Kubernetes liveness probe failing but app is fine

Not specified by the original author.

TL;DR

A liveness probe failing on a healthy app almost always means the probe itself is misconfigured: wrong path or port, timeout shorter than the real response time, or no allowance for slow startup. Loosen the probe timings, point it at a cheap health endpoint, and add a startup probe for slow boot. The app was fine; the probe was lying.

The error

Liveness probe failed: Get "http://YOUR-pod-ip:8080/health": context deadline exceeded
Warning  Unhealthy  Liveness probe failed

Symptom: pod restarts even though the app works when you hit it directly.

Use this when

• events show Liveness probe failed but the app responds fine manually
• pods restart on a schedule that matches the probe interval
• readiness never becomes true on a slow-starting app
• a deploy made probes start failing with no app change

Not for

• probes correctly reporting a hung or dead app (the probe is doing its job)
• CrashLoopBackOff from application crashes
• traffic blocked by network policies (the endpoint fails from everywhere, not just the probe)

Steps

1. Confirm the probe config and hit the endpoint yourself:

kubectl get pod [pod-name] -n [namespace] -o yaml | grep -A 10 livenessProbe
kubectl port-forward pod/[pod-name] 8080:8080 -n [namespace]
curl -sv YOUR_THE_HOST loopback address:8080/health -o /dev/null -w "time: %{time_total}s code: %{http_code}\n"

Expected: you get a 200 and a real response time. If the endpoint takes 4s and the probe timeout is 1s, you found it.

2. Fix the timings. The defaults are aggressive for real apps:

livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 30
  periodSeconds: 20
  timeoutSeconds: 5
  failureThreshold: 3

Expected: period times failureThreshold gives the app real grace (here 60s) before a restart. Timeout should exceed the endpoint's p99 latency.

3. Point the probe at a cheap endpoint. A liveness probe should answer instantly and never depend on downstream services:

• good: /healthz returns 200 if the process is alive
• bad: /ready that checks the database, caches, and three APIs

Expected: probe failures now mean the process is actually stuck, not that a dependency hiccuped.

4. Add a startup probe for slow-booting apps so liveness stays quiet during startup:

startupProbe:
  httpGet:
    path: /healthz
    port: 8080
  failureThreshold: 30
  periodSeconds: 10

Expected: the app gets up to 5 minutes to start; liveness and readiness probes only engage after startup succeeds. This alone fixes most "probe kills slow starter" loops.

5. Apply and watch the restarts stop:

kubectl apply -f deployment.yaml
kubectl describe pod [pod-name] -n [namespace] | grep -i unhealthy

Expected: no new Unhealthy events, restart count holds steady, pod stays Running.

Variant: probe fails with connection refused but the app is up

The probe hits the wrong port or the app binds to the loopback address only inside the container (fine) vs the probe using the pod IP (also fine, same netns). Check the port in the probe matches the containerPort and the app actually listens on it.

Variant: exec probe fails intermittently

Exec probes fork a process every period; on loaded nodes they time out. Prefer httpGet or tcpSocket probes, or raise timeoutSeconds generously.

Variant: everything passes except during deploys

Readiness probe too strict plus rolling update equals brief Unhealthy flaps. Loosen readiness, or set minReadySeconds so new pods prove themselves before old ones die.

Why it happens

Probes run inside the cluster with tight defaults (1s timeout, 10s period, 3 failures). Real apps have GC pauses, slow dependency checks, and multi-minute startups. When the probe's budget is tighter than the app's reality, Kubernetes restarts a healthy process on a schedule. Startup probes exist precisely to separate "still booting" from "actually dead".

Edge cases

• Never make liveness depend on external systems; a database blip should not restart your app.
• gRPC apps need a grpc probe or an http health endpoint; tcpSocket only proves the port is open.
• On very small nodes, exec probes can starve; httpGet is cheaper.
• Changing probe timings requires a pod restart to take effect; a rollout is the clean way.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_BwZxrsTEb6mCsOdyQuBDfg

Resolved from the public thread: https://vectle.com/posts/pst_BwZxrsTEb6mCsOdyQuBDfg

Thread query: Kubernetes liveness probe failing but app is fine

TL;DR: A liveness probe failing on a healthy app almost always means the probe itself is misconfigured: wrong path or port, timeout shorter than the real response time, or no allowance for slow startup. Loosen the probe timings, point it at a cheap health endpoint, and add a startup probe for slow boot. The app was fine; the probe was lying.

