Troubleshooting
Something is broken
The rest of this site is organised by subject, which is the wrong shape when something is actually failing. These pages start from the error you are looking at.
Each page names every cause it knows about and gives you a command that confirms or rules out each one. Nothing here can see your cluster, so nothing here is presented as a certainty — you check, and the page tells you what to look for.
Terraform
- Error acquiring the state lockSomething holds the Terraform state lock, usually a run that was killed before it could release it. But it may be a run that is still very much alive, and
force-unlockon that one can corrupt your state. The whole question is which.4 causes · 3 diagnostic steps - Terraform wants to change something nobody changedA plan proposes changes to resources you did not touch: reality moved out from under the state, or the provider reports a difference that is not real. Reality moves when, for example, somebody changes something in a console. The two look identical in a plan and need opposite responses.5 causes · 3 diagnostic steps
- Error: Invalid for_each argumentTerraform names every for_each instance by its key, so it needs those keys before it changes anything. When a key comes from something that does not exist yet, a function such as
uuid()ortimestamp(), or a secret, it refuses. The durable fix is in the error message itself: keep the keys in your configuration and let only the values wait for apply.3 causes · 3 diagnostic steps - Error: Saved plan is staleA saved plan records the state it was worked out against, and Terraform refuses to apply it once that state has changed. Anything that writes the state in between counts — another apply, a retried job, even
terraform state rmon a resource the plan never touches — because the plan's changes were calculated for a state that no longer exists. There is no flag to force it, and you should not want one: plan again.3 causes · 2 diagnostic steps - Error: Inconsistent dependency lock file
.terraform.lock.hclrecords exactly which version of each provider the configuration uses. When the configuration asks for a provider the lock file does not have, or for a version range the locked version is outside of, Terraform stops rather than quietly choose. The fix depends on which: a new provider needs a plainterraform init; a changed version constraint needsterraform init -upgrade, which upgrades every provider, not just the one you changed.3 causes · 3 diagnostic steps - Missing Resource Identity After ReadA provider release added or changed resource identity, and it reads your existing resources wrongly: no identity at all, or one that differs from state. It is a provider bug, usually fixed in the next release. Upgrade the provider; if the newest release still fails, pin the last version that worked.2 causes · 2 diagnostic steps
- Provider produced inconsistent result after applyAfter apply the provider returned a different value than it planned, usually because the API rewrote what you sent: its case, order or JSON formatting. On create, Terraform keeps the object but marks it tainted, so the next apply would replace it. Match the value the error shows, upgrade the provider, then untaint.3 causes · 3 diagnostic steps
- Error: Invalid count argumentTerraform must know how many instances count makes before it plans, but your count comes from a value that only exists after apply, such as an ID. Derive count from values in your configuration instead, or apply the dependency first with -target as a one-off.2 causes · 2 diagnostic steps
- Error: Backend configuration changedThe backend settings in your configuration no longer match what this working directory was set up with, so Terraform wants init again. Use -migrate-state to move existing state to the new settings; -reconfigure ignores it, so the next plan would recreate everything.3 causes · 2 diagnostic steps
- Error: Reference to undeclared resourceTerraform found a reference to a resource that does not exist in the module where the reference is written. Usually a typo, a resource that lives in another module, or a data source referenced without the "data." prefix.4 causes · 1 diagnostic steps
- Error: Duplicate resource configurationTwo resource blocks in the same module have the same type and name, so Terraform cannot tell which one you mean. Usually the same block was pasted into two .tf files, or a copied file such as "main copy.tf" is still in the directory. Delete the extra copy, or rename one block; if it is already applied, add a moved block when you rename it, or Terraform destroys and recreates it.3 causes · 1 diagnostic steps
