Inspect CoreDNS config and logs

Review Corefile (forward/cache) and tail logs for SERVFAIL/upstream errors

kubectl -n kube-system get cm coredns -o yaml; kubectl -n kube-system logs deploy/coredns --tail=50

More troubleshooting commands

TLS cipher and protocol enum

nmap --script ssl-enum-ciphers -p 443 <host>

Grade supported TLS versions/ciphers; flags weak/deprecated suites per port
Verify full TLS chain and SNI

openssl s_client -connect <host>:443 -servername <host> -showcerts 2>/dev/null | grep -E 'Verify|s:|i:'

Show full chain with correct SNI; Verify line catches missing intermediates
Batch cert expiry scan

for h in $(cat hosts.txt); do echo -n "$h "; echo | openssl s_client -connect $h:443 -servername $h 2>/dev/null | openssl x509 -noout -enddate; done

Loop many hosts to print notAfter dates; pipe to sort for soonest expiry
Decode JWT claims

cut -d. -f2 <<<"$JWT" | tr '_-' '/+' | base64 -d 2>/dev/null | jq .

Decode payload to inspect exp/iss/aud; note: fixes base64url, skips sig check
List gRPC services via reflection

grpcurl -plaintext <host>:<port> list; grpcurl -plaintext <host>:<port> describe <svc>

Enumerate services/methods over reflection; -plaintext skips TLS for debug