRule, Gateway or ServiceEntry rules that do not apply, or istiod and proxy problems. Reads Envoy's access log and response flag...Votes: 0GitHub stars: 35
- K8s Kyverno TroubleshootingUse when Kyverno blocks, changes or fails to police resources in Kubernetes: "admission webhook \"validate.kyverno.svc-fail\" denied the request", "resource ... was blocked due to the following policies", "Policy ... failed" from a ValidatingPolicy, a policy that should block but only reports (Audit), PolicyReports with failures, a policy that is not Ready, mutate or generate rules that do nothing, UpdateRequests stuck, or "failed calling webhook" for kyverno when its pods are down. Covers Cl...Votes: 0GitHub stars: 35
- K8s Loki TroubleshootingUse when Grafana Loki on Kubernetes rejects, drops or cannot query logs: clients getting 400, 401 or 429 from /loki/api/v1/push, "write operation failed", "has timestamp too old", "entry too far behind", "Per stream rate limit exceeded", "ingestion rate limit exceeded", "maximum active stream limit exceeded", "no org id" (missing X-Scope-OrgID tenant), Loki crashing at start with "validating config" or "invalid schema config", "failed to flush chunks", ring or memberlist errors ("empty ring",...Votes: 0GitHub stars: 35
- K8s Network TroubleshootingUse when traffic does not reach a workload in Kubernetes although its pods are running: a Service with no endpoints, a wrong selector or targetPort, connection refused or time-outs between pods, DNS names that do not resolve (NXDOMAIN, "server can't find"), a NetworkPolicy blocking traffic, or an Ingress or Gateway API route that does not route. Investigates with kubectl get and describe, asks before checks inside a container, and proposes fixes. Reads first and asks before changing anything.Votes: 0GitHub stars: 35
- K8s Node TroubleshootingUse when a Kubernetes node is unhealthy or pods will not go onto it: a node NotReady or Unknown, MemoryPressure, DiskPressure or PIDPressure, pods Evicted, pods Pending with "untolerated taint(s)", "Insufficient cpu" or "Insufficient memory" while the node looks idle, a node cordoned (SchedulingDisabled), or the cluster autoscaler not adding or removing nodes. Investigates with kubectl get, describe and events, and proposes fixes. Reads first and asks before changing anything.Votes: 0GitHub stars: 35
- K8s Opentelemetry Collector TroubleshootingUse when telemetry (traces, metrics, logs) does not get through the OpenTelemetry Collector on Kubernetes: the collector crashes at start ("invalid configuration", "references receiver ... which is not configured", "unknown type"), applications get "connection refused" on 4317 or 4318 (a receiver listening on localhost, or not in a pipeline), exporters fail ("Exporting failed. Will retry the request after interval", "Exporting failed. Dropping data.", "sending queue is full", "no children to ...Votes: 0GitHub stars: 35
- K8s Prometheus TroubleshootingUse when Prometheus on Kubernetes does not collect or alert as expected: a ServiceMonitor or PodMonitor whose targets never appear, targets that are down ("server returned HTTP status 404 Not Found", "connection refused", "context deadline exceeded"), a PrometheusRule that does not load or alerts that do not fire or reach Alertmanager, a Prometheus or Alertmanager custom resource that is not Available, "InvalidConfiguration" events from the Prometheus Operator, or Prometheus pods that are OOM...Votes: 0GitHub stars: 35
- K8s Rbac TroubleshootingUse when a Kubernetes request is refused by RBAC: "Error from server (Forbidden)", "User ... cannot list resource ... in the namespace" or "at the cluster scope", a ServiceAccount, controller, CI job or person getting 403, a RoleBinding that does not seem to apply (wrong namespace, wrong subject, a ClusterRole bound with a RoleBinding), "is attempting to grant RBAC permissions not currently held", "roleRef ... field is immutable", 401 Unauthorized versus 403 Forbidden, or a custom resource th...Votes: 0GitHub stars: 35
- K8s Storage TroubleshootingUse when Kubernetes storage blocks a workload: a PersistentVolumeClaim stuck in Pending, ProvisioningFailed events, a StorageClass that does not exist or a provisioner that cannot provide the access mode, pods Pending with "unbound immediate PersistentVolumeClaims", FailedAttachVolume, FailedMount or Multi-Attach errors, a PVC or PV stuck Terminating or Released, or a volume that is full or will not expand. Investigates with kubectl get, describe and events, and proposes fixes. Reads first an...Votes: 0GitHub stars: 35