- Error: Unsupported argumentTerraform does not accept a name you used inside a block: the resource, data source or module has no argument or nested block with that name. Usually a typo, an argument written as a block or the reverse, a module input the module does not declare, or a provider version that does not have it.3 causes · 1 diagnostic steps
- Error: Variables not allowedTerraform found var. (or a local or data value) in a place that is read before variables exist: a backend block, a variable's default, or a module's source. For a backend, pass the values to terraform init with -backend-config or a .tfbackend file. For a variable's default, use a local instead; a module's source must be written out in full.3 causes · 1 diagnostic steps
- Error: No value for required variableA variable in the configuration you are running (the root module) has no default and no value reached it. Terraform could not ask for one, because input is off, as in CI. Usually the .tfvars file was not passed, or the TF_VAR_ environment variable is named differently from the variable.3 causes · 1 diagnostic steps
- Error: Missing required argumentA resource, data source or module block leaves out an argument that it must have. Usually it was never set, it is misspelt (look for an Unsupported argument error beside it), or a module variable without a default was not passed.4 causes · 1 diagnostic steps
- Error: Unsupported attributeA reference asks for an attribute that the value it points at does not have. Usually a module output that was never declared, a misspelt attribute, a field read from a whole list instead of one element, or an output missing from remote state.4 causes · 1 diagnostic steps
- Error: Invalid value for input variableA value given to a Terraform variable does not match the variable's type, or fails one of its validation rules. The message says which variable, where the value came from, and what was expected.3 causes · 1 diagnostic steps
- Error: Reference to undeclared input variableThe configuration reads var.NAME, but the module it is in has no variable block with that name. Usually a typo, or a child module using a variable only the root module declares.4 causes · 1 diagnostic steps
- Error: Invalid indexAn expression asked for list item N, a map key, or resource [0], and that element does not exist. Usually a list shorter than expected, a missing map key, or a resource whose count is 0.3 causes · 1 diagnostic steps
- Error: CycleTwo or more things in the configuration each need the other to exist first, so Terraform cannot order them. The error lists every object in the loop; break one link in it.3 causes · 1 diagnostic steps
- Error: Module not installedTerraform found a module block it has not downloaded or linked yet, or one whose source changed since terraform init last ran. Run terraform init again in that directory.2 causes · 1 diagnostic steps
HTTP
- 502 Bad GatewayThe proxy could not get a usable response from the upstream server behind it, and is reporting a fact about somebody else. The answer is usually in whether the upstream was reachable, alive and speaking HTTP, though some causes below are proxy settings, such as a wrong upstream address or a header buffer that is too small.6 causes · 3 diagnostic steps
- 504 Gateway TimeoutThe proxy gave up waiting: usually for a response from a reachable upstream, occasionally for the connection itself. Unlike a 502, nothing failed — the proxy gave up waiting, which means the answer is either a slow upstream or a timeout set below how long the work honestly takes.5 causes · 3 diagnostic steps
Docker
- Container exits immediatelyThe container starts, the process finishes, and Docker stops the container — because a container lives exactly as long as its main process. The exit code tells you which of two quite different situations you are in.5 causes · 3 diagnostic steps
- Bind for 0.0.0.0:PORT failed: port is already allocatedSomething already holds the host port you asked Docker to publish, so the new container cannot bind it. Usually another running container, and sometimes a process on the host that has nothing to do with Docker.3 causes · 3 diagnostic steps
- Connection refused between containersAlmost always one of three:
localhostused instead of the other container's name, no shared network, or the app listening only on its own loopback. Each has a one-line check below.6 causes · 3 diagnostic steps - no space left on deviceDocker has filled the filesystem, and almost always with things nothing is using: build cache, dangling images, stopped containers and orphaned volumes. Deleting containers does not reclaim their volumes, which is why the space does not come back.5 causes · 3 diagnostic steps
