The full fault catalog (35 primitives)
Every fault scenario our coverage report draws from — each one detectable, diagnosable, and autonomously remediable. Machine-readable copies: ruleset.json · catalog.md.
Catalog 0efc434, ruleset v0.1.0. To see which of these apply to your own stack, run the coverage report.
Kubernetes
- Netpol blockwarning · network partitionAdd an egress rule to checkout-netpol allowing TCP 5432 to postgres.
- CPU squeezecritical · resource exhaustionRestore the checkout CPU limit (500m) / right-size requests+limits.
- Bad imagewarning · crash loopRoll the deployment back to a valid (existing) image tag.
- Unschedulable CPUcritical · scheduling failureLower the CPU request to fit a node (or add capacity).
- Broken probewarning · probe failureFix the liveness probe path back to the real health endpoint.
- Init container failwarning · crash loopCorrect or remove the init-container image reference.
- PVC unboundwarning · storage failurePoint the PVC at a valid StorageClass (or create it).
- PDB blocking rolloutwarning · bad deploymentLower PDB minAvailable (or raise replicas) so a pod can be evicted.
- STS stuck PVCwarning · storage failureFix the StatefulSet StorageClass to a provisionable one.
- HPA cannot scalewarning · resource exhaustionRaise the ResourceQuota pod limit (or free quota).
- Service zero endpointscritical · service failureFix the Service selector to match the deployment's pod labels.
- Configmap driftwarning · config driftRestore the ConfigMap value and roll the checkout pods.
- RBAC deniedwarning · rbac denialGrant the missing RBAC verb in the Role/RoleBinding.
- Cert expiredcritical · cert failureCreate the missing Issuer, or point the Certificate at an existing one.
- DB conn exhaustioncritical · resource exhaustionKill the connection hog and/or raise max_connections; fix the connection leak.
- Dependency egress blockwarning · dependency unavailableRestore the :443 egress rule in the checkout NetworkPolicy.
- DNS failurecritical · dependency unavailableRestore DNS (:53) egress / fix the pod dnsConfig.
- Redis egress blockwarning · dependency unavailableRestore the :6379 egress rule in checkout-java-netpol (or fix the cache route).
- Kafka egress blockcritical · dependency unavailableRestore the :9092 egress rule in checkout-java-netpol (or fix the broker route).
- Karpenter capacitywarning · capacity exhaustionReduce the request to a satisfiable size, or widen the NodePool instance-type/limits.
- JVM OOMcritical · resource exhaustionStop the leak / restart the pod; right-size the JVM heap (-Xmx) and the container memory limit.
- Latency brownoutcritical · resource exhaustionRemove the injected delay; size the thread pool / add capacity to absorb the latency.
- Failed prestop hookwarning · workload lifecycleFix the preStop hook command, or extend terminationGracePeriodSeconds so the hook reliably completes.
- Failed daemon podwarning · node lifecycleCorrelate with the node lifecycle event (drain, spot interruption, scale-down) and confirm the DaemonSet tolerates it.
AWS
- Postgres S3 denycritical · iam permission driftRemove the deny / restore the postgres role's S3 permissions.
- Checkout sm denywarning · iam permission driftRestore the checkout role's GetSecretValue permission.
- ELB unhealthycritical · external service failureRestore the target group's health-check path.
- SG rule blockwarning · iam permission driftRe-authorize the security-group ingress rule.
- SG DB blockwarning · dependency unavailableRe-authorize the :5432 ingress on the RDS security group.
- RDS failovercritical · dependency unavailableTransient — ensure the app's pool reconnects/retries; investigate the failover trigger if unexpected.
- SQS receive denywarning · iam permission driftRestore the consumer role's sqs:ReceiveMessage permission.
- Karpenter runinstances denywarning · iam permission driftRestore the Karpenter controller role's ec2:RunInstances/CreateFleet permissions.
- SQS consumer stallcritical · dependency unavailableRestart/unblock the consumer so it drains the queue; investigate why acking stalled.
- SQS poison messageswarning · service failureDrain/triage the DLQ, fix the message contract or consumer parsing, and replay valid messages.
- External secret sync failurewarning · secret sync failureFix the backing secret's IRSA permissions, or correct the ExternalSecret spec if the source key/path changed.