- K8s TriageUse when something is wrong in a cluster and it is not yet clear where: "the cluster is broken", "a lot of pods are failing", "users say the app is down", "something is off after the upgrade", or any problem report that names no workload. Sweeps nodes, pods in every namespace, recent Warning events and CPU and memory use, ranks what it finds by severity, proposes a first fix for each issue and names the skill that goes deeper. Reads first and asks before changing anything.Votes: 0GitHub stars: 35
- K8s Workload TroubleshootingUse when a pod or workload is unhealthy in Kubernetes: pods stuck in Pending, CrashLoopBackOff, ImagePullBackOff or ErrImagePull, containers OOMKilled (exit code 137), failing liveness, readiness or startup probes, pods Running but not Ready, a Deployment rollout that does not progress (ProgressDeadlineExceeded), or a Job or CronJob that fails. Investigates with kubectl get, describe, logs and events, and proposes fixes. Reads first and asks before changing anything.Votes: 0GitHub stars: 35
- K8s Cloudnative Pg TroubleshootingUse when a CloudNativePG (CNPG) PostgreSQL Cluster in Kubernetes is not healthy: a Cluster stuck in "Setting up primary", "Creating a new replica" or "Waiting for the instances to become active", fewer ready instances than requested, an initdb or join pod that is Pending or in CreateContainerConfigError, PVCs that stay Pending, a bootstrap Secret that is missing, a replica that cannot be scheduled (pod anti-affinity, nodeSelector, taints), "Not enough disk space", failing WAL archiving or bac...Votes: 0GitHub stars: 35
- K8s Gateway Api TroubleshootingUse when Gateway API objects in Kubernetes do not route, whatever the implementation: a GatewayClass stuck "Waiting for controller" or not Accepted, a Gateway with no address or PROGRAMMED Unknown or False ("ListenersNotValid", "AddressNotAssigned"), a listener that is not Programmed ("InvalidCertificateRef", "ProtocolConflict", "InvalidRouteKinds", "RefNotPermitted"), an HTTPRoute, GRPCRoute or TLSRoute that is not Accepted ("NoMatchingParent", "NotAllowedByListeners", "NoMatchingListenerHos...Votes: 0GitHub stars: 35
- K8s Upgrade ReadinessUse when a Kubernetes cluster is about to be upgraded to its next minor version, or someone asks "is the cluster ready to upgrade?", "what will break when we upgrade?" or why a node drain hangs during an upgrade: PodDisruptionBudgets with ALLOWED DISRUPTIONS 0, pods with no controller ("cannot delete Pods that declare no controller"), admission webhooks with failurePolicy Fail and no endpoints, deprecated or removed APIs still in use (apiserver_requested_deprecated_apis, CRD versions marked d...Votes: 0GitHub stars: 35
- K8s Velero TroubleshootingUse when Velero backups or restores in Kubernetes fail or do not happen: a BackupStorageLocation that is Unavailable ("is unavailable", NoSuchBucket, AccessDenied, a wrong endpoint or region), a Backup in FailedValidation, Failed or PartiallyFailed, or stuck in New, Queued or InProgress, a Schedule in FailedValidation ("invalid schedule") or that makes no backups, a Restore that is Completed with warnings but did not bring objects back ("already exists", "the in-cluster version is different t...Votes: 0GitHub stars: 35
- Cluster Health CheckUse for a scheduled or on-demand overall health sweep of the cluster - nodes, unhealthy pods and workloads, disruption budgets, quotas, recent warning events, storage, Flux GitOps objects and firing alerts. Produces a prioritised list of findings with evidence.Votes: 0GitHub stars: 3
- Flux Gitops StatusUse when checking whether Flux GitOps is healthy - Kustomizations, HelmReleases, GitRepositories and other Flux sources that are not Ready, suspended, stalled or failing to reconcile - or when a component looks out of date or keeps being reverted.Votes: 0GitHub stars: 3
- Node TroubleshootingUse when a node is NotReady, cordoned, under memory, disk or PID pressure, out of allocatable resources, or when many pods fail on the same node. Also covers cluster autoscaler behaviour (scale-up not happening, pods waiting for capacity).Votes: 0GitHub stars: 3
- Prometheus QueriesUse when metrics can confirm or time a problem - memory or CPU close to limits, CPU throttling, restart trends, node resource pressure, disk or PVC filling up, API server or DNS errors - or when you need to know when something started or whether it is getting worse. Needs the prometheus_query tools.Votes: 0GitHub stars: 3
- Workload TroubleshootingUse when a specific pod or workload is unhealthy - Pending, CrashLoopBackOff, OOMKilled, ImagePullBackOff, failing readiness or liveness probes, or a Deployment that does not reach its desired replicas. Finds the root cause from pod status, events, logs and the owning controller.Votes: 0GitHub stars: 3