- permission denied while trying to connect to the Docker daemon socketYour user cannot open the Docker daemon's socket, /var/run/docker.sock, which only root and members of the docker group can use. Add yourself to the group and start a new login session, or use rootless Docker. Never chmod the socket to 666: anyone who can use the socket can get root on the host.4 causes · 4 diagnostic steps
- exec format errorThe kernel refused to run the container's entrypoint because the file is not something it can execute here. Usually the image was built for another CPU architecture, amd64 on an arm64 node or the reverse. A script with no #! line, or a file that is not a program at all, fails the same way. Windows line endings and glibc binaries on Alpine do not cause this error; they give no such file or directory.4 causes · 3 diagnostic steps
- blob unknown to registrySince Docker 29.7 (BuildKit 0.32), images are built with their provenance attestation stored as an OCI artifact that points at the image manifest. Some registries, GitLab's among them, refuse that attestation when the image manifest is new in the same push and answer blob unknown to registry. Rebuild with
BUILDX_NO_DEFAULT_OCI_ARTIFACT=1(Buildx 0.36.1 or later), then push again.2 causes · 2 diagnostic steps - net/http: timeout awaiting response headersDocker 29.7+ and containerd 2.3+ give a registry 30 seconds to start answering, so pushing or pulling a large layer from a slow registry fails. Registries that finish storing or scanning a layer before they answer (Nexus, Harbor and similar) take longer for multi-gigabyte layers. The limit is not configurable yet: push from the classic image store, or make the registry answer faster.2 causes · 2 diagnostic steps
- exec /entrypoint.sh: no such file or directoryThe entrypoint exists, but the program that runs it does not: a Windows line ending in its first line, bash missing from the image, or a glibc binary on Alpine. Fix the line endings, the first line or the base image.3 causes · 2 diagnostic steps
Kubernetes
- The connection to the server localhost:8080 was refusedkubectl found no kubeconfig, so it fell back to its built-in default, http://localhost:8080, where no API server is listening. The fix is to give kubectl the cluster's kubeconfig, not to start anything on port 8080. A different host in the same message means a configured cluster is not answering.4 causes · 3 diagnostic steps
- error: You must be logged in to the server (Unauthorized)The API server was reached but rejected the credentials kubectl sent, with HTTP 401. Usually the client certificate has expired (kubeadm's last one year), a token or cloud login has expired or maps to no one, or the context uses the wrong user. Find which credential the context uses, check it, and renew or replace it.3 causes · 3 diagnostic steps
- CrashLoopBackOffA container starts, exits, and Kubernetes restarts it — repeatedly. The loop itself is not the fault; it is the symptom of whatever makes the container exit.5 causes · 3 diagnostic steps
- OOMKilled (exit code 137)The kernel killed your container because memory ran out: usually the container went over its own limit, sometimes the whole node ran short. Reason
OOMKilledis the signature, and the question is whether the limit is too low, the application is leaking, a spike hit, or the node was overcommitted.4 causes · 3 diagnostic steps - ImagePullBackOffThe kubelet cannot retrieve the container image, and is now backing off between attempts. Almost always the name, the credentials, or the network — in that order of likelihood.5 causes · 3 diagnostic steps
- Pod stuck in PendingThe pod exists in the API but no node has accepted it. Nothing is running yet, so logs are empty — the answer is always in the scheduler's own explanation.5 causes · 3 diagnostic steps
- Service has no endpointsThe Service exists and its name resolves, but nothing is behind it, so connections to it have nowhere to go. Almost always the selector, the readiness of the pods, or the port — and which one it is takes two commands to establish.5 causes · 4 diagnostic steps
- PersistentVolumeClaim stays PendingThe PersistentVolumeClaim stays Pending because it asks for storage nobody has offered yet. Either no StorageClass is provisioning, the class is waiting for a pod on purpose, or the claim asks for something no volume can satisfy — and the claim's events say which in one line.4 causes · 3 diagnostic steps
