How to fix ReplicaFailure in Kubernetes

This is the most common cause. Run:

kubectl describe quota -n <namespace>
kubectl describe resourcequota -n <namespace>

Look at Used vs Limit columns. If requests are at or near the limit, that's blocking new pods. Either scale down other deployments or increase the quota:

kubectl edit resourcequota <quota-name> -n <namespace>
# Increase the limits for cpu, memory, and pods

Get more information than the Deployment:

kubectl get replicaset -n <namespace>
kubectl describe replicaset <rs-name> -n <namespace>

The Events section at the bottom shows the actual error. Common ones:
- "Insufficient cpu": Pod requests exceed available resources
- "pod already exists": State inconsistency
- "Pod creation blocked": Admission controller rejection (PodSecurityPolicy, Istio, custom webhooks)

Check the image reference in your deployment:

kubectl get deploy <name> -o yaml | grep -A2 image:

Verify the image exists:

docker pull myregistry.com/myimage:tag

For private registries, verify imagePullSecrets:

spec:
  imagePullSecrets:
  - name: regcred  # Must match a valid secret
  containers:
  - image: private.registry/image:tag

Create if missing: kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=...

Validate your deployment YAML:

kubectl apply -f deployment.yaml --dry-run=client

Common issues:
- typos in field names
- invalid resource requests (e.g., "100G" instead of "100Gi")
- missing or malformed probe configurations
- invalid security contexts

Get current spec to review: kubectl get deploy <name> -o yaml

Check overall cluster capacity:

kubectl top nodes
kubectl describe nodes
kubectl get --raw /api/v1/namespaces/<ns>/pods

If all nodes show CPU/memory pressure, the cluster is full. Solutions:
- Scale down other deployments
- Add more worker nodes
- Reduce resource requests in your pod spec

For resource requests, check current deployment:

kubectl get deploy <name> -o yaml | grep -A5 resources:

Check the service account:

kubectl get sa -n <namespace>
kubectl describe sa <sa-name> -n <namespace>

Verify RBAC bindings allow pod creation:

kubectl get rolebindings,clusterrolebindings -n <namespace> -o wide

If missing, create a role with pod creation permissions:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-creator
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create", "get", "list"]

If using Istio, service mesh, or custom admission webhooks, they may be rejecting pods:

kubectl get validatingwebhookconfigurations
kubectl get mutatingwebhookconfigurations

Describe to see rules:

kubectl describe validatingwebhookconfigurations <name>

Check admission controller logs:

kubectl logs -n istio-system deployment/istiod  # For Istio
kubectl logs -n kube-system <admission-pod>     # For custom controllers

If everything looks correct but pods take time to schedule, increase the timeout:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  progressDeadlineSeconds: 1800  # 30 minutes instead of default 10
  # ... rest of spec

Apply: kubectl apply -f deployment.yaml