Kubernetes Networking, DNS & Ingress Errors
The Kubernetes failures where pods can't talk to each other or the outside world: connection refused in-cluster, CoreDNS SERVFAIL, dial-tcp i/o timeouts, a Service with no endpoints, ingress 503/413 errors, or a CNI that won't set up the pod network. Each guide opens with the cause and the `kubectl get endpoints`, `nslookup`, and CNI commands to prove it. Pick your symptom below, or paste it into the assistant.
Fix your error now
Paste the error or logs and let the Incident Assistant diagnose it, or run a guided triage prompt with AI — no copy-paste.
Every guide in this cluster
20 guides-
'connect: connection refused' Pod-to-Pod Networking
Fix dial tcp connection refused between pods and Services: app not listening, wrong targetPort, and readiness gaps. Distinct from kubectl server refused errors.
-
'SERVFAIL' from CoreDNS Resolution Failure
Fix CoreDNS SERVFAIL in Kubernetes: broken upstream resolvers, the loop plugin, and forward misconfiguration. Distinct from NXDOMAIN name-not-found errors.
-
'503 Service Temporarily Unavailable' From ingress-nginx
Fix ingress-nginx 503 Service Temporarily Unavailable: no healthy upstream endpoints, service selector mismatch, and pods that never reach Ready.
-
'dial tcp <ip>:<port>: i/o timeout' Connection Timeout
Fix 'dial tcp <ip>:<port>: i/o timeout' in Kubernetes: NetworkPolicy denials, cloud security groups, CNI MTU mismatch, and cross-node pod connectivity.
-
'cni config uninitialized' Node NotReady Network Failure
Fix Kubernetes 'container runtime network not ready: NetworkReady=false ... cni config uninitialized' NotReady nodes: install/repair the CNI plugin and restore pod networking.
-
'CNI request failed with status 400' failed to delegate add
Fix 'networkPlugin cni failed: CNI request failed with status 400: failed to delegate add' in Kubernetes: Calico/Cilium/Flannel IPAM exhaustion and config issues.
-
'default backend - 404' from ingress-nginx
Fix default backend - 404 from ingress-nginx: resolve missing Ingress rules, ingressClassName mismatch, empty endpoints, wrong pathType, and host header issues.
-
'dial tcp <ip>:<port>: connect: no route to host'
Fix 'dial tcp: connect: no route to host' in Kubernetes: stale Service endpoints, broken kube-proxy iptables rules, and node routing or firewall problems.
-
'Liveness probe failed: ... connection refused' Restart Loop
Fix Kubernetes 'Liveness probe failed: connection refused' restart loops: diagnose wrong probe port/path, apps that start slowly, and when to add a startupProbe with kubectl.
-
'lookup <svc>.svc.cluster.local: no such host' DNS NXDOMAIN
Fix 'lookup svc.ns.svc.cluster.local on 10.96.0.10:53: no such host' in Kubernetes: CoreDNS, service name typos, ndots, search domains, and NXDOMAIN failures.
-
'networkPlugin cni failed to set up pod' CNI Failures
Fix networkPlugin cni failed to set up pod errors: missing CNI binaries, IPAM pool exhaustion, stale cni0 bridge, unready CNI pods, and unassigned podCIDR.
-
'no endpoints available for service' Empty Service
Fix 'no endpoints available for service': align Service selectors with pod labels, pass readiness probes, and restore EndpointSlices so traffic reaches your pods again.
-
'no such file /var/run/secrets/.../token' ServiceAccount Token Not Mounted
Fix pods that cannot authenticate to the API: 'open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file' from automountServiceAccountToken false or a missing projected token.
-
'Readiness probe failed: statuscode: 503' — Fix Unready Pods
Fix the Kubernetes 'Readiness probe failed: statuscode: 503' error: diagnose dependency checks, warmup timing, and probe endpoints that report unready.
-
code = Unavailable desc = connection error' Kubelet to Runtime
Fix Kubernetes 'rpc error: code = Unavailable desc = connection error' between kubelet and the container runtime: diagnose a down CRI socket, restarting containerd, and NotReady nodes.
-
'The connection to the server was refused' API Server Down
Fix 'connection to the server was refused' on port 6443: diagnose a crashed kube-apiserver, stale kubeconfig, dead load balancer, expired certs, and a stopped kubelet.
-
'upstream connect error or disconnect/reset before headers' Envoy
Fix Envoy/Istio upstream connect error, reset reason connection failure: backend down, wrong port, mTLS PERMISSIVE vs STRICT mismatch, and missing endpoints.
-
'v1beta1.metrics.k8s.io: the server is currently unable to handle the request'
Fix Kubernetes 'v1beta1.metrics.k8s.io: the server is currently unable to handle the request': repair a down metrics-server APIService that breaks kubectl top and HPA scaling.
-
'x509: certificate is valid for ..., not <svc>.<ns>.svc' Admission Webhook Failure
Fix the admission webhook 'x509: certificate is valid for <names>, not <svc>.<ns>.svc' error: repair serving certificate SANs and the webhook caBundle so the API server can call it.
-
Ingress '413 Request Entity Too Large' — Fix Upload Limits
Fix the ingress 413 Request Entity Too Large error in Kubernetes: raise proxy-body-size on ingress-nginx annotations and the backend so uploads succeed.
Kubernetes & Helm AI prompts
Copy-paste, production-safe prompts for this stack.
Kubernetes & Helm command center
Top errors, validators, and runbooks for the whole stack.
Frequently asked questions
Why does my Service have no endpoints?
kubectl get svc <name> -o wide selectors against the pod labels, and check kubectl get endpoints <name>. See no endpoints available.What causes CoreDNS SERVFAIL in a cluster?
Corefile/stub domain. Check the CoreDNS pod logs and test with kubectl run -it --rm dnsutils. See CoreDNS SERVFAIL.