CCNA Troubleshooting Questions

When a pod's status displays Init:CrashLoopBackOff, it indicates that one of its defined init containers has exited with a non-zero status code and is repeatedly failing during startup. Kubernetes will continuously attempt to restart this failing init container before it can proceed to the main application containers, blocking the pod from reaching the Running state.

This is the correct answer. The kubelet is responsible for reporting the node's status to the API server through periodic heartbeat updates. When there is a network connectivity issue between the kubelet and the API server, the API server's node controller does not receive these updates for longer than the node-monitor-grace-period (default 40 seconds). As a result, the node is marked as NotReady, even though the kubelet process itself continues to run locally and can still manage containers on the node.

This command is the correct approach because the --previous (or -p) flag instructs the kubelet to retrieve the stdout and stderr logs from the most recently terminated instance of the container. This is essential for diagnosing CrashLoopBackOff states where the current container has restarted and its active log buffer is empty or irrelevant.

The init container's role is to run to completion before the main container starts; if it fails, the pod cannot proceed. When an init container exits with a non-zero exit code, the kubelet restarts the pod according to the restartPolicy, causing the pod to enter CrashLoopBackOff after repeated failures. This is the standard mechanism for Init:CrashLoopBackOff, so a non-zero exit code is the correct explanation.

journalctl -u kubelet is the correct command on systemd-based systems because the kubelet runs as a systemd service and writes its logs to the systemd journal. This command filters the journal to show only kubelet entries, revealing errors such as failed API server connectivity, CNI plugin failures, or node lease renewal problems. These logs are essential for diagnosing why the node is NotReady, as they contain the actual failure messages that file-based logs or kubectl cannot provide.

This is the standard diagnostic pair for a systemd-managed kubelet. `systemctl status kubelet` shows whether the unit is active (running), failed, or inactive, and gives the last few log lines plus the main process PID; it also returns a non-zero exit code when the service is not running, which is useful for scripting. `journalctl -u kubelet` retrieves the full journal for the kubelet unit, allowing you to see startup errors, crashed state, or repeated restarts—critical for identifying why the kubelet stopped, such as a bad kubelet config, certificate expiry, or a missing CSI driver.

kubectl top nodes is the correct command because it queries the metrics.k8s.io API provided by metrics-server to return each node’s current total CPU and memory usage, along with the percentage relative to allocatable capacity. It aggregates pod usage plus node-level system reservations from cAdvisor and presents a concise per-node snapshot, making it the standard built-in way to assess current node resource consumption.

kubectl describe pod pod-name retrieves the Pod's full configuration along with a dedicated 'Events' section that records timestamped, sequential notifications from the kubelet and controller-manager about that Pod. These events describe actions like scheduling decisions, container creation, image pulling, probe failures, and restarts, which are exactly what you need when debugging why a Pod is stuck or repeatedly crashing. The describe command aggregates just the events for that specific Pod, making it the direct answer to the question.

Control plane components run as static pods in the kube-system namespace, so listing pods there reveals their phase, restart counts and readiness. This works on clusters where the componentstatuses API is deprecated or disabled, making it the reliable fallback for verifying scheduler, controller-manager and etcd health.

Checking kubelet logs with `journalctl -u kubelet` is the correct first diagnostic step because it provides the authoritative record of why the kubelet is reporting NotReady. The logs will show concrete errors such as failed CNI plugin execution, repeated API server connection timeouts, disk or memory pressure conditions (`eviction signals`), or Webhook errors, all of which directly explain the node's status. This is the most efficient way to pinpoint the failure rather than guessing, and it also gives you the timestamps to correlate with events from the control plane. Only after analyzing these logs should you decide whether a restart or other intervention is necessary.

A connection refused error—specifically ECONNREFUSED—indicates that the application's TCP handshake reached the target host but nothing was listening on that port, or the service endpoints are empty because the backing database pods are not ready. This commonly occurs when the database Deployment has zero ready replicas, the Service selector does not match any pods, or the pod is using an incorrect service name or port. The container's main process exits after failing to initialize its database connection, and the kubelet restarts it, cycling into CrashLoopBackOff.

