> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/network-security/container-network-exposure/troubleshoot-container-network-exposure.md).

# Troubleshoot Container Network Exposure Issues

## Onboarding Issues

If Container Exposure is not generating any alerts or your RQL queries always return empty:

* Make sure all Prisma Cloud resources in the specific cluster are in the **Running** state.
* Check the Satellite status in the Prisma Cloud UI (**Settings > Providers > K8s Satellite**):
  * If the resources in the cluster are running and the Satellite status is **Active**:
    * Make sure the cluster is onboarded and the Satellite operator is installed successfully,
    * Wait until the first ingestion cycle is completed (24 hours).
  * If the Satellite status is **Pending Install**:
    * Ensure resources under K8s `pc-satellite` namespace are in the **Running** or **Completed** state,
    * Check `prismacloud-satellite-manager` pod logs: `kubectl logs <pod name> -n pc-satellite`,
    * Ensure that the K8s Node has sufficient resources.
  * If the