Troubleshooting

Don't panic!

Deployment status

Description

success

Everything is fine, your application has been deployed, and is up and running.

queued

Deployment request accepted, waiting to be deployed.

in_progress

Application deployed to Kubernetes, waiting for new version to start.

failure

Your application failed to start. Check state with kubectl describe app <APP>.

error

Either an error in your request, or the deployment system has issues. Check the logs.

First debugging steps

When something is wrong with your application, these kubectl tools should be the first things you check out:

Describe the pod to find statuses and messages:

kubectl describe pod <podname>

And view the logs for your pods with this command:

kubectl logs <podname>

Logs

All deployments are logged to Kibana. You can get a direct link to your deployment logs from the https://github.com/navikt/<YOUR_REPOSITORY>/deployments page. Click on the link that says deployed.

This link is also printed in the console output. It looks like https://deployment.prod-sbs.nais.io/logs?delivery_id=<UUID>&ts=<TIMESTAMP>.

FAQ

Message

Action

You don't have access to apikey/.

See Access to Vault in the Teams documentation

403 authentication failed

Either you're using the wrong team API key, or if using the old version of NAIS deploy, your team is not registered in the team portal.

502 bad gateway

There is some transient error with GitHub or Vault. Please try again later. If the problem persists, ask @nais-team for help.

deployment failed: failed authentication

Wrong team API key, please check Vault for the correct key under /apikey/nais-deploy/<TEAM>.

failed authentication: HMAC signature error

See above.

"tobac.nais.io" denied the request: user 'system:serviceaccount:default:serviceuser-FOO' has no access to team 'BAR'

The application is already deployed, and team names differ. See changing teams.

“tobac.nais.io” denied the request: team 'FOO' on existing resource does not exist

The team owning the resource may have been deleted or renamed. Ask @nais-team for help.

Asking on Slack

If you read this entire page, and checked your logs, and checked application status with kubectl, you can ask Slack for help. Use the #nais channel and include the following information:

  • Application

  • Team tag

  • Namespace

  • Cluster name

  • Link to logs

  • What steps you already took to debug the error