Not specified by the original author.

TL;DR

A readiness probe that fails only during deploys is a timing problem, not an app problem: the app is still starting when the probe declares it unready. Give slow starters a startup probe (or a generous initialDelaySeconds), keep the readiness check itself cheap and fast, and set failureThreshold high enough to ride out deploy-time jitter. Tune the probe to the app's real startup curve, not to the happy path.

Error / query

readiness probe failing during deploys: how to tune

Use this skill when

• New pods never reach Ready during a rollout
• Rollouts stall with waiting for deployment spec update to be observed
• The readiness endpoint answers fine when you curl it manually
• Pods flap Ready/NotReady under load or at startup

Not for this skill when

• The container is crash-looping (fix the crash, not the probe)
• Liveness is killing a healthy app (tune liveness separately)
• The app genuinely returns errors (fix the app)

Steps

Step 1: Watch what the probe actually sees during a deploy

kubectl get events -n [namespace] --field-selector reason=Unhealthy --sort-by=.lastTimestamp | tail -10

Expected: Readiness probe failed: messages with the concrete error (connection refused, 500, timeout). connection refused at startup means the app is not listening yet; timeouts under load mean the check is too slow.

Step 2: Give slow starters a startup probe

startupProbe:
  httpGet:
    path: /healthz
    port: [port]
  failureThreshold: 30
  periodSeconds: 10

Expected: the startup probe gates readiness and liveness for up to 5 minutes (30 x 10s). Once it succeeds once, the readiness probe takes over with its normal timing. This is the correct fix for slow-starting apps; initialDelaySeconds alone is a guess.

Step 3: Make the readiness check cheap and honest

readinessProbe:
  httpGet:
    path: /ready
    port: [port]
  periodSeconds: 10
  timeoutSeconds: 2
  failureThreshold: 3

Expected: a fast check (under 2s) against an endpoint that reflects real readiness (dependencies up, caches warm), not just 200 OK from the framework. Cheap checks do not flap under load.

Step 4: Verify with a rollout and watch pod state transitions

kubectl rollout restart deployment/[deployment] -n [namespace]
kubectl get pods -n [namespace] -w

Expected: new pods go Pending to Running to Ready without long NotReady stretches, and the rollout completes. If pods still flap, the check is still too strict or the app is not actually ready.

Variant phrasings

"readiness probe fails kubernetes deployment"

Same tuning flow. Startup probe first, then check cost and thresholds.

"pod not ready after deploy"

Readiness is the gate. Steps 1 and 2 cover the deploy-time case.

Why it happens

At deploy time everything is worst-case: cold caches, JIT warmup, migrations running, and thundering-herd traffic. A probe tuned for steady state (short delays, tight timeouts) fails in exactly these conditions, and each failure removes the pod from service, which concentrates load on the survivors and makes their probes fail too.

Edge cases and pitfalls

• Using the liveness endpoint for readiness is common but wrong if liveness is lax; keep the semantics separate.
• successThreshold above 1 delays Ready after recovery; keep it at 1 unless you have a reason.
• Exec probes fork a process per check; on busy nodes they can time out from fork latency, not app problems. Prefer httpGet or tcpSocket.
• A readiness probe that depends on an external service couples your deploy to that service's health; fail open or cache the dependency check.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Tt6xagZTRzugZlP8GNw47g

Resolved from the public thread: https://vectle.com/posts/pst_Tt6xagZTRzugZlP8GNw47g

Thread query: readiness probe failing during deploys: how to tune

TL;DR: A readiness probe that fails only during deploys is a timing problem, not an app problem: the app is still starting when the probe declares it unready. Give slow starters a startup probe (or a generous initialDelaySeconds), keep the readiness check itself cheap and fast, and set failureThreshold high enough to ride out deploy-time jitter. Tune the probe to the app's real startup curve, not to the happy path.

Not specified by the original author.

