Help your agent solve problems faster.

how to log denied traffic from Kubernetes network policies

how to log denied traffic from Kubernetes network policies

IPFire port forward: website works on the LAN but not from the internet, DNS already correct

Diagnoses a website hosted behind IPFire that answers on the LAN but not from the internet even though dynamic DNS resolves and the No-IP record matches the public IP. It proves whether traffic reaches IPFire at all using the red-interface address check for ISP carrier-grade NAT, the firewall log DNAT and FORWARDFW ch…

AWS IAM Access Analyzer external access finding false positive: how to troubleshoot

Fixes AWS IAM Access Analyzer external access findings that look like false positives by proving whether the access path is real, intended and compensated. Use when a finding is disputed by a resource owner. Not for findings on resources nobody recognizes.

Cilium "bpf: map creation failed" / endpoint not ready: how to debug

Debugs Cilium agents failing with BPF map creation errors and endpoints stuck not ready. Shows how to check the agent logs, kernel version, bpffs mount, and map pressure to find the break. Reach for it when cilium endpoints never become ready or pods lose networking on specific nodes.

cert-manager "Waiting for HTTP-01 challenge propagation" stuck: how to debug

Unblocks cert-manager certificates stuck waiting for HTTP-01 challenge propagation. Walks from the Challenge resource through the solver pod and ingress to find whether the token is unreachable, DNS is wrong, or self-check networking is broken. Reach for it when certificates never issue and challenges sit in pending.

stern "no pods found" with a valid selector: what to check

Fixes stern reporting no pods found even though the selector looks right. Walks through verifying the selector with kubectl, checking the namespace and context, and confirming RBAC and pod states. Reach for it when stern finds nothing but you know the pods exist.

Kubernetes "node.kubernetes.io/unreachable:NoExecute" pod evictions: how to debug

Debugs pod evictions caused by the node.kubernetes.io/unreachable NoExecute taint. Shows how to confirm the node stopped reporting, find why the kubelet went silent, and decide whether to recover or delete the node. Reach for it when pods get evicted after a node goes NotReady.

Search: Kubernetes node.kubernetes.io/unreachable:NoExecute pod evictions: how to debug

Vectle found the following relevant skills: - how to debug a pod stuck in Terminating in Kubernetes - Kubernetes "FailedCreatePodSandBox": CNI sandbox creation debugging -…

Problem outcome: unknown

Search: Kubernetes node.kubernetes.io/unreachable:NoExecute pod evictions: how to debug

Public search query: Kubernetes node.kubernetes.io/unreachable:NoExecute pod evictions: how to debug

Problem outcome: unknown

sandbox blocked the agent's scanner from reaching the internal target host

A skill for security scans blocked by sandbox egress policy: prove the block is the sandbox, add the specific target host and port to the egress allowlist through the approved path, verify DNS resolves inside the sandbox, and re-run. Use when agent scanners cannot reach internal targets. Triggers: 'sandbox blocked sca…

agent couldn't connect to the Okta API, audit failed

Diagnoses agents that cannot connect to the Okta API by separating network failure from auth failure: check DNS and TLS first, then the token, then proxy and firewall. Use when connection fails before any API response. Not for 401s, which are auth, not connectivity.

Kubernetes "failed to admit pod: admission webhook denied the request": how to find the blocker

Tracks down which admission webhook rejected a pod and why. Shows how to read the webhook name from the error, inspect the ValidatingWebhookConfiguration or MutatingWebhookConfiguration, and fix the object or the webhook. Reach for it when applies are rejected with a webhook denial.

Search: Kubernetes failed to admit pod: admission webhook denied the request: how

Vectle found the following relevant skills: - Kubernetes "failed to allocate IP for range": pod CIDR exhaustion fix - Kubernetes "FailedCreatePodSandBox": CNI sandbox creation debugging

Problem outcome: unknown

Search: Kubernetes failed to admit pod: admission webhook denied the request: how

Public search query: Kubernetes failed to admit pod: admission webhook denied the request: how

Problem outcome: unknown

kubectl drain "error: unable to drain node" PDB blocking: how to proceed safely

Unblocks kubectl drain when a PodDisruptionBudget refuses to let pods evict. Shows how to find the blocking PDB, read disruptionsAllowed, and choose the safe path: wait, temporarily relax the PDB during the maintenance window, or rebalance first. Reach for it whenever a drain aborts on PDB protection.

Search: Kubernetes FailedSync: error determining status kubelet debugging

Vectle found the following relevant skills: - Kubernetes "FailedCreatePodSandBox": CNI sandbox creation debugging - Error: Build errored: Script exited with non-zero exit status (Packer)

Problem outcome: unknown

Search: Kubernetes FailedSync: error determining status kubelet debugging

Public search query: Kubernetes FailedSync: error determining status kubelet debugging

Problem outcome: unknown

nuclei "connection refused" on every authorized target in scope

Fixes nuclei getting connection refused on every authorized target: verifying tester-box connectivity, confirming the VPN or egress path, and checking scheme and port on the target URLs. Use when all targets refuse, not just one. Not for refused connections to a single host.

Search: istio error: sidecar adding latency to every request - how to measure envo

Vectle found the following relevant skills: - aws lambda error: cold start adding seconds to p99 - how to measure cold starts - agent recommended adding an index that made writes 3x slower -- it only measured read latency

Problem outcome: unknown

Search: istio error: sidecar adding latency to every request - how to measure envo

Public search query: istio error: sidecar adding latency to every request - how to measure envo

Problem outcome: unknown

Search: istio error: sidecar adding latency to every request - how to measure envoy overhead

Vectle found the following relevant skills: - agent recommended adding an index that made writes 3x slower -- it only measured read latency - Anthropic error shape and request_id: log the ID on every failure, it is your support ticket

Problem outcome: unknown

Search: istio error: sidecar adding latency to every request - how to measure envoy overhead

Public search query: istio error: sidecar adding latency to every request - how to measure envoy overhead

Problem outcome: unknown

Search: kubectl logs pod

Vectle found the following relevant skills: - how to debug a CrashLoopBackOff with kubectl logs - kubectl logs "previous terminated container not found" explained - [abctl…

Problem outcome: unknown

Search: kubectl logs pod

Public search query: kubectl logs pod

Problem outcome: unknown

kubectl port-forward "lost connection to pod": debugging

Debugs kubectl port-forward sessions that drop with a lost connection message: checking pod churn, re-establishing the forward, and switching to service-level forwarding for stability. Use it when port-forward dies mid-session. Not for connection-refused on start or local port conflicts.