- Pod stuck in TerminatingDeletion of the pod was accepted but not completed, so it shows Terminating and stays there. The pod carries a deletionTimestamp and is waiting on something — a grace period that has not expired, a process ignoring SIGTERM, a finalizer nobody is clearing, or a node that stopped answering. Force-deleting ends the symptom without ending the cause, and the docs are explicit that the container may keep running.5 causes · 4 diagnostic steps
- DNS lookup fails inside a podA pod cannot turn a name into an address, so connections by Service or host name fail. The cluster's DNS has a short, fixed chain — CoreDNS pods, the kube-dns Service, its endpoints, and the pod's own resolv.conf — and each link has a one-line check. Most failures are one namespace assumption or one unready pod, not a broken network.7 causes · 5 diagnostic steps
- Pod EvictedThe kubelet stopped the pod to protect its node, or because the pod went over its own ephemeral-storage limit. The pod is left behind with phase Failed, reason Evicted, and a message that names the resource. Read that message first: memory, node disk and the pod's own limit each have a different fix.5 causes · 4 diagnostic steps
- CreateContainerConfigErrorThe kubelet could not assemble the container's configuration, so it never created the container. Usually a ConfigMap or Secret the container's environment refers to does not exist in the pod's namespace, or lacks the key named. runAsNonRoot checks and bad subPath mounts fail the same way. The real error is in the pod's events, not in kubectl describe's State section.4 causes · 3 diagnostic steps
- Readiness probe failedThe kubelet's readiness check on a container failed, so the pod is marked not ready and Services stop sending it traffic. The container is not restarted. The event's text after Readiness probe failed: says how it failed: a status code, connection refused, or a timeout. Each points somewhere different, and the commonest causes are an app listening only on localhost, the wrong port or path, and a 1-second timeout.6 causes · 4 diagnostic steps
- kubelet is configured to not run on a host using cgroup v1From Kubernetes 1.35 the kubelet refuses to start on a node that still uses cgroup v1, because its failCgroupV1 setting now defaults to true. The lasting fix is moving the node to cgroup v2. To buy time, set failCgroupV1: false; with kubeadm, also add it to the kubelet-config ConfigMap before upgrading and skip the SystemVerification preflight check.2 causes · 3 diagnostic steps
- static pods may not referenceFrom Kubernetes 1.34 the kubelet refuses a static Pod that refers to an API object: a ConfigMap, Secret, ServiceAccount or PersistentVolumeClaim. Kubernetes 1.37 removed the feature gate that allowed opting out. If the refused manifest is a control-plane component, that component does not come back after the kubelet upgrade. Put the data the Pod needs on the node and mount it with hostPath, or run the workload as a normal Pod.2 causes · 3 diagnostic steps
- failed calling webhookThe API server could not reach an admission webhook that has to approve your request, so it rejected the request. The text after failed to call webhook says why: no pods behind the service, a timeout, or a certificate. Fix that webhook, or remove its configuration if the software is gone.4 causes · 2 diagnostic steps
- no matches for kind in versionThe cluster does not serve that kind in that apiVersion: the version was removed in a Kubernetes upgrade, or the kind's CRD is not installed. Change the manifest to the served apiVersion, or install the CRD before the resources that use it.2 causes · 2 diagnostic steps
GitHub Actions
- Not authorized to perform sts:AssumeRoleWithWebIdentityGitHub issued a valid OIDC token and AWS refused to exchange it for the role's temporary credentials. Almost never a permissions problem — the role's trust policy is comparing the token's sub claim against a string that does not match it.5 causes · 4 diagnostic steps
- Runner version is deprecated and cannot receive messagesGitHub stops sending jobs to a self-hosted runner that is too far behind the newest runner release, and GitHub Enterprise Cloud enforces this since 29 Sep 2026. A runner must be updated within 30 days of each release, and at once for critical security fixes. The runner prints this line and exits. The fix is to run a current runner version (v2.338.0 on 21 Oct 2026), usually by letting it update itself or by bumping the version baked into your image.3 causes · 3 diagnostic steps
Sigstore / cosign
GitHub
- push declined due to repository rule violationsGitHub found something that looks like a credential in the commits you are pushing and refused the push. Deleting the line and committing again does not clear it — the secret is still in the history being sent.4 causes · 3 diagnostic steps
