Task 3.2: Debugging

• Akubectl logs <pod> --container=app

  Correct

  The --container (-c) flag picks which container's logs to print in a multi-container Pod.

• Bkubectl logs <pod> --all-namespaces

  Incorrect

  That flag widens the namespace scope; it does not choose a container.

• Ckubectl describe pod <pod> --container app

  Incorrect

  describe shows the Pod's spec, status and events, not log output.

• Dkubectl exec <pod> -- cat /dev/stdout

  Incorrect

  Container output goes to the runtime's log files, which kubectl logs reads; this does not retrieve past output.

In a Pod with several containers, name the container with -c, or use --all-containers to print them all.

• Akubectl exec -it <pod> -- /bin/sh with a longer --request-timeout

  Incorrect

  The image has no shell; a longer timeout cannot add a binary that is not there.

• Bkubectl port-forward <pod> 8080:8080 and inspect the app from the laptop

  Incorrect

  port-forward opens a local port to the Pod; it does not give access to its processes.

• Ckubectl rollout restart deployment/<name> after switching to a debug image

  Incorrect

  A restart replaces the Pod, losing the state the engineer wants to inspect.

• Dkubectl debug --image=busybox --target=<container> on the running Pod

  Correct

  kubectl debug adds an ephemeral container with its own image and tools to the running Pod, and --target shares the process namespace of the named container.

Ephemeral containers exist for this: interactive troubleshooting when exec is not enough, for example with distroless images, without restarting the Pod.

• Akubectl expose service api --type=LoadBalancer

  Incorrect

  expose creates a new Service, an object change that also exposes the app publicly.

• Bkubectl proxy --port=8080 with the Service's ClusterIP as the target

  Incorrect

  kubectl proxy exposes the API server; a ClusterIP is still unroutable from the laptop.

• Ckubectl port-forward service/api 8080:80

  Correct

  port-forward opens a local port and forwards it through the API server to the Service's Pods, with no change to the cluster.

• Dkubectl edit service api to set type NodePort

  Incorrect

  Editing the Service changes the object and opens a port on every node.

Port forwarding is the debugging shortcut for reaching cluster-internal applications from a workstation without exposing them.

• AReplace the liveness probe with a readiness probe that has the same settings

  Incorrect

  Readiness only removes a Pod from Service endpoints; dropping liveness loses the restart of a hung app.

• BAdd a startupProbe that gives the app time to start before liveness checks

  Correct

  While a startup probe is configured, liveness and readiness checks are held back until it succeeds, which protects slow starters.

• CRemove the container's memory limit so the JVM can start faster

  Incorrect

  The kills come from the failing probe, not from memory.

• DSet restartPolicy to Never in the Deployment's Pod template

  Incorrect

  A Deployment's Pod template accepts only Always as restartPolicy, and stopping restarts would not make the app start faster.

• ERaise the liveness probe's initialDelaySeconds above the startup time

  Correct

  Delaying the first liveness check past the startup time also stops the early kills, and the probe stays the same afterwards.

For slow starters, give the app time with a startup probe or a longer initial delay; keep the liveness probe itself strict for later.

• Akubectl events --types=Normal

  Incorrect

  --types filters by event type for all objects.

• Bkubectl events --for pod/web-7f9c

  Correct

  The --for flag limits kubectl events to the named object.

• Ckubectl get events -A --watch

  Incorrect

  -A widens the list to every namespace.

• Dkubectl top pod web-7f9c --containers

  Incorrect

  top shows resource usage, not events.

kubectl events can focus on one object with --for and can follow it with --watch.

• A--profile=restricted

  Incorrect

  restricted applies the Restricted Pod Security settings, the opposite of extra privileges.

• B--image-pull-policy=Always

  Incorrect

  That controls image pulls, not privileges.

• C--attach=false

  Incorrect

  That only skips attaching to the container.

• D--profile=netadmin

  Correct

  The netadmin profile applies a set of properties that include network administrator privileges.

kubectl debug profiles shape the debug container's security settings, from restricted to netadmin and sysadmin.

• AterminationMessagePolicy of FallbackToLogsOnError

  Correct

  With FallbackToLogsOnError, the last chunk of container log output is used when the message file is empty and the container failed.

• BactiveDeadlineSeconds set to 60 on the Pod

  Incorrect

  That limits how long the Pod may run, not what its status reports.

• CrestartPolicy set to OnFailure for the Pod

  Incorrect

  That decides restarts, not what the status reports.

• DimagePullPolicy set to Always for the image

  Incorrect

  Image pulls are unrelated to termination messages.

Termination messages explain failures in the Pod status; falling back to logs helps apps that do not write the file.

• Akubectl logs nightly-report

  Incorrect

  Without a type, the name is treated as a Pod name, and no Pod has that exact name.

• Bkubectl logs job/nightly-report

  Correct

  kubectl logs accepts a TYPE/NAME such as job/hello and reads from a Pod of that Job.

• Ckubectl describe cronjob nightly-report

  Incorrect

  That shows a CronJob's spec and events, not logs.

• Dkubectl get job nightly-report -o yaml

  Incorrect

  That prints the Job object, not its output.

Many kubectl commands accept TYPE/NAME, which spares looking up the generated Pod name.