Troubleshooting guide · Running but not ready

Pod Running but not ready: readiness probes and Services with no endpoints

A pod that is Running but shows 0/1 in the READY column has containers that started and a readiness check that is failing, so Kubernetes has taken it out of every Service that selects it. The probe's failure message is in the pod's events; a Service that reaches no pods at all is more often a selector that matches nothing.

Updated

Why the probe fails

  • connection refused: nothing is listening on that port yet, or at all — the probe names a different port from the one the application binds, or the application listens on 127.0.0.1 instead of every address.
  • A non-2xx status: the endpoint is reached and says it is not ready — often because a dependency it checks is down. A readiness check that fails when a shared database blips takes every replica out at once.
  • timeout: the endpoint answers more slowly than timeoutSeconds, which defaults to one second.
  • The wrong path or scheme: an HTTP probe against an HTTPS port, or a path the application does not serve.

Events like Readiness probe failed: HTTP probe failed with statuscode: 503, or connection refused:

kubectl describe pod <pod> -n <namespace>

Test the endpoint yourself

Forward a local port to the pod, then request the probe's path on localhost:8080 from your machine:

kubectl port-forward pod/<pod> 8080:<port> -n <namespace>

When the Service reaches nothing

If the pods are ready and the Service still sends no traffic, its selector probably matches no pods. A Service's endpoints list exactly which pods it will route to:

The endpoints behind a Service; ready addresses are the pods receiving traffic:

kubectl get endpointslices -n <namespace> -l kubernetes.io/service-name=<service>

The labels the Service selects on:

kubectl get service <service> -n <namespace> -o jsonpath='{.spec.selector}'

The pods those labels actually match. None means a typo, or labels changed on one side:

kubectl get pods -n <namespace> -l <key>=<value>

Check the Service's targetPort too: it must be the port the container listens on, by number or by the port's name.

In PodSteer

What PodSteer does about it.

  • A pod running but not ready for five minutes is a finding: its containers run, readiness fails, and no Service is sending it traffic.
  • The dependency map draws which pods a Service actually selects — including a Service that reaches only some of a workload's pods, or none.
  • A reachability probe tests a Service or a pod from your machine or from inside the cluster, and says which route it took.
PodSteer's cluster overview with its findings open under a banner reading Needs attention, 4 critical and 5 warning findings. Listed: an image that cannot be pulled for two pods of storefront/reviews, two unschedulable pods of storefront/search-indexer, CrashLoopBackOff for the image-resizer deployment, an unschedulable Trivy scanner job, and the start of a warning about failing startup probes. Each finding says what the state means. PodSteer's cluster overview with its findings open under a banner reading Needs attention, 4 critical and 5 warning findings. Listed: an image that cannot be pulled for two pods of storefront/reviews, two unschedulable pods of storefront/search-indexer, CrashLoopBackOff for the image-resizer deployment, an unschedulable Trivy scanner job, and the start of a warning about failing startup probes. Each finding says what the state means.
Findings, named by the workload. Each finding names the workload it belongs to and says what the state means, before a single pod has been opened.
Download PodSteer Cluster assessment Shells and terminals

Read next

CrashLoopBackOff

The container starts, exits and is restarted with a growing delay. Find the reason in the previous attempt's logs and its exit code.

CreateContainerConfigError

The kubelet cannot build the container's configuration: a ConfigMap, Secret or key it names is missing, or a security setting cannot be met.

Pod stuck in Terminating

The pod was deleted but has not gone. A finalizer, a process ignoring SIGTERM, or a node nobody can reach is holding it.