- remote: Support for password authentication was removedGitHub stopped accepting account passwords for Git over HTTPS on 13 August 2021, so use a personal access token, gh auth login or SSH instead. If Git does not even ask, a saved old password is being sent: remove it with git credential reject.3 causes · 2 diagnostic steps
CI/CD
- Passes locally, fails in CIThe same commit behaves differently on two machines, so something about those machines differs. The list of candidates is short, and each one can be confirmed rather than guessed at.7 causes · 4 diagnostic steps
- The vulnerability scan blocked the buildA scanner found something and stopped the pipeline, and the question is not how to make it pass. It is whether this finding is reachable, exploitable and fixable, and those are three separate checks.6 causes · 4 diagnostic steps
MLOps
TLS
- x509: certificate signed by unknown authorityYour client does not trust the server's certificate: Go says signed by unknown authority, curl and OpenSSL say unable to get local issuer certificate. Three different situations produce nearly identical wording — a private CA it has never heard of, a server sending an incomplete chain, or a proxy substituting its own certificate — and
openssl s_clienttells them apart in one command.5 causes · 3 diagnostic steps - SSL routines::wrong version numberYour client started a TLS (https) handshake, and the server answered in plain text. Almost always https:// on a port that speaks plain HTTP, implicit TLS on a mail port that expects STARTTLS, or a proxy URL written https:// for a plain proxy.3 causes · 2 diagnostic steps
Linux
- Too many open filesA process asked for one more file descriptor than it is allowed to have. Sockets cost descriptors too, so this usually arrives disguised as a network fault. Two different errors share almost the same wording, and which one you have decides whether you edit a service unit or a sysctl.5 causes · 4 diagnostic steps
- /bin/bash^M: bad interpreter: No such file or directoryThe kernel could not find the program named on the script's first line. The ^M in the message means the file has Windows line endings, so the interpreter's name ends in an invisible carriage return; otherwise the path itself is wrong. If you see ^M, strip the carriage returns (the sed command below); otherwise correct the path on the first line.2 causes · 1 diagnostic steps
- Text file busySomething tried to write into a program file while that program is running, and Linux refuses to change a running executable in place. Usually a deploy that copies a new binary over the old one while the service is still up.2 causes · 1 diagnostic steps
- Argument list too longA shell glob such as rm *.log expanded to more file names than the system lets one command receive. The command never started; split the work with find or xargs instead.2 causes · 1 diagnostic steps
- /usr/bin/env: 'python': No such file or directoryA script's first line asks for python, and this system only has python3. Current Ubuntu and Debian do not install a python command. Point the script at python3, or install the package that adds the alias.2 causes · 1 diagnostic steps
Prometheus
Git
- Push rejected as non-fast-forwardThe remote branch has commits yours is not built on, so accepting your push would drop them. Git refuses by default. The fix is almost never --force — it is to incorporate what is already there, and where history genuinely was rewritten, --force-with-lease --force-if-includes refuses to overwrite work that arrived while you were not looking.3 causes · 4 diagnostic steps
- fatal: refusing to merge unrelated historiesThe two branches share no commit at all, so Git cannot tell what changed on each side and refuses rather than guess. Usually a repository was created on the host with a README while the project was started locally; sometimes a shallow clone simply cannot see the shared history. Rebase onto the remote, or fetch the missing history. --allow-unrelated-histories is for the rare deliberate merge of two separate projects.4 causes · 4 diagnostic steps
- fatal: detected dubious ownership in repositoryGit refuses to work in a repository owned by another user, because that user's config could run commands as you. Common in containers, CI and shared drives. Fix the ownership, or mark that one path safe in your global config; a setting inside the repository is ignored.3 causes · 2 diagnostic steps
- fatal: Need to specify how to reconcile divergent branchesYour branch and the remote both have commits the other lacks, and since Git 2.33.1 git pull will not choose between merging and rebasing for you. Pick one for this pull with --rebase or --no-rebase, or set pull.rebase once.2 causes · 2 diagnostic steps