If the `command` or `args` defined in the Pod specification, or the `ENTRYPOINT` instruction within the container image's Dockerfile, refers to an executable that simply does not exist within the image's filesystem, the container runtime cannot execute it. This fundamental failure causes the container to exit immediately with a non-zero status. Kubernetes then detects this repeated failure and places the pod into a `CrashLoopBackOff` state, with `kubectl describe pod` typically showing an error like "executable file not found" or "no such file or directory" in the container's last termination message.

kubectl get events --sort-by=.lastTimestamp is correct because it lists cluster Event resources and applies a JSONPath sort on the lastTimestamp field, which records the most recent time the event was observed. This produces a clean chronological ordering of events—oldest to newest—making it easier to correlate system activity and identify the root cause sequence during troubleshooting.

Providing an invalid image name or an unavailable tag causes the container registry to return a 404 error to the kubelet. Consequently, the pod transitions into `ErrImagePull` and then `ImagePullBackOff` because the container runtime cannot locate or download the specified image layers.

This is the exact event message emitted by the kube-scheduler when a Pod references a PersistentVolumeClaim that uses the Immediate volume binding mode but has not yet been bound to a PersistentVolume. The scheduler cannot place the Pod on a node until the underlying storage is successfully provisioned and bound to satisfy the Pod's volume requirements.

Adding a toleration to the pod spec that matches the node's taint is the correct solution because tolerations explicitly opt a pod into scheduling on tainted nodes. The taint on the node uses key, value, and effect (e.g., node-role.kubernetes.io/control-plane:NoSchedule), and the toleration must mirror that key, value, and effect before the scheduler will place the pod there. This is the standard, least-privilege way to run a specific workload on a dedicated or control-plane node without weakening cluster-wide policies.

Exit code 137 is calculated as 128 plus the signal number 9 (SIGKILL), which indicates that the operating system or container runtime forcefully terminated the process. In Kubernetes, this most commonly occurs when a container exceeds its configured memory limit, triggering the Linux Out-Of-Memory (OOM) killer to terminate the process to safeguard node stability.

The kubectl describe pod command retrieves the pod's events and status conditions, which include the specific image pull failure reason and message. This satisfies the stem's need for underlying error detail that kubectl get pod alone does not expose.

A Pod can only stay Pending when the scheduler is unable to place it on a node. If every node lacks sufficient allocatable CPU and/or memory to satisfy the Pod's `resources.requests`, kube-scheduler marks the Pod unschedulable and leaves it in Pending while continuously retrying scheduling. This is purely a pre-scheduling condition, so it remains until a node is scaled up or the requests are reduced.

When kubelet is not running on a node, the node's heartbeat to the control plane is absent; after the node-monitor-grace-period, the Node controller marks the node NotReady and applies the node.kubernetes.io/not-ready:NoSchedule taint. Since no nodes are schedulable, the kube-scheduler cannot find a match for the pod, leaving it in Pending indefinitely. This is often the systemic cause when all nodes are unreachable or their kubelets have crashed.

kubectl run test-pod --image=busybox --rm -it -- wget -O- http://service:port launches a temporary, interactive busybox Pod that performs an HTTP request against the target Service from within the cluster network. The --rm flag ensures the Pod is deleted after the command finishes, and -it lets you see the output immediately. This is a classic debugging pattern for validating DNS resolution, Service routing, and application response without altering any existing workloads.

`kubectl exec <pod-name> -- nslookup kubernetes.default` runs the `nslookup` binary directly inside the target pod's network namespace. This uses the pod's own `/etc/resolv.conf`, including its `nameserver` (typically the kube-dns ClusterIP) and search domains (such as `default.svc.cluster.local`), to perform a real DNS query. It is the most direct way to verify that the pod can resolve a service name, because it replicates exactly what an application in that pod would experience.

