## 通用命令

```bash
kubectl describe pod <pod> -n <ns>          # 先看 Events
kubectl logs <pod> -n <ns> --previous       # 崩溃前日志
kubectl get pod <pod> -n <ns> -o wide
```

---

## ImagePullBackOff

**原因：** 镜像不存在、私有仓库没授权、tag 写错、ARM/x86 架构不匹配

```bash
kubectl get pod <pod> -n <ns> -o jsonpath='{.spec.containers[*].image}'
kubectl get secret -n <ns> | grep docker
```

**修复：创建 imagePullSecret**

```bash
kubectl create secret docker-registry regcred \
  --docker-server=registry.example.com \
  --docker-username=admin \
  --docker-password='密码' -n <ns>
```

Deployment 引用：

```yaml
spec:
  imagePullSecrets:
    - name: regcred
```

多架构镜像：

```bash
docker buildx build --platform linux/amd64,linux/arm64 -t xxx:v1 --push .
```

---

## CrashLoopBackOff

**原因：** 应用报错、探针太激进、OOM、启动命令错

```bash
kubectl logs <pod> -n <ns> --previous | tail -50
kubectl describe pod <pod> -n <ns> | grep -A3 "Last State"
```

| 现象 | 处理 |
|------|------|
| OOMKilled | 调大 memory limits |
| 探针误杀 | 加大 initialDelaySeconds |
| 配置缺失 | 检查 env、ConfigMap、Secret 挂载 |

---

## Pending

**原因：** 资源不足、污点、PVC 未绑定、nodeSelector 不匹配

```bash
kubectl describe pod <pod> -n <ns> | tail -15   # 看 FailedScheduling
kubectl get pvc -n <ns>
kubectl top nodes
kubectl describe nodes | grep Taints
```

| Events 关键词 | 处理 |
|---------------|------|
| Insufficient cpu/memory | 扩容节点或降低 requests |
| didn't tolerate taint | Pod 加 tolerations |
| pvc not bound | 检查 StorageClass |
| didn't match node selector | 修正 label 或删 nodeSelector |

---

## 速查

| 状态 | 第一眼看 |
|------|----------|
| ImagePullBackOff | pull 报错、imagePullSecrets |
| CrashLoopBackOff | logs --previous、OOM、探针 |
| Pending | FailedScheduling Events |