- error: src refspec main does not match anyGit has no local branch called main to push: there are no commits yet, the branch is called master, or CI checked out a single commit. Push the branch you have, rename it, or push HEAD:main.3 causes · 2 diagnostic steps
- error: remote origin already existsThe repository already has a remote called origin, often because you cloned it or ran the setup steps twice, so git remote add origin refuses. Change its URL with git remote set-url origin URL, or add the new remote under another name.2 causes · 1 diagnostic steps
- error: Your local changes to the following files would be overwritten by mergegit pull stopped because you have uncommitted edits to files the incoming commits also change, and merging would overwrite them. Commit them, stash them around the pull, or discard them if you do not need them.2 causes · 2 diagnostic steps
- error: pathspec did not match any file(s) known to gitgit checkout did not find a local branch, tag or file with that name, so it treated the name as a file path and matched nothing. Usually the branch exists only on the remote and has not been fetched yet, or the name is misspelled; git fetch, then check it out again.2 causes · 2 diagnostic steps
- fatal: The current branch has no upstream branchThe branch you are pushing was created locally and is not yet linked to a branch on the remote, so a plain git push does not know where to send it. Push it once with git push -u origin BRANCH, or set push.autoSetupRemote.2 causes · 1 diagnostic steps
- *** Please tell me who you areGit needs a name and email for every commit and none is configured for this user, which is normal in fresh containers and CI runners. Set user.name and user.email with git config, either for every repository on this machine (--global) or for this repository only, and commit again.2 causes · 1 diagnostic steps
- fatal: not a git repositoryGit looked in this directory and every parent for a .git and found none, so the command has no repository to work on. Usually you are in the wrong directory, or the files were copied without .git, as in many Docker builds and downloaded archives.5 causes · 1 diagnostic steps
- error: cannot lock refGit could not update a branch or remote-tracking ref, so the fetch, pull or commit stopped part-way. Usually a remote branch such as feature was replaced by one such as feature/x, two remote branches differ only in letter case on a Mac or Windows disk, or a crashed Git left a .lock file.4 causes · 1 diagnostic steps
- fatal: Unable to create '.git/index.lock': File existsGit found .git/index.lock, the file it uses to stop two commands changing the staging area at once, so it refused to start. Either another Git command really is running, or one crashed and left the lock behind.3 causes · 1 diagnostic steps
- fatal: could not read Username for 'https://github.com': terminal prompts disabledGit needed a username and password for an https:// repository, had none stored, and was not allowed to ask. Usually a CI job with no credentials for that repository, a private or misspelt repository URL, or a script running without a terminal.3 causes · 1 diagnostic steps
- warning: LF will be replaced by CRLF the next time Git touches itA warning, not an error: Git is set to convert line endings, and this file will get different ones in your working folder at its next checkout. Your commit still worked.3 causes · 2 diagnostic steps
- error: cannot rebase: You have unstaged changesgit rebase or git pull --rebase found uncommitted changes to tracked files and stopped before changing anything. Commit them, stash them, or rebase with --autostash.3 causes · 2 diagnostic steps
- error: The following untracked working tree files would be overwritten by checkoutA file you have locally but never committed exists, tracked, in the branch or commits you are switching to or pulling. Git stops rather than replace it, even when the contents are identical.2 causes · 2 diagnostic steps
- Git tag already exists (rejected, would clobber existing tag)A tag with that name already points at a different commit, and Git does not move tags unless you force it. Creating, pushing and fetching a moved tag all stop with a variant of this error.3 causes · 1 diagnostic steps
PostgreSQL
systemd
SSH
- Permission denied (publickey)The server tried every key your client offered and accepted none, and that one line covers several unrelated problems. The key is not in authorized_keys, the wrong user, file permissions sshd refuses to trust, a private key ssh refused to read, or the right key never offered at all — and the client cannot tell them apart.
