Logs, CLI Monitoring and Debugging

Diagnosis almost always starts with kubectl get pods, whose STATUS column names the failure class — Pending, ContainerCreating, ImagePullBackOff, CrashLoopBackOff — and kubectl describe pod, whose Events section explains why. For a Pending Pod with no container ever created, Events is where a message like "0/4 nodes available: insufficient cpu" shows up; kubectl logs is empty because there is nothing to log yet. For a crashed container, describe's Last State shows Terminated with a reason — OOMKilled means the container tried to use more memory than its limit allowed and the kernel's out-of-memory killer ended it, a distinct failure from a probe failure or a bad exit code.

kubectl logs <pod> shows the current container instance's output; after a crash and restart, that instance is new, so kubectl logs <pod> --previous is what shows the crashed instance's actual output. -f follows logs live, and -c <container> selects one container in a multi-container Pod.

kubectl describe pod web-7fdb6f9b56-2vp8x
kubectl logs web-7fdb6f9b56-2vp8x --previous
kubectl logs web-7fdb6f9b56-2vp8x -c sidecar -f

kubectl top pods and kubectl top nodes read from the Metrics API, which needs metrics-server (or an equivalent) deployed in the cluster — it is not part of a base Kubernetes install, so a fresh cluster returns an error rather than numbers. A repeatedly crashing container follows CrashLoopBackOff: Kubernetes waits before each restart with a delay that grows with each failure rather than retrying instantly every time.

When a container has no shell to kubectl exec into — a distroless image, or one deliberately stripped of tools — kubectl debug -it <pod> --image=<debug-image> --target=<container> attaches an ephemeral container that shares the target's process namespace, so you can inspect its processes and filesystem from a fresh, fully tooled container without rebuilding or replacing anything. This has been stable since Kubernetes v1.25, and once added, an ephemeral container cannot be removed — it stays until the Pod itself is gone.