Investigate · workspace

P3closed

Registry service image pulls intermittently reset

TLS resets against the external registry mirror in staging.

Evidence viewerOpen RCA report

Elapsed

closed

resolved

Reference

inc-4795

recurrence 3x

Investigation workspace

Evidence-backed timeline — every step is read-only, bounded and audited.

Read-only Agent OS

Status

closed

Tenant

Atlas Public Sector

National Registry Services

Lead agent

Linux Agent 02

Environment: staging

RCA confidence

pending

Investigation timeline

Severity P3 · phases are append-only evidence steps

  1. Tenant and scope validationverifiedGuardrails · 06:41:12

    Passport verified for ag-kubernetes-01. Scope limited to tenant tn-nordic / customer cu-fsprod. Read-only mode confirmed.

    • passport signature valid
    • tenant boundary check passed
  2. Node status queryanomalyKubernetes · 06:41:38

    fs-prod-cs-tool2 reports Ready=False, kubelet heartbeat stale for 4m12s.

    • kubectl get node fs-prod-cs-tool2 -> NotReady
    • kubelet last heartbeat 06:37:26
  3. Node conditionsanomalyKubernetes · 06:42:02

    MemoryPressure=False, DiskPressure=False, PIDPressure=False, NetworkUnavailable=False, Ready=False (KubeletNotReady: container runtime network not ready).

    • conditions snapshot captured
  4. Kubernetes eventsanomalyKubernetes · 06:42:31

    17 FailedCreatePodSandBox events and 9 Failed ErrImagePull events on the node within 10 minutes.

    • event stream 06:32-06:42
  5. Kubelet logsanomalyLinux · 06:43:04

    kubelet: failed to pull image registry.corp.internal/cni/calico-node:v3.27.2 — connection reset by peer during layer fetch.

    • journalctl -u kubelet (read-only)
  6. Containerd logsanomalyLinux · 06:43:29

    containerd: 3 resets mid-transfer at ~5MB layer boundary; TLS handshake succeeds, stream terminates.

    • journalctl -u containerd (read-only)

Opened 7/31/2026, 11:02:00 AM · inc-4795