ssh -von your side and the server's auth log on the other can.5 causes · 3 diagnostic steps - Host key verification failedSSH could not match the server's host key against your known_hosts file, so it stopped before sending anything. Either the key changed, which can be a rebuilt server or someone intercepting the connection, or the host is not in known_hosts and nothing could ask you, as in CI. Verify the new fingerprint against a source you trust before trusting it.3 causes · 4 diagnostic steps
npm
- npm error ERESOLVE unable to resolve dependency treenpm could not build a dependency tree that satisfies every package's peerDependencies, so it stopped. The error names the package already in your tree and the package whose peer range excludes it. --force and --legacy-peer-deps make the error go away by installing the very combination the peer range forbids; the fix is to choose versions that agree.4 causes · 4 diagnostic steps
- npm error code EACCES: permission denied, mkdirnpm tried to create a folder your account is not allowed to write to, usually the shared folder for global packages or a cache left owned by root. The fix is to install where you own the files, not to run npm with sudo.3 causes · 2 diagnostic steps
nginx
- 413 Request Entity Too LargeSomething between the client and your application refused the request because its body was larger than that layer allows. On nginx the limit is client_max_body_size, 1m unless set. In Kubernetes ingress-nginx it is the proxy-body-size annotation, also 1m by default. The application itself or a CDN in front can send the same status, and the response body tells you which.4 causes · 3 diagnostic steps
- SSL_CTX_use_PrivateKey failed: key values mismatchThe private key nginx loaded does not belong to the certificate it loaded first. Usually the wrong key file, a key from before a renewal, or a chain file with the certificates in the wrong order.2 causes · 2 diagnostic steps
Docker Compose
Ubuntu 26.04
Terraform AWS provider
Python (pip)
Docker Hub
AWS CLI
Helm
- Error: Kubernetes cluster unreachableHelm could not reach a cluster: localhost:8080 in the message means it found no kubeconfig at all, any other address means nothing answered there. In Terraform it usually means the Helm provider has no cluster settings yet.4 causes · 2 diagnostic steps
- Error: YAML parse error on a Helm chart templateA Helm template rendered text that is not valid YAML, usually because of toYaml indentation or an unquoted value. The line number counts rendered lines, not template lines, so render with --debug and look there.3 causes · 2 diagnostic steps
- nil pointer evaluating interface {} in a Helm templateThe template reads a nested value such as .Values.database.host, and the parent, database, is not set. Give the parent a default, guard it with with, or make it required.2 causes · 1 diagnostic steps
AWS
- SignatureDoesNotMatchAWS recalculated your request's signature and got a different one: the secret key, a header, the URL or the clock differs from what was signed. With presigned S3 URLs it is usually a Content-Type or a URL that changed on the way.4 causes · 2 diagnostic steps
- ExpiredToken: The security token included in the request is expiredTemporary AWS credentials have a lifetime, from 15 minutes to 12 hours, and the ones being used have run out. Most often they were exported as environment variables, which never renew and override your profile. Unset them and let a profile, SSO or the role refresh credentials for you.3 causes · 2 diagnostic steps
OpenSSH
- Unable to negotiate: no matching host key type found. Their offer: ssh-rsaYour SSH client and the server share no allowed algorithm, usually because the server offers only retired ones: ssh-rsa SHA-1, old key exchange or CBC. Update or reconfigure the server; allow the old algorithm for that one host only as a stopgap.3 causes · 2 diagnostic steps
- ssh: Could not resolve hostnamessh could not turn the host name into an IP address, so it never got as far as connecting or logging in. Usually a typo, a Host alias in ~/.ssh/config pointing at the wrong HostName, a private name only your VPN or office DNS knows, or no working DNS at all. Check the name for typos first.3 causes · 2 diagnostic steps
- WARNING: UNPROTECTED PRIVATE KEY FILE!ssh refused to use your private key because other users on the machine could read it, and then fell back to other keys or failed. Make the file readable by you alone with chmod 600, and fix whatever created it with the wrong mode.4 causes · 1 diagnostic steps
- ssh: connect to host port 22: Connection refusedYour machine reached the server, and something there answered that nothing accepts connections on that port. Usually sshd is not running, you are using the wrong port, or a firewall rejects the connection.5 causes · 2 diagnostic steps
