Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →A Kubernetes node marked NotReady can still be running containers: the status tells you what the control plane can confirm about the node, not whether every local process has stopped. To find out why users still reach an application, check the node condition, the affected Pod’s readiness, and the Service’s actual endpoints separately. Traffic may be going to another backend or through a stale or already-established network path; the cause depends on your cluster.
Why can a NotReady node still appear to serve traffic?
A node becomes NotReady when Kubernetes cannot establish that it is healthy and communicating as expected. For example, a kubelet failure or network partition can prevent heartbeats from reaching the control plane while containers continue running on the machine. The control plane may therefore lack both current status and the ability to promptly tell the kubelet to stop a workload. Kubernetes’ node documentation and its explanation of what happens after a node restart describe why control-plane knowledge and local process state are not the same thing.
As an Amazon Associate I earn from qualifying purchases.
For a standard Kubernetes Service, Pod readiness—not the node’s displayed status alone—governs whether a Pod is eligible as a backend. A Pod’s Ready condition is false when its node’s Ready condition is not true, and unready Pods are removed from Service load balancers. If the application still responds, determine whether the request reached that Pod, another ready endpoint, or a path whose configuration has not yet converged. The Kubernetes probe documentation explains how readiness affects traffic eligibility.
Trace the request before assigning a cause
Do not infer the traffic path from a successful request or from kubectl get nodes alone. Compare the Pod IP on the affected node with the ready addresses in the Service’s EndpointSlices, then establish which address and network path actually handled the request.
#1 Best Overall
- If the affected Pod IP is absent from ready endpoints, check for another backend, an external load balancer, ingress routing, or an already-established connection.
- If the affected Pod IP is still listed as ready, compare the Pod’s conditions and events with the EndpointSlice state, then investigate whether the cluster’s data plane has applied the change.
- If the request path uses a CNI, kube-proxy, eBPF data plane, ingress, or cloud load balancer, inspect the relevant component’s health and configuration. Which one matters depends on the cluster architecture.
EndpointSlice membership and the observed route are related but distinct evidence. A stale data-plane configuration or an existing connection can make observed behavior differ from the current control-plane view; the exact explanation cannot be determined without the cluster’s endpoint contents and traffic path.
Run these checks in order
- Confirm node conditions and timing. Run
kubectl get nodes, thenkubectl describe node <node>and, if needed,kubectl get node <node> -o yaml. Inspect theReadycondition, other conditions, taints, events, and the age of the latest status or lease update. These are among the node checks in the official Kubernetes cluster troubleshooting guide. - Inspect the affected Pod independently. Run
kubectl get pods -A -o wide, thenkubectl describe pod <pod> -n <namespace>. Check its assigned node,status.conditions, container state, and events. A running container does not establish that Kubernetes currently considers its Pod ready or can still communicate with it. - Check Service backend membership. Run
kubectl get endpointslices -n <namespace> -l kubernetes.io/service-name=<service> -o yaml. Compare the affected Pod IP with endpoint addresses and their readiness conditions. Use the legacy Endpoints resource only if that is what your Kubernetes version or setup exposes. - Read taints alongside tolerations. Determine whether the node has
node.kubernetes.io/not-readyornode.kubernetes.io/unreachable, and inspect the Pod or its controller for matching tolerations andtolerationSeconds. - Review events and the network path. Run
kubectl get events -A --sort-by=.lastTimestamp, then check the relevant controllers and data-plane components, ingress, and cloud load balancer for the affected route. Events and endpoint state may help establish when Kubernetes changed its view; verify the actual traffic path in your environment.
Useful commands together:
kubectl get nodeskubectl describe node <node>kubectl get node <node> -o yamlkubectl get pods -A -o widekubectl describe pod <pod> -n <namespace>kubectl get endpointslices -n <namespace> -l kubernetes.io/service-name=<service> -o yamlkubectl get events -A --sort-by=.lastTimestamp
Use commands permitted by your cluster’s access controls and adapt resource names to your Kubernetes version.
What taints and eviction timing do—and do not—tell you
Kubernetes associates node.kubernetes.io/not-ready with Ready=False and node.kubernetes.io/unreachable with Ready=Unknown. Both have NoExecute behavior by default, which can lead to eviction of Pods that do not tolerate the taint. In the usual case, Pods receive automatically added 300-second tolerations for these taints. This is a default toleration value, not a guaranteed deadline by which a Pod will be deleted or traffic will stop. Explicit Pod or controller settings can change tolerations, and DaemonSet Pods receive indefinite tolerations for these taints. See the Kubernetes taints and tolerations documentation.
Eviction can also be rate-limited. If the control plane cannot communicate with the kubelet, it may not be able to make the node delete Pods until communication returns. A single-node fault, a broader partition, custom tolerations, and cluster eviction settings can therefore produce different timing. Do not treat a taint or the 300-second default as proof that a workload has stopped locally or ceased to receive every request.
Rank #3
Compare the evidence, not just the node label
| Evidence | What to compare | What it establishes |
|---|---|---|
| Node condition | Ready=False versus Ready=Unknown |
Whether Kubernetes reports the node as not ready or cannot determine its state. |
| Pod state | Local container state, Pod Ready condition, and deletion or eviction status |
Whether the container appears to run locally and whether Kubernetes considers the Pod ready. |
| Service state | Pod IP and readiness in EndpointSlices, compared with the observed request destination | Whether the Pod is a ready Service backend in the API view, and whether the observed request followed that route. |
| Eviction policy | Default or custom tolerations, tolerationSeconds, and DaemonSet behavior |
How a Pod may respond to the taint and why timing can vary. |
| Fault scope and timing | Single-node issue versus wider partition; events and eviction behavior | Whether controller or communication delays may affect convergence. |
What you can conclude—and what needs cluster evidence
NotReady alone does not prove that containers have stopped, and continued application responses alone do not prove that the affected Pod is still serving them. The node condition, Pod conditions, EndpointSlices, and observed network route answer different parts of the question. Kubernetes’ documentation describes these general behaviors, but it cannot identify the route or convergence time in a particular cluster. That requires the cluster’s Kubernetes version, Pod tolerations, Service type, EndpointSlice contents, data-plane and load-balancer configuration, and relevant events.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
