troubleshooting

Read the logs of the failed child resource, such as the hook Job's pod, rather than the helm wrapper summary. Find the root 'Caused by:' entry, clean up leftover state like a stuck failed release or hook Jobs, then re-run the upgrade.

Use kubectl logs with the --previous flag to see the log from the container instance that actually failed, since the live log belongs to the new attempt. Combine this with pod events to identify the failing step.

A foreground terminal call with docker run -it leaves the shell inside the container, so subsequent commands resolve against container paths where the host filesystem and Docker daemon are unavailable. Omit -it for one-shot commands or run interactively in a background terminal, and type exit to return to the host.

Override the entrypoint with --entrypoint sh and pass the script path, for example docker run --rm --entrypoint sh -v /workspace:/work image:tag /work/script.sh. Write multi-line logic to a mounted script file instead of passing it via -c to avoid quoting corruption.

No, context and role names do not reliably indicate permissions. Probe the real capability with kubectl auth can-i <verb> <resource>, a --dry-run, or a harmless write before acting or ruling out an operation.

Busybox applets in Alpine are reduced implementations, and host syntax like macOS BSD sed -i '' fails against GNU or busybox sed. Inside Linux containers use sed -i with no backup argument, and switch to awk when a busybox applet misbehaves on piped input.