- kex_exchange_identification: Connection closed by remote hostThe TCP connection opened, but the server closed or reset it before the two sides even exchanged SSH greetings. Usually sshd is refusing new connections for a while (too many waiting logins, or a penalty on your address), a firewall cut it, or the port is not running SSH at all.4 causes · 1 diagnostic steps
- ssh: connect to host port 22: Connection timed outYour packets left, but nothing came back: no answer, not even a refusal. Usually a firewall or cloud security rule silently drops them, the address is wrong or private, or the server is off or has no route back to you.4 causes · 2 diagnostic steps
YAML
- yaml: mapping values are not allowed in this contextThe parser met a colon followed by a space where a new key cannot start. Usually a value that itself contains ": " and is not quoted, two keys on one line, or a line indented further than the keys beside it.3 causes · 1 diagnostic steps
- yaml: did not find expected keyA line inside a block is indented differently from the keys around it, so the parser cannot place it. The line number usually points at the line before the real mistake, which is why the error is hard to see.3 causes · 1 diagnostic steps
- yaml: found character that cannot start any tokenThe parser met a character YAML does not allow there: almost always a tab used for indentation, or an unquoted value starting with @ or a backtick.2 causes · 1 diagnostic steps
Node.js
- JavaScript heap out of memoryNode.js ran out of room in its own memory heap and stopped the process: the job needed more than V8's heap limit allows. Usually a build or test run that is simply big, a leak in a long-running process, or a limit set lower than the work needs.4 causes · 2 diagnostic steps
- SyntaxError: Cannot use import statement outside a moduleNode.js loaded your file as a CommonJS script, where import statements are not allowed. Usually the package is not marked as an ES module, the Node.js version is older than automatic detection, or a tool runs the file as CommonJS.3 causes · 1 diagnostic steps
- Error [ERR_REQUIRE_ESM]: require() of ES Module not supportedCommonJS code called require() on a package or file that is an ES module, and this Node.js version cannot load ES modules that way. Newer Node.js can, except for modules that use top-level await.3 causes · 1 diagnostic steps
Make
Linux and macOS
Bash
- syntax error: unexpected end of fileBash reached the end of your script while a block it was reading was still open, so it gave up. Usually an if without its fi, a loop without done, a function without its closing brace, or a quote that never closes; the line it reports is the end of the file, not the mistake.4 causes · 2 diagnostic steps
- unbound variableThe script runs with set -u (often as set -euo pipefail) and read a variable or argument that was never set, so bash stopped. Set it, give it a default, or fail with a clear message.3 causes · 1 diagnostic steps
- [: too many argumentsA [ ] test received a different number of words than it expects, almost always because a variable was not quoted and was empty or contained spaces. The test fails, and the script carries on down the wrong branch.2 causes · 1 diagnostic steps
- syntax error near unexpected tokenBash could not parse the script, so none of it ran, and the token it names is where parsing broke. A token of $'\r' means Windows line endings, ( means unquoted parentheses, and fi or done means a malformed block.4 causes · 1 diagnostic steps
sed
jq
Linux shell
- Bad substitutionA bash-only expansion such as ${VAR^^}, ${VAR:0:3} or an array ran under /bin/sh, which on Debian and Ubuntu is dash. Run it with bash, or use a POSIX form.3 causes · 1 diagnostic steps
- set: Illegal option -o pipefailA script written for bash ran under /bin/sh, which on Debian and Ubuntu is dash. That shell rejects pipefail, source, [[ ]], arrays and the function keyword, and two of those fail silently.2 causes · 1 diagnostic steps
curl
- curl: (6) Could not resolve hostcurl could not turn the host name into an IP address, so it never connected. Either the name is wrong, or DNS is not working from where curl runs, such as inside a container or a CI job.3 causes · 1 diagnostic steps
- curl: (7) Failed to connectcurl found the host's address but nothing accepted the connection on that port. Usually the service is not running yet, listens on another port or address, or a firewall refuses it.3 causes · 1 diagnostic steps
- curl: (28) Operation timed outcurl gave up waiting, and the wording of the message says where it was stuck. Failed to connect … Timeout was reached means the connection never opened; Operation timed out … bytes received means it opened but the response was too slow.2 causes · 1 diagnostic steps
- curl: (22) The requested URL returned errorThe server answered with an HTTP error (400 or above) and curl was run with -f or --fail, so it exited 22 instead of saving the error page. The number after error: is the HTTP status, and it tells you what to fix.3 causes · 1 diagnostic steps
An error you cannot find here? Ask it — the catalogue grows from what people actually hit.