Recommended Free Tools
CrashLoopBackOff means Kubernetes is repeatedly restarting a CoreDNS container; it does not identify why. Start by checking the failing pod’s current and previous logs and its events, then use the observed error to distinguish a missing or unhealthy pod network, a DNS forwarding loop, or a startup/runtime security problem. Avoid changing resolver settings or security controls until the logs point to a specific cause.
Check the pod’s logs and events first
Capture the evidence before editing the Corefile, kubelet settings, or deployment. Identify whether the problem affects every CoreDNS replica or only one pod or node, and note whether it began during initial cluster setup or after a configuration change.
-
List CoreDNS pods and their nodes:
kubectl get pods -n kube-system -l k8s-app=kube-dns -o wide. If that label returns no pods, list the namespace withkubectl get pods -n kube-system -o wideand identify the CoreDNS pods there. -
Describe the failing pod to inspect its events, container state, and restart details:
kubectl describe pod -n kube-system <pod-name>.Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Read the current container log:
kubectl logs -n kube-system <pod-name> -c coredns. If the container has restarted, read the previous instance’s log as well:kubectl logs -n kube-system <pod-name> -c coredns --previous. -
Check the CoreDNS configuration and the cluster’s network add-on health before making changes:
kubectl get configmap coredns -n kube-system -o yamlandkubectl get pods -A -o wide. Confirm the Corefile and add-on components against the configuration actually deployed in your cluster.
Use the log message and events to choose the branch below. An upstream DNS timeout, a loop-detection message, an add-on or permission error, and a runtime startup failure are different problems and call for different remedies.
Check whether the pod network is installed and healthy
During kubeadm bootstrap, CoreDNS may still be Pending
In a kubeadm cluster, CoreDNS is expected to remain Pending until a pod network add-on is installed. Kubernetes describes this as expected behavior in its kubeadm troubleshooting guidance. A pod that is merely Pending at this stage is not evidence of a CoreDNS crash.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →If CoreDNS starts crashing after network deployment
Inspect the network add-on’s pods and events. Kubernetes notes that CoreDNS entering CrashLoopBackOff after the pod network is deployed can indicate that the add-on is broken or insufficiently configured, including an issue with required privileges. Check the add-on’s installation and configuration for your cluster before changing CoreDNS itself.
If all replicas fail at the same time, prioritize cluster-wide network or configuration changes. If only one replica or node is affected, compare that node’s add-on status and events with healthy nodes; the difference can narrow the failure to a node-specific condition.
Investigate a DNS forwarding loop
A loop is a documented cause of CoreDNS exiting and restarting. The CoreDNS loop plugin documentation says that when a CoreDNS pod detects a loop, it will start to enter CrashLoopBackOff.
Inspect forwarding targets and the resolver file
If the log reports a loop, inspect the Corefile’s forward rules. Check whether a rule forwards queries for the affected zone back toward a DNS service that ultimately routes them into CoreDNS again. Also inspect the resolver file used by CoreDNS, commonly /etc/resolv.conf, for local addresses that may send queries back into the cluster DNS path.
A frequent example is a host using systemd-resolved: its stub resolver can appear as 127.0.0.53. If that host-local address is passed through to pods, CoreDNS may forward a query to the host stub, which in turn sends it back to CoreDNS, creating a loop.
Verify kubelet’s resolver configuration before changing it
Kubernetes’ DNS debugging guide documents checking DNS configuration and kubelet’s --resolv-conf setting. In its systemd-resolved setup, the relevant resolver file is /run/systemd/resolve/resolv.conf. Verify that systemd-resolved is in use and inspect the file’s contents on the affected node before applying this configuration; do not assume the same path or remedy fits every distribution or cluster.
Check runtime and security errors when logs point there
If the logs indicate a startup, permission, or runtime failure rather than a DNS loop, check whether the affected node uses SELinux and whether its container runtime matches the scenario described in Kubernetes’ kubeadm troubleshooting guidance. That page lists older Docker with SELinux as one possible cause.
Kubernetes discusses upgrading Docker, disabling SELinux, and setting allowPrivilegeEscalation to true for the CoreDNS deployment as possible workarounds. It also warns that disabling SELinux or enabling privilege escalation can compromise cluster security. Treat those changes as security-sensitive, not routine quick fixes: first confirm the actual runtime and policy issue, assess cluster-specific safer options, and obtain a security review before relaxing a control.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use the evidence to narrow the cause
| What you observe | What to investigate |
|---|---|
| CoreDNS is Pending during kubeadm setup, before a pod network is installed | Install and configure the cluster’s pod network add-on; Pending is expected at this stage. |
| CoreDNS crashes after the network add-on is installed; add-on pods or events show errors | Check the add-on installation, configuration, and required privileges. |
| Logs explicitly report a DNS loop | Trace Corefile forwarding targets and the resolver file available to CoreDNS, including any host-local stub address. |
| Logs show startup, permission, or runtime errors, especially on a node using SELinux | Confirm the node’s SELinux policy and container runtime, then evaluate a cluster-specific remedy without casually weakening security. |
| Only one replica or node fails, or only upstream lookups fail | Compare that pod or node with healthy replicas and distinguish local startup problems from forwarding or upstream-resolution failures. |
These are diagnostic branches, not a diagnosis of an unspecified cluster. The right fix depends on the observed log, Kubernetes and CoreDNS versions, CNI, container runtime, Corefile, and host resolver configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
