Azure AKS: diagnose outbound SNAT exhaustion before adding a NAT Gateway
A production runbook for separating DNS, remote dependency, network policy, conntrack and Azure SNAT pressure on AKS before changing the cluster outbound path.
Read article
Tag
aks
15 articles connected to this technical signal.
Azure AKS: diagnose HPA oscillation before raising replica limits
A production runbook for separating noisy metrics, miscalibrated requests, slow startup and node capacity before changing Horizontal Pod Autoscaler bounds on AKS.
Read articleAKS: diagnose intermittent DNS before restarting CoreDNS
A production runbook for separating pod resolver, CoreDNS, service path, upstream DNS and node-specific failures before restarting or rolling back AKS DNS.
Read articleAKS: diagnose a NetworkPolicy-blocked flow before loosening cluster traffic
A production runbook for proving whether AKS traffic is denied by Kubernetes or Cilium policy, using selectors, both flow directions, DNS checks, bounded evidence and rollback.
Read articleAzure Container Registry: diagnose incomplete image replication before retrying a multi-region rollout
A production runbook for separating ACR replication, regional routing, digests, identity and network paths before retrying or rolling back a container rollout.
Read articleAzure Monitor Managed Prometheus: contain a cardinality spike before raising quotas
A production runbook for isolating the metric, target and labels behind an AKS time-series spike before filtering collection, adding capacity or rolling back.
Read articleAzure AKS: diagnose a stuck rollout before forcing rollback
A production runbook for locating an AKS rollout stalled across Deployment, ReplicaSet, scheduling, image and readiness, then resuming or returning to a known revision with explicit stop conditions.
Read articleAzure ACR and AKS: verify an image signature before production promotion
A production runbook for pinning an ACR digest, verifying its Notation signature, scoping trust policy, promoting by digest, and rolling back without disabling provenance controls.
Read articleAzure AKS: diagnose Workload Identity before bringing back a secret
A production runbook for isolating a Microsoft Entra Workload ID failure across the pod, ServiceAccount, webhook, OIDC token, managed identity and RBAC, then validating or rolling back without a client secret.
Read articleAzure ACR and AKS: contain a vulnerable image digest before redeployment
A production runbook for mapping an ACR vulnerability signal to AKS pods, freezing promotion, returning to a known digest, validating the rollout, then retaining or deleting the suspect image.
Read articleAzure AKS: unblock a node pool upgrade stopped by a PDB
A production runbook for diagnosing an AKS drain blocked by a PodDisruptionBudget, recovering disruption headroom, fixing capacity or readiness, then validating or postponing the upgrade without removing safeguards.
Read articleAzure Container Registry: diagnose an image pull failure before redeploying
A production runbook for qualifying an ACR image pull failure with identity, network, DNS, firewall, logs, node cache, validation and rollback before rerunning deployment.
Read articleAzure NAT Gateway: diagnose SNAT exhaustion and outbound IP drift
An operational runbook for qualifying Azure outbound incidents involving NAT Gateway, SNAT ports, UDR, NSG, firewalls, allowlists and rollback.
Read articleAzure AKS: diagnose private ingress before changing deployments
Build an operational runbook for AKS private ingress failures by separating DNS, Application Gateway, ingress controller, Kubernetes service endpoints, pod readiness and rollback evidence.
Read articleKQL snippet: correlate AKS private ingress and application logs
A short query to read ingress controller and application logs together when a private AKS route returns 502, timeouts or no endpoints.
Read article