NetworkPolicy is a namespace-scoped firewall that can restrict egress traffic from a specific pod (via podSelector) to a destination service's backing pod IP or CIDR. Even if the Service object and endpoints are intact, a NetworkPolicy denying egress from the source pod to the backend pod's IP or port will silently drop the packets, making the Service unreachable only for the affected pod(s).

A requiredDuringSchedulingIgnoredDuringExecution anti-affinity rule is a hard constraint: the scheduler will only place the pod on a node that satisfies every term of the rule. If the rule's label selector and topologyKey match labels on pods running on every available node, no node passes the check. The resulting event is '0/3 nodes are available: 3 node(s) didn't match pod anti-affinity rules,' and the pod stays Pending until a node no longer runs a conflicting pod or the rule is updated. This is the only option where the pod's own scheduling constraints, not cluster conditions, make all nodes ineligible.

kubectl describe pod <pod-name> is the correct diagnostic command because it aggregates the pod's object metadata, current status, conditions, and most importantly, recent Events from the API server, scheduler, and kubelet. For a Pending pod, the Events section reveals whether the scheduler failed due to insufficient resources, taints/tolerations, node selector mismatches, or whether a PersistentVolume claim is awaiting binding — the precise reason for the stuck state.

The tag `nginx:1.21` does not exist in the Docker Hub repository; valid tags for the 1.21 series include specific patch versions like `1.21.6`. Changing the image reference to a known valid tag allows the runtime to pull the correct manifest and start the container, resolving the ImagePullBackOff. Always verify available tags in the registry when encountering pull errors.

kubectl describe node <node> is the correct first diagnostic because it displays the Node object's Status.Conditions (Ready, MemoryPressure, DiskPressure, PIDPressure, NetworkUnavailable) and a rolling list of recent Events that record taints, kubelet restarts, and CNI failures. This single command aggregates the node's current condition, capacity, allocatable resources, and the kubelet's reported heartbeats from the control plane, letting you immediately see which signal flipped the node to NotReady without requiring SSH access to the node.

Running `kubectl exec <pod> -- nslookup kubernetes.default` is a valid troubleshooting step because it tests DNS resolution from inside the pod's network namespace, exactly where application failures occur. If this command fails, it confirms the issue is with DNS resolution rather than with the application itself. It uses the pod's configured DNS settings (resolv.conf and search domains) to query the cluster's DNS service. Success indicates the cluster DNS is reachable and resolving service names, while failure isolates the problem to DNS configuration or CoreDNS.

This is the most effective command because `kubectl exec` runs `curl` directly within the network namespace of `pod-a`, simulating the exact origin of the communication. By targeting `http://service-b:80`, it simultaneously tests DNS resolution of the service name, the ability to establish a TCP connection to the service's ClusterIP on port 80, and the application's responsiveness. This provides a comprehensive end-to-end test from the perspective of the source pod.

Executing `kubectl exec -it my-pod -- nslookup kubernetes.default.svc.cluster.local` is the most direct and effective method for debugging DNS resolution issues from within a specific pod. This command leverages `kubectl exec` to run `nslookup` directly inside `my-pod`, utilizing that pod's `/etc/resolv.conf` and its configured DNS server. It precisely tests whether the pod itself can successfully resolve the fully qualified domain name (FQDN) of the `kubernetes` service, providing immediate insight into its DNS capabilities.

kubectl logs api-6f4d7b9d4c-abcde -n production --previous is the correct command because it fetches the stdout/stderr from the previous, now-terminated container instance in the pod. In a CrashLoopBackOff, the currently restarted container usually has no useful logs — it may not have started, or it immediately restarted before writing anything — while the last crashed instance carries the actual error that triggered the restart. This gives you the application-level failure message (e.g., uncaught exception, missing config, listen EADDRINUSE) needed to fix the root cause; pair it with kubectl describe pod to see the last exit code and restart count.

The scheduler reports Insufficient memory, meaning no node has enough allocatable memory for the pod's request. Lowering the container's memory request brings it within available capacity, allowing the scheduler to bind the pod to a suitable node.

