FAQ
Answers to the questions that come up most often. Each answer is short and points to the canonical page for the full explanation. If you are looking for a specific error message, the Troubleshooting index is a better starting point.
kubelogin and identity
Section titled “kubelogin and identity”Why does kubectl say “Unauthorized” even though I just logged in?
Section titled “Why does kubectl say “Unauthorized” even though I just logged in?”Your cached OIDC token may be stale or your Cloud RAP group claim may not match. Clear the cache and retry:
kubectl oidc-login cleankubectl get nsIf it still fails, see the kubelogin troubleshooting section for the full diagnosis flow.
Why does kubectl get ns return zero namespaces after a successful login?
Section titled “Why does kubectl get ns return zero namespaces after a successful login?”Run kubectl auth whoami and check the Groups row. If it contains your oidc:<your-tenant> group, login is working — an empty kubectl get ns is normal on a fresh tenant, because Kestrel does not pre-create any namespaces for you. Create one and carry on: see Namespaces and Your first deployment.
If the Groups row shows only system:authenticated, your OIDC token was accepted but its groups claim does not contain a tenant group that maps to a Capsule Tenant. The most common cause is that you have not been added to the tenant’s Keycloak group yet — membership is currently managed by RCS staff, and sponsorship in CCDB alone does not grant access. Ask your PI to confirm the add-user request to RCS was made and completed. See Managing membership and Requesting access for the full flow.
Which kubelogin do I need — the int128 one or the Microsoft one?
Section titled “Which kubelogin do I need — the int128 one or the Microsoft one?”Kestrel uses the int128/kubelogin OIDC plugin, not the Microsoft Azure AD tool of the same name. If your package manager offers both, pick the int128 build. See Install kubelogin for per-OS instructions.
How do I log in from WSL2 or an SSH session with no browser?
Section titled “How do I log in from WSL2 or an SSH session with no browser?”Add --skip-open-browser to your kubeconfig exec.args, copy the printed URL to a local browser, and forward the callback port if the shell is remote. Full steps are in kubelogin troubleshooting — browser does not open.
ArgoCD and deployments
Section titled “ArgoCD and deployments”Why is my ArgoCD Application stuck in OutOfSync or Degraded?
Section titled “Why is my ArgoCD Application stuck in OutOfSync or Degraded?”Click into the Application in the ArgoCD UI, open the failing resource, and read the sync message. The most common failures are YAML validation errors, Kyverno Pod Security rejections, namespace prefix violations, and priority class not in the allowlist. The Triage page has the quick-check flow.
How do I add a new application to my ArgoCD repo?
Section titled “How do I add a new application to my ArgoCD repo?”It depends on whether an Application already watches the manifests. Adding resources under the path of an already-registered Application is just a push — ArgoCD picks them up on its next Git poll (roughly every 3 minutes). A genuinely new workload or directory needs its own Application registered first, through the ArgoCD UI (New App) — commit the matching canonical Application YAML to your repo as the record. See ArgoCD on Kestrel for the full pattern and User brings a repo for bringing your own Helm chart or Kustomize overlay.
Why does ArgoCD reject my Pod with a security policy error?
Section titled “Why does ArgoCD reject my Pod with a security policy error?”Kestrel enforces the Kubernetes Pod Security Standards at the restricted level via Kyverno. Every container’s securityContext must include runAsNonRoot: true, seccompProfile.type: RuntimeDefault, capabilities.drop: [ALL], and allowPrivilegeEscalation: false. See Known limitations — Pod Security restricted for the full checklist.
Ingress and networking
Section titled “Ingress and networking”Why does my Ingress return 404 even though the Pod is running?
Section titled “Why does my Ingress return 404 even though the Pod is running?”The three most common causes are a missing spec.ingressClassName: traefik field, a Service selector that does not match Pod labels, or a cert-manager certificate that has not issued yet. Run kubectl describe ingress and kubectl get certificate to check. See Ingress on Kestrel for the full recipe and Triage — Ingress 404 for the quick-check flow.
Can I use a LoadBalancer Service on Kestrel?
Section titled “Can I use a LoadBalancer Service on Kestrel?”No. Capsule restricts Service types to ClusterIP only — NodePort, LoadBalancer, and ExternalName are all blocked. Use an Ingress with Traefik instead. See Service types for the rationale and Known limitations — LoadBalancer blocked for context.
How does TLS work on Kestrel?
Section titled “How does TLS work on Kestrel?”cert-manager automatically provisions Let’s Encrypt certificates for Ingress resources that specify a tls block with a secretName. This assumes the hostname’s DNS record already exists — DNS records for tenant hostnames are currently created manually, so open a ticket with RCS asking for the record first; without it the certificate stays READY: False. Once the hostname resolves, the first certificate issue takes about 30 seconds. See TLS on Kestrel for the full flow.
Storage and quotas
Section titled “Storage and quotas”Why is my PVC stuck in Pending?
Section titled “Why is my PVC stuck in Pending?”Check kubectl describe pvc for the event message. Common causes: the requested storage class does not exist, the quota is exhausted, or you requested ReadWriteMany (RWX) on a Cinder storage class. Kestrel provides two OpenStack Cinder storage classes: csi-cinder-sc-delete (the default; reclaim policy Delete) and csi-cinder-sc-retain (reclaim policy Retain). Both are block volumes and support ReadWriteOnce only. ReadWriteMany (shared) volumes are not offered through a storage class — open a ticket with RCS to have a per-tenant NFS volume provisioned. See Storage classes and Persistent volumes.
Why does my Pod fail to schedule with “Insufficient cpu” or “Insufficient memory”?
Section titled “Why does my Pod fail to schedule with “Insufficient cpu” or “Insufficient memory”?”Your tenant’s ResourcePool quota is exhausted. Run kubectl describe resourcepool (it is cluster-scoped — the -n flag is ignored) to see current usage versus allocation; for per-namespace usage run kubectl describe resourcequota -n <namespace>. Common culprits are completed Jobs that still hold resources, orphaned PVCs, and overprovisioned requests. See Viewing your allocation and Triage — Storage or quota surprise.
How do I request a larger quota?
Section titled “How do I request a larger quota?”Open a ticket with RCS requesting a tier change. Include your tenant name, current tier, requested tier, and rationale. See Requesting quota changes for the full process and SLO expectations.
What is the difference between the four quota tiers?
Section titled “What is the difference between the four quota tiers?”Kestrel has three preset tiers of increasing size (sandbox, standard, premium) plus a custom tier with individually negotiated CPU, memory, and storage limits. See Resource pools and quotas — tier numbers for the exact numbers and Requesting quota changes for how to move between tiers.