Troubleshooting Scenario Questions

oc rollout undo

Why wrong: This is a fix, not a troubleshooting tool.

oc delete project

Why wrong: This is destructive.

oc start-build

Why wrong: This restarts the build, not debugging.

The API server service is missing endpoint IPs.

Why wrong: API server endpoints affect management operations, not pod external DNS lookups.

NodePort range exhaustion prevents external DNS packets from traversing worker nodes.

Why wrong: DNS traffic does not use NodePorts.

The cluster ingress controller is blocking external UDP port 53.

Why wrong: Ingress controllers handle HTTP/TLS traffic, not UDP DNS forwarding.

oc test dns --cluster

Why wrong: There is no 'oc test dns' subcommand in the OpenShift CLI.

oc adm diagnose network-dns

Why wrong: oc adm diagnose is used for general cluster diagnostics, not interactive ephemeral pod deployment.

oc debug node/worker-1 --image=registry.redhat.io/rhel9/support-tools:latest

Why wrong: oc debug node runs on the host namespace, which does not test cluster internal pod DNS resolution directly in the same manner as a cluster pod.

Running systemctl restart firewalld on all worker nodes simultaneously

Why wrong: Restarting firewalld disrupts node networking and is not a standard troubleshooting tool for OVN flows.

Editing the master /etc/hosts file to add custom pod IP mappings

Why wrong: Static /etc/hosts edits do not resolve dynamic pod network routing or policy drops.

Delete all pending MachineConfig objects from the cluster.

Why wrong: Deleting MachineConfigs removes the desired configuration entirely rather than temporarily pausing application.

Scale down the machine-config-operator deployment in openshift-machine-config-operator to zero replicas.

Why wrong: Scaling down the MCO deployment directly is unsupported and can destabilize cluster node certificate management and core controllers.

Annotate all worker nodes with 'machineconfiguration.openshift.io/paused=true'.

Why wrong: Pausing is configured on the MachineConfigPool resource, not via individual node annotations.

Check the MachineConfigPool for paused reconciliation flags.

Why wrong: MachineConfigPool controls node configurations, whereas OLM manages Operators.

Review the ClusterVersion resource status for pending updates.

Why wrong: ClusterVersion tracks OpenShift platform upgrades, not OLM Operator installation lifecycles.

Inspect the KubeletConfig custom resource for validation errors.

Why wrong: KubeletConfig is used for customizing kubelet parameters on worker nodes, unrelated to OLM.

In the openshift-apiserver namespace

Why wrong: The API server validates manifests, but network rule enforcement is logged by CNI controller pods.

In the kube-system namespace under core-dns logs

Why wrong: CoreDNS handles name resolution, not network policy compilation.

In the openshift-ingress namespace under router pods

Why wrong: Router pods handle HTTP/TLS routing, not CNI network policies.

Switch the upgrade channel to 'fast-4.14' to bypass the degraded check.

Why wrong: Switching channels does not bypass the health checks performed by the CVO on cluster operators.

Delete the Cluster Version Operator deployment to force a reset of the upgrade state machine.

Why wrong: Deleting core operator deployments can corrupt cluster state; issues should be resolved via standard troubleshooting.

Force the upgrade by running 'oc adm upgrade --to=<version> --force-ignore-degraded'.

Why wrong: There is no '--force-ignore-degraded' flag in OpenShift upgrade commands.

runAsUser.type: RunAsAny

Why wrong: This controls the user ID execution strategy, not host port binding permissions.

allowPrivilegedContainer: true

Why wrong: This field allows containers to run in privileged mode, which is overly permissive just for host port binding.

privileged: true

Why wrong: Setting privileged to true grants unrestricted access, which bypasses all security constraints and exposes the host kernel unnecessarily.

Modify the global ClusterVersion resource with the namespace-specific pull secret.

Why wrong: Global cluster pull secrets apply cluster-wide and do not support per-namespace custom overrides directly through ClusterVersion.

Edit the CatalogSource resource to inject credentials into the CSV.

Why wrong: CatalogSources provide package manifests, not namespace pod pull credentials.

Annotate the OperatorGroup with 'olm.openshift.io/pull-secret=true'.

Why wrong: OperatorGroups do not support pull-secret annotations.

oc adm top scc

Why wrong: This command does not exist.

oc get scc --debug

Why wrong: There is no debug flag for the get command.

oc explain scc

Why wrong: This only provides documentation on the API object.

Run 'oc adm diagnostics storage'.

Why wrong: This diagnostic tool is not a standard troubleshooting command for CSI provisioner backend errors.

Inspect the container image registry logs.

Why wrong: Image registry has no relation to storage provisioning controllers.

Check /var/log/messages on the control plane nodes.

Why wrong: OpenShift containerizes control plane services; logs are accessed via 'oc logs', not direct file inspection on nodes.

oc describe machineconfigpool worker

Why wrong: Describing the pool shows high-level status conditions and node counts, but not the detailed MCD failure script output.

oc logs -n openshift-cluster-version-operator deployment/cluster-version-operator

Why wrong: The CVO coordinates cluster upgrades as a whole, but individual node file deployment is handled by the MCO.

journalctl -u kubelet -e

Why wrong: The kubelet manages container lifecycles, not the specific OS-level MachineConfig file applications handled by MCO.

oc top pod <pod-name> --containers

Why wrong: oc top shows current real-time usage, but a crashed pod will return an error since it is no longer running.

oc get pod <pod-name> -o yaml

Why wrong: YAML output shows static configuration but does not summarize exit reasons and last termination state cleanly.

oc adm diagnostics

Why wrong: adm diagnostics is a general cluster health check tool, not for querying specific pod OOM states.

oc get events -n openshift-storage

Why wrong: While events can show errors, the detailed CSI driver and attacher plugin logs are necessary for deep storage troubleshooting.

oc debug node/worker-0

Why wrong: Debugging the node is premature before checking the storage controller events and PVC description.

oc logs -n openshift-cluster-storage-operator deployment/csi-snapshot-controller-operator

Why wrong: This operator manages snapshots, not the volume attachment and mounting operations.