Troubleshooting

Identify the first failed phase; do not repeat destructive steps.

Artifact access

helm show chart <chart-reference> --version <chart-version>
kubectl get secret graph-artifacts --namespace <namespace> \
  --output jsonpath='{.type}{"\n"}'

• 401/403: token scope, expiration, or entitlement.
• ImagePullBackOff: inspect Pod events, image name/tag, and namespace-local pull secret.

Operator and CRD

kubectl get crd | grep -E 'anzo|anzograph'
kubectl get deployment --namespace <namespace>
kubectl logs deployment/<operator-deployment> --namespace <namespace>
kubectl describe anzo <name> --namespace <namespace>
kubectl describe anzograph <name> --namespace <namespace>

• CR rejected: validate against the CRD shipped with the installed chart, or check the schema using the validation tools in the Agentic reference.
• CR does not reconcile: verify operator readiness, watch namespace, RBAC, and events.
• CR phase Failed: record .status.reason and .status.message before changing it.

Workload

kubectl get pods,pvc,service --namespace <namespace>
kubectl get events --namespace <namespace> --sort-by=.lastTimestamp
kubectl logs <pod-name> --namespace <namespace> --all-containers=true --tail=200

Symptom	Check first
Pod Pending	Requested resources, node selectors, PVC events
CrashLoopBackOff	License, generated config, Secret keys, memory limit
PVC Pending	StorageClass, access mode, topology, quota
Service unreachable	Service endpoints, TLS, ingress/LB, network policy
Login fails	Generated credential Secret and identity-provider configuration
License inactive	Selected method, network path, CR status/operator logs
Data missing	Retention settings, PV claimRef, upgrade/reinitialization history

Escalation bundle

Collect resource descriptions, status, recent events, chart/version, Kubernetes version, and redacted logs. Never include Secret data, rendered licensing manifests, tokens, passwords, private keys, or license strings. Use Support for escalation.