The scheduler cannot bind the pod to any node because every candidate lacks sufficient allocatable CPU or memory. Unschedulable resource requests leave the pod without a node assignment, so it remains Pending until capacity frees up or the pod's requests are reduced.

When a node becomes unreachable or experiences network partition issues, the node controller automatically applies the node.kubernetes.io/unreachable taint to it. Because the pending pod does not possess a matching toleration for this specific taint, the Kubernetes scheduler cannot assign the pod to any of these affected nodes, leaving it stuck in the Pending state.

The `kubectl top nodes` command retrieves resource usage data from the Metrics API, which is typically backed by a metrics-server that collects node-level metrics from kubelets. It reports current CPU and memory consumption in both absolute units (e.g., millicores and MiB) and as percentages of node allocatable resources. This is exactly the command needed to answer the question about node resource usage.

Running `kubectl exec` into a pod and curling the Service's ClusterIP directly tests the Service's virtual IP from inside the cluster network namespace. This validates the entire data path: the pod's routing, kube-proxy or iptables/ipvs rules, and backend endpoint selection. It is especially useful because the ClusterIP is only reachable from within the cluster, so a successful curl proves the kube-proxy rules are installing correctly and that at least one healthy backend is receiving traffic. A failed curl with a timeout, rather than a connection refused, also gives a specific hint about whether packets are being silently dropped.

If a container demands more memory than its limit allows, the image has already been successfully pulled and the container has started, so the failure mode is OOMKilled or an overloaded kubelet eviction, not ImagePullBackOff. ImagePullBackOff is exclusively a pre-start image acquisition failure, making this the one option that could never produce that state.

The `kubectl describe pod` command is the correct diagnostic because it aggregates the pod's status conditions, container states, and, crucially, the recent Events list from the kubelet and the image puller. For an `ImagePullBackOff`, the events will contain a specific reason such as `ErrImagePull`, `ImagePullBackOff`, `Failed to pull image`, or a registry authentication/not found error with the exact HTTP status. This detailed output is exactly what you need to pinpoint whether the problem is a typo in the image tag, missing credentials, or network connectivity to the registry.

The exhibit's event message contains the exact Kubernetes error string: the secret `my-secret` could not be found in the pod's namespace, so the kubelet is unable to inject the environment variable or volume content required by the container spec. Every Secret reference is namespaced, and the kubelet queries the API server for the secret exactly as it appears in the pod manifest; any typo, wrong namespace, or omitted resource will immediately produce this failure. Because the error is explicit and points to a missing API object, the most likely cause is that `my-secret` simply does not exist in the namespace where the Pod is running.

`kubectl describe pod pod-name` is a correct first step because it shows container states (Waiting, Running, Terminated) with detailed reason and message fields—for example, `CrashLoopBackOff`, `ImagePullBackOff`, or `OOMKilled`. It also lists recent events specific to that pod, such as failed volume mounts or failed liveness probes, which directly explain why a container may have never produced logs or why its log stream was cut short. When `kubectl logs` returns nothing, this command reveals whether the container even started, and if it did, what caused it to terminate or restart, making it an essential troubleshooting action.

A Kubernetes Service only forwards traffic to Pod IPs listed in its Endpoints object, which are populated by the controller based on matching selectors and the readiness status of pods. If the selector matches no pods, or the pods are not Ready (e.g., failing readiness probes or CrashLoopBackOff), the Endpoints object is empty, so connections to the Service's ClusterIP are dropped or refused. Running 'kubectl get endpoints' is the quickest way to confirm whether the Service actually has healthy, Ready backends, directly exposing the most common cause of communication failure.

