Investigation workspace
Evidence-backed timeline — every step is read-only, bounded and audited.
Status
closed
Tenant
Helios Energy Grid
Grid Telemetry Fabric
Lead agent
Application Agent 01
Environment: production
RCA confidence
pending
Investigation timeline
Severity P2 · phases are append-only evidence steps
- Tenant and scope validationverifiedGuardrails · 06:41:12
Passport verified for ag-kubernetes-01. Scope limited to tenant tn-nordic / customer cu-fsprod. Read-only mode confirmed.
- passport signature valid
- tenant boundary check passed
- Node status queryanomalyKubernetes · 06:41:38
fs-prod-cs-tool2 reports Ready=False, kubelet heartbeat stale for 4m12s.
- kubectl get node fs-prod-cs-tool2 -> NotReady
- kubelet last heartbeat 06:37:26
- Node conditionsanomalyKubernetes · 06:42:02
MemoryPressure=False, DiskPressure=False, PIDPressure=False, NetworkUnavailable=False, Ready=False (KubeletNotReady: container runtime network not ready).
- conditions snapshot captured
- Kubernetes eventsanomalyKubernetes · 06:42:31
17 FailedCreatePodSandBox events and 9 Failed ErrImagePull events on the node within 10 minutes.
- event stream 06:32-06:42
- Kubelet logsanomalyLinux · 06:43:04
kubelet: failed to pull image registry.corp.internal/cni/calico-node:v3.27.2 — connection reset by peer during layer fetch.
- journalctl -u kubelet (read-only)
- Containerd logsanomalyLinux · 06:43:29
containerd: 3 resets mid-transfer at ~5MB layer boundary; TLS handshake succeeds, stream terminates.
- journalctl -u containerd (read-only)
Opened 7/30/2026, 8:14:00 AM · inc-4788