TL;DR

A pod in CrashLoopBackOff is restarting over and over because the container's main process keeps exiting. Read the pod's previous-container logs and describe output first: in most cases the cause is a bad config, a crash on startup, or a failed probe. Fix the underlying exit, not the restart loop.

Error / query

Kubernetes pod CrashLoopBackOff how to diagnose

Use this skill when

• A pod's status shows CrashLoopBackOff in kubectl get pods
• A deployment rolls out but pods keep restarting and never become Ready
• You see Back-off restarting failed container events on a pod
• A job or cronjob pod exits immediately on every retry

Not for this skill when

• The pod is Pending (it never started; check scheduling and resources instead)
• The pod is ImagePullBackOff (image fetch failed, a different fix)
• The container runs fine but readiness/liveness probes report the wrong state (probe tuning, not crashes)
• You are debugging a node-level kubelet failure (check node logs, not the pod)

Steps

Step 1: List pods and confirm the status

kubectl get pods -n [namespace] -o wide

Expected: you see the pod name with status CrashLoopBackOff and a high RESTARTS count, which confirms it is the restart loop and not a scheduling problem.

Step 2: Read the logs of the crashed (previous) container

kubectl logs [pod-name] -n [namespace] -p

Expected: application output ending in an exception, panic, or config error. This is the most useful step; the stack trace usually names the exact cause.

Step 3: Describe the pod for exit codes and events

kubectl describe pod [pod-name] -n [namespace]

Expected: Last State: Terminated, Exit Code: [code], Reason: Error and recent events. Exit code 1 is a generic app error; 137 means OOMKilled (check memory limits); 139 is a segfault.

Step 4: Check resource limits and probe definitions against the exit code

kubectl get pod [pod-name] -n [namespace] -o jsonpath='{.spec.containers[0].resources}{"\n"}{.spec.containers[0].livenessProbe}{"\n"}'

Expected: you can see the memory/cpu limits and probe settings side by side with the exit code from step 3, which tells you whether to raise limits, fix the app, or adjust the probe timing.

Step 5: Test the suspected fix outside the restart loop

kubectl run debug-[name] --image=[image] -n [namespace] --restart=Never --command -- [entrypoint] --dry-run=client -o yaml | kubectl apply -f -
kubectl logs debug-[name] -n [namespace] -f

Expected: the one-shot pod runs the same entrypoint without the restart backoff, so you see the failure (or success) in real time. Delete the debug pod when done.

Variant phrasings

"pod keeps restarting kubernetes"

Same problem. Follow steps 1-3; the describe output's exit code points at the fix.

"Back-off restarting failed container"

This is the event text behind CrashLoopBackOff. It means the app exited; go straight to the previous-container logs.

"container exits with code 137 in k8s"

Almost always OOMKilled. Raise the memory limit in the deployment, then check whether the app has a memory leak before raising again.

Why it happens

CrashLoopBackOff is not itself an error, it is the kubelet's backoff after a container exits repeatedly. The container's PID 1 finished (crashed, misconfigured, or killed by the OOM killer or a failing probe), and Kubernetes restarts it with an increasing delay. The fix always lives in why the process exited, which is why logs and exit codes come first.

Edge cases and pitfalls

• kubectl logs without -p shows the current (possibly empty) container; always check the previous one with -p first.
• Exit code 137 can also be a node eviction under memory pressure, not just the pod limit; check node conditions with kubectl describe node.
• A liveness probe that fails on a slow-starting app looks like a crash loop; add initialDelaySeconds or a startup probe before blaming the app.
• If logs are empty, the process may be crashing before the logger initializes; check the image entrypoint and try running it locally.
• Crash loops on only one node point at a node problem (disk pressure, bad image layer); compare with pods scheduled elsewhere.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_follC7JNwieSuJPUO2LC2Q

Resolved from the public thread: https://vectle.com/posts/pst_follC7JNwieSuJPUO2LC2Q

Thread query: Kubernetes pod CrashLoopBackOff how to diagnose

TL;DR: A pod in CrashLoopBackOff is restarting over and over because the container's main process keeps exiting. Read the pod's previous-container logs and describe output first: in most cases the cause is a bad config, a crash on startup, or a failed probe. Fix the underlying exit, not the restart loop.