When a pod requests more CPU than any node can allocate, the kube-scheduler cannot find a feasible host and sets the pod to Pending, recording an event such as `Insufficient cpu`. CPU requests are guaranteed amounts that the scheduler sums across all existing pods and compares against a node's `allocatable` CPU (node capacity minus reserved system components). Until some running pods are terminated or a node with more free CPU joins the cluster, the pod will remain Pending, which exactly matches the given event.

kubectl describe pod <pod> is correct because it renders the pod's full status section, including each container's current state (Waiting, reason, message), and appends pod Events. For an ImagePullBackOff, the Events show the exact registry error (e.g., unauthorized, manifest unknown, network timeout), and the container status shows the backoff reason, giving you the diagnostic detail needed to fix the image pull failure.

kubectl describe pod <pod-name> outputs a comprehensive summary of the pod's configuration and status, culminating in an Events section that chronologically lists recent events for that specific pod (e.g., successful pull, failed schedule, container started). These events often contain the direct cause of a pod problem, making this command one of the two candidates that actually surface events. However, it only shows events for the named pod, so its scope is limited to that Pod object.

The error 'no such file or directory' for /app/start.sh in the container logs directly indicates that the command or entrypoint defined in the pod spec references a script that does not exist within the container image. This typically happens when a Dockerfile fails to COPY the script into the image, or the image tag points to an older build without the file. Because the process cannot start, the container exits non-zero and Kubernetes enters CrashLoopBackOff.

systemctl status kubelet is the definitive, node-local command for inspecting the kubelet's systemd service state. It directly queries systemd's unit properties, showing whether the unit is active (running), failed, activating, or inactive, along with the main process ID (MainPID) and recent journal entries. This is the first step when the kubelet is suspected of malfunctioning because it immediately confirms whether the process is alive and healthy from the init system's perspective, without relying on the Kubernetes API or network latency. It also reveals the exit code or last status change, which is essential for diagnosing crashes or manual stops on the node itself.

kubectl describe pod pod-name is correct for CrashLoopBackOff because it displays the pod's full lifecycle events, container states, restart counts, and the last reason/exit code from the previous terminated container. Those events often reveal the root cause, such as image pull failures, failed readiness/liveness probes, or OOMKilled. It also shows the current backoff state and timestamps, making it the first diagnostic command to run.

The scheduler evaluates the pod's CPU request against the allocatable CPU on each node after reserving resources for existing pods and system components. If the requested CPU exceeds what any node can accommodate, the scheduler reports 'Insufficient cpu' and leaves the pod Pending. This is a resource-fit failure, not an API or runtime error, so checking the pod's resources.requests is the first diagnostic.

If the cluster lacks nodes with enough allocatable CPU or memory to satisfy the pod's resource requests, the Kubernetes scheduler cannot assign the pod to any node and leaves it in Pending. The scheduler only considers unreserved resources calculated as capacity minus requests from existing pods; a node with insufficient free capacity or failing a node selector will keep the pod unschedulable. The scheduler emits events like '0/3 nodes are available: insufficient cpu' to point you to this condition.

Scaling down other Deployments reduces the total CPU requests reported against those nodes, which is exactly what the scheduler uses to compute resource availability. When the request sums drop below a node's allocatable capacity, the pending pod's request can fit, enabling successful placement. This resolves the root cause of the pending state without altering the pod's toleration settings or risking node stability, and it is a common operational remedy for clusters experiencing CPU exhaustion.

If one or more nodes have taints (e.g., node-role.kubernetes.io/control-plane:NoSchedule) and the pod spec lacks matching tolerations, the scheduler will exclude those nodes from feasible candidates. As a result, the pod remains in Pending because no node can satisfy both taint/toleration rules and other scheduling predicates. This is a common cause of Pending, especially in single-node clusters or clusters with specialized node pools.

`kubectl logs` captures the container's stdout/stderr, so a database connection failure (e.g., "connection refused" or "dial tcp: lookup db-service") is exactly what appears. This is a typical application-level startup error that causes the process to exit, triggering the kubelet's restart backoff. Probe failures or OOM would not produce this specific log content, making this the most plausible direct cause.

