Pod Lifecycle

# Replace <namespace> with the application namespace.
kubectl get pods -n <namespace> -o wide

# Show the Pod's events, conditions, containers, volumes, node, and failure messages.
kubectl describe pod <pod-name> -n <namespace>

# Show container statuses including waiting/running/terminated reasons.
kubectl get pod <pod-name> -n <namespace> -o jsonpath='{range .status.containerStatuses[*]}{.name} ready={.ready} restarts={.restartCount} state={.state}{"\n"}{end}'

# Get current container logs. Add -c <container-name> for multi-container Pods.
kubectl logs <pod-name> -n <namespace> --tail=100

# Get logs from the previous crashed container instance.
kubectl logs <pod-name> -n <namespace> --previous --tail=100

# Watch Pod state while testing a fix or rollout.
kubectl get pod <pod-name> -n <namespace> --watch

# If NODE is empty, the scheduler has not placed the Pod.
kubectl get pod <pod-name> -n <namespace> -o wide

# Read scheduler messages such as insufficient CPU, taints, affinity, or PVC binding.
kubectl describe pod <pod-name> -n <namespace>

# Check node capacity and pressure.
kubectl get nodes -o wide
kubectl describe nodes | grep -E 'Name:|Taints:|Allocatable:|Allocated resources:' -A8

# Check whether an unbound PVC is blocking scheduling.
kubectl get pvc -n <namespace>
kubectl describe pvc <pvc-name> -n <namespace>

# Events usually name the failed step: FailedMount, FailedCreatePodSandBox, FailedPull, etc.
kubectl describe pod <pod-name> -n <namespace>

# Check referenced ConfigMaps and Secrets exist in the same namespace as the Pod.
kubectl get configmap,secret -n <namespace>

# Check CNI and kube-proxy style components in kube-system.
kubectl get pods -n kube-system -o wide | grep -E 'calico|cilium|flannel|aws-node|azure|kube-proxy'

# Check the node that owns this Pod.
kubectl get pod <pod-name> -n <namespace> -o jsonpath='{.spec.nodeName}{"\n"}'
kubectl describe node <node-name>

apiVersion: v1
kind: Secret
metadata:
  name: registry-creds # Referenced by imagePullSecrets in the Pod spec.
  namespace: app # Must be in the same namespace as the Pod.
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: BASE64_ENCODED_DOCKER_CONFIG_JSON # Usually created by kubectl create secret docker-registry.
---
apiVersion: v1
kind: Pod
metadata:
  name: private-image-demo
  namespace: app
spec:
  imagePullSecrets:
    - name: registry-creds # Kubelet uses this Secret when pulling private images.
  containers:
    - name: app
      image: private-registry.example.com/team/app:1.0.0 # Replace with approved registry/image/tag.
      ports:
        - containerPort: 8080

# Current logs may be short if the process exits quickly.
kubectl logs <pod-name> -n <namespace> -c <container-name> --tail=100

# Previous logs are usually the key for CrashLoopBackOff.
kubectl logs <pod-name> -n <namespace> -c <container-name> --previous --tail=200

# Show exit code and reason from the last terminated container.
kubectl get pod <pod-name> -n <namespace> \
  -o jsonpath='{range .status.containerStatuses[*]}{.name} lastState={.lastState}{"\n"}{end}'

# Common signal: exitCode 137 often means the process was killed, frequently OOMKilled.
kubectl describe pod <pod-name> -n <namespace> | grep -A8 -E 'Last State|Reason|Exit Code|OOMKilled'

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      terminationGracePeriodSeconds: 30 # Time allowed after SIGTERM before SIGKILL.
      containers:
        - name: web
          image: nginx:1.27
          ports:
            - containerPort: 80
          startupProbe:
            httpGet:
              path: /healthz/startup # Use an endpoint that succeeds only after startup is complete.
              port: 80
            failureThreshold: 30 # 30 failures * 2s = up to 60s startup allowance.
            periodSeconds: 2
          readinessProbe:
            httpGet:
              path: /ready # Use dependency-aware readiness, not just process-alive.
              port: 80
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /healthz/live # Keep this lightweight; avoid deep dependency checks.
              port: 80
            initialDelaySeconds: 20
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3

apiVersion: v1
kind: Pod
metadata:
  name: graceful-demo
  namespace: app
spec:
  terminationGracePeriodSeconds: 45 # Match this to app shutdown time and load balancer drain behavior.
  containers:
    - name: app
      image: nginx:1.27
      lifecycle:
        preStop:
          exec:
            command:
              - /bin/sh
              - -c
              - sleep 10 # Gives endpoint removal/load balancer drain a short buffer before process exit.
      ports:
        - containerPort: 80

# Check if a stuck terminating Pod has finalizers.
kubectl get pod <pod-name> -n <namespace> -o jsonpath='{.metadata.finalizers}{"\n"}'

# Check deletion timestamp and grace period.
kubectl get pod <pod-name> -n <namespace> -o jsonpath='deleting={.metadata.deletionTimestamp} grace={.metadata.deletionGracePeriodSeconds}{"\n"}'

# Do not force delete until you understand storage/network side effects.
# Force delete removes the API object; it does not guarantee the process stopped instantly on the node.
kubectl delete pod <pod-name> -n <namespace> --grace-period=0 --force

apiVersion: v1
kind: Pod
metadata:
  name: lifecycle-demo
  namespace: app
  labels:
    app: lifecycle-demo # Service selectors and troubleshooting commands can use this label.
spec:
  restartPolicy: Always # Always for long-running app Pods; Jobs usually use Never or OnFailure.
  terminationGracePeriodSeconds: 30
  containers:
    - name: app
      image: nginx:1.27
      imagePullPolicy: IfNotPresent # Use Always for mutable tags; prefer immutable tags or digests in prod.
      ports:
        - name: http
          containerPort: 80
      env:
        - name: ENVIRONMENT
          value: production # Example inline env var; Secrets/ConfigMaps are better for shared config.
      readinessProbe:
        httpGet:
          path: /
          port: http
        periodSeconds: 10
      livenessProbe:
        httpGet:
          path: /
          port: http
        initialDelaySeconds: 20
        periodSeconds: 10
      resources:
        requests:
          cpu: 100m # Scheduler reserves this amount.
          memory: 128Mi
        limits:
          cpu: 500m # Container is throttled above this CPU limit.
          memory: 256Mi # Container can be OOMKilled above this memory limit.