Troubleshooting

Troubleshooting

Node stuck in NotReady

Check kubelet logs:

sudo k0s kubectl describe node $(hostname)
journalctl -u k0scontroller -f

Common causes: firewall blocking port 10250, kube-bridge not in the trusted zone, or SELinux denying containerd operations.

Eviction pressure on large disks

Caution

On a controller with --enable-worker, the default workerProfile does not apply through the normal reconciler. You must patch the kubelet config at /var/lib/k0s/kubelet-config.yaml after k0s starts and restart the kubelet.

Kubernetes defaults to percentage-based eviction thresholds. On a 2 TB disk, 10% means eviction triggers at 200 GB free. Override with absolute thresholds in your k0s config under spec.workerProfiles:

spec:
  workerProfiles:
    - name: default
      values:
        evictionHard:
          nodefs.available: "10Gi"
          imagefs.available: "10Gi"
          memory.available: "256Mi"
          nodefs.inodesFree: "5%"

SELinux denials

Check the audit log:

sudo ausearch -m AVC -ts recent

If containerd operations are blocked, verify container-selinux is installed and the /etc/k0s/containerd.d/selinux.toml snippet is in place.

Konnectivity agent not connecting

The konnectivity agent on worker nodes connects to port 8132 on the controller. Verify the port is open and reachable. On Fedora, check both firewall-cmd --list-all and that kube-bridge is in the trusted zone.