Pod anti-affinity enforces that a pod cannot share a topology domain with other pods that match a specified label selector. If the pod's `requiredDuringSchedulingIgnoredDuringExecution` anti-affinity rule targets pods that appear on every node within the cluster, then each node is disqualified and the scheduler reports something like `0/3 nodes are available: 3 node(s) didn't match pod anti-affinity rules.` This exactly matches the described output, confirming the conflict with existing pods is the cause of the Pending state.

The `--previous` flag instructs kubectl to retrieve the logs of the last terminated container instance within the pod. When a container has crashed and restarted, the current container's logs are empty or show only new output, while the terminated container's logs remain accessible via this flag. This is the correct way to diagnose why the previous container failed, as it directly fetches the stdout/stderr stream from that dead instance.

The kubelet determines node readiness by reporting conditions such as Ready, and one key condition the kubelet watches is the status of the container network interface (CNI). If the network plugin (e.g., Calico, Flannel, Cilium) fails to install routes, pods, or the CNI binaries, the kubelet cannot set up pod networking, causing the Ready condition to become False. The kubelet may also have its own network readiness checks (like the NodeStatus condition for network) that fail, and the node will stay NotReady until the CNI plugin is restored. This is why a healthy kubelet and Kubernetes control plane can still show a node as NotReady when the overlay network is broken.

Checking whether the kubelet is actually running on the node is the first diagnostic action: systemctl status kubelet reports whether the unit is active, the main PID, memory/CPU usage, and a short tail of recent log lines. If the service is inactive or failed, the exit status and timestamp help determine whether the node problem is a service crash, a stopped unit, or a configuration failure. This is a quick, non-destructive check that establishes the starting point before digging into logs.

kube-proxy programs the iptables or IPVS rules that implement ClusterIP load balancing on each node. If it is not running, packets to the virtual IP are never translated to a pod endpoint, so the Service fails despite having healthy endpoints.

The Kubernetes scheduler uses a pod's CPU request to determine node feasibility during the filtering phase. Lowering this request value reduces the resource footprint required for scheduling, allowing the pod to fit onto existing nodes with limited allocatable CPU. Alternatively, evicting or deleting non-essential workloads frees up allocatable capacity on those nodes, resolving the scheduling bottleneck without requiring infrastructure changes.

When an application process exits immediately due to a missing dependency, runtime error, or misconfiguration, the container terminates with a non-zero exit code. Kubernetes detects this termination and automatically restarts the container, eventually entering a CrashLoopBackOff state as it backs off exponentially between restart attempts. This is the classic signature of an application-level startup failure.

When an init container exits with a non-zero exit code, the pod status transitions to Init:Error (or Init:CrashLoopBackOff if it keeps failing). Kubernetes treats init containers as mandatory prerequisites: they run sequentially to completion before any regular containers start. The failing init container can be identified with kubectl describe pod, which shows the last exit code and reason, and its logs are available via kubectl logs <pod> -c <init-container-name>. This directly matches the init error status shown in the question stem.

This command retrieves detailed configuration and lifecycle status of the pod, including its recent event log. The 'Events' section at the bottom of the output will explicitly detail the failure reason, such as a 'Failed to pull image' error due to an incorrect tag, network issue, or missing registry credentials.

This command is a first-line check to confirm the Service named kube-dns actually has backend Pods behind it. In Kubernetes, a Service is only able to route traffic to Pods that match its selector; if the endpoints list is empty, no Pod is available to receive DNS queries, meaning the Service is not routing to any CoreDNS Pod. You would then inspect the CoreDNS Deployment or DaemonSet to determine whether the Pods are unscheduled, crashing, or carry the wrong labels.

This command queries the Kubernetes API server for the complete state of the pod and appends a dedicated Events section at the bottom. This section explicitly details scheduler decisions, such as insufficient CPU/memory, taints and tolerations mismatches, or node selector conflicts that are keeping the pod in a pending state.

Pod anti-affinity rules prevent the scheduler from placing a pod on a node that already hosts a matching pod. By removing or relaxing these rules, such as changing a hard requiredDuringSchedulingIgnoredDuringExecution constraint to a soft preferredDuringSchedulingIgnoredDuringExecution rule, the scheduler can utilize the available worker nodes even if they already run similar pods.

