Kubernetes PVC Pending and CSI: diagnose binding, attach and mount

The OS selection describes the administration host running kubectl, not a qualification of cluster-node operating systems. Use the existing approved kubectl under the authorized normal user; sudo can select a different kubeconfig and identity. kubectl is a client, not a daemon, and this workflow installs no kubelet or cluster.

Query the base packages and the client build. Missing tooling means prepare an approved compatible client in a planned change through the team’s official workflow before continuing. Do not replace it with an arbitrary latest package, an Arch package on Manjaro or an unapproved repository. The official setup reference also documents pinned binary/checksum verification; this guide deliberately requires an existing approved client.

Use a supported updated minor of this 10/9 family and entitled RHEL or corresponding official Rocky/Alma repositories for base packages. Keep the approved existing kubectl and authentication plugin. Preserve SELinux/firewalld and the host crypto policy; no new inbound port or node service is needed.

cat /etc/os-release
uname -m
rpm -q ca-certificates bash coreutils
command -v bash kubectl
kubectl version --client --output=yaml

Preserve SELinux, firewalld and the administration host’s crypto policy. Resolve plugin/kubeconfig/TLS-trust failures with its owner; do not set permissive mode, recursively relabel paths or open a new public port. These checks report host state, not the cluster nodes’ security configuration.

if command -v getenforce >/dev/null 2>&1; then getenforce; fi
if command -v firewall-cmd >/dev/null 2>&1; then firewall-cmd --state; fi

Compare the context name with the authorized target and keep this Bash shell. The k function in subsequent panels pins that context and a request timeout. Reload this step in a new shell; an empty selection must not silently become another target.

At review time the upstream maintained branches are 1.37, 1.36 and 1.35. kubectl must be within one minor of every API server it may reach; an HA control plane during upgrade narrows the range. Distribution/provider and driver support can impose additional limits. A failed or unavailable server version is not permission to proceed on a guess.

context=$(kubectl config current-context) || exit 1
test -n "$context" || exit 1
printf 'Selected context: %s\n' "$context"
k() {
    test -n "${context:-}" || { printf 'STOP: load the selected context in this shell first.\n' >&2; return 1; }
    kubectl --context "$context" --request-timeout=20s "$@"
}
k version --output=yaml

The namespace owner may read its Pod/PVC but not cluster-scoped PV, StorageClass, Node or VolumeAttachment objects. Query authorization before choosing those branches. Each answer describes this identity, not whether the storage backend is healthy. A no answer is a delegated-owner handoff, not permission to obtain cluster-admin.

Event messages and driver logs can contain internal backend identifiers. Keep them in the approved private incident record. This investigation does not retrieve Kubernetes Secret contents or raw authentication configuration.

k auth can-i get pods -n 'apps'
k auth can-i get persistentvolumeclaims -n 'apps'
k auth can-i list events -n 'apps'
k auth can-i get storageclasses.storage.k8s.io
k auth can-i get persistentvolumes
k auth can-i list volumeattachments.storage.k8s.io