`--previous` (or `-p`) is the correct flag because it instructs kubectl to retrieve the log file of the last terminated container instance for the named container in the same pod. When a container crashes and restarts, the kubelet retains the previous container's log file alongside the current one. By combining `-c my-container` with `--previous`, you specifically target the earlier incarnation that produced output, bypassing the currently empty log stream.

This command queries the Kubernetes API server for the complete state of the Pod resource, rendering its configuration, current conditions, and controller events. The "Events" section at the bottom of the output is critical for troubleshooting Pending Pods, as it reveals scheduler decisions, such as insufficient CPU/memory, node taints, or missing PersistentVolumeClaims. This makes it the primary tool for diagnosing scheduling failures.

In on-premises clusters without a cloud provider integration, the Service controller has no built-in mechanism to allocate an external IP. A load balancer controller such as MetalLB is required to watch for Services of type LoadBalancer and update their status with an IP from its address pool. Until that controller runs, the external IP is stuck in <pending>, which is exactly the symptom shown.

A nodeSelector in the pod spec requires the selected node to have all the specified label key-value pairs. If no node in the cluster carries those labels, the scheduler marks those nodes as failing the `node selector` predicate and the pod remains Pending with an event like `0/N nodes are available: N node(s) didn't match node selector`. This is the canonical cause of a pending pod when there are no volume, resource, or taint issues, and it is confirmed by checking node labels with `kubectl get nodes --show-labels`.

This command initiates an interactive execution context within the container of pod-a, allowing you to run curl directly from its network namespace. By targeting the IP address of pod-b, you can verify if the Kubernetes network plugin (CNI) is correctly routing traffic between these specific endpoints. It is the most direct way to validate data-plane connectivity from the source pod's perspective.

The `kube-dns` (or `CoreDNS`) service is the designated DNS resolver for pods within a Kubernetes cluster, with pods' `/etc/resolv.conf` typically pointing to its ClusterIP. If the underlying `kube-dns` or `CoreDNS` pods are not running, are crashing, or are misconfigured (e.g., resource starvation, incorrect upstream servers), the DNS service IP will be unresponsive to queries. This directly causes DNS resolution attempts from client pods to time out, as queries are sent to the correct IP but receive no response from the non-functional or overloaded DNS server.

Adding tolerations to the pod's manifest is the correct solution because taints repel pods unless those pods have a matching toleration. Control-plane nodes are typically tainted to prevent general workloads from running on them. By adding a toleration that matches the control-plane node's taint (e.g., `key: node-role.kubernetes.io/control-plane`, `operator: Exists`, `effect: NoSchedule`), the pod explicitly signals to the scheduler that it is permitted to be scheduled on such nodes, resolving the `Pending` state.

The pod's memory request is higher than any node's allocatable memory. The Kubernetes scheduler performs a feasibility check for each node, comparing the pod's sum of memory requests against the node's allocatable memory (which excludes reserved system resources). If no node can satisfy this request, the scheduler cannot bind the pod, leaving it in Pending state. The `kubectl describe` output would include events such as "0/3 nodes are available: insufficient memory" or "Fit failed" for all nodes, directly indicating that the request exceeds every node's capacity.

The kube-apiserver runs as a static pod in the kube-system namespace, labelled component=kube-apiserver on kubeadm clusters, so listing pods with that label selector reveals its phase and restart count. This checks control-plane health through the API itself.

kubectl get events is correct because the default output of the events command is already sorted by lastTimestamp, the moment each event was last observed, from most to least recent. This gives an effective chronological view without needing extra flags, satisfying the requirement to view events sorted by a time field.

Because the kubelet typically runs as a systemd service on the host operating system rather than as a containerized pod, its logs are managed by systemd-journald. Running `journalctl -u kubelet` allows you to view the service's standard output and error streams directly on the node. This is the standard method for diagnosing startup failures, certificate issues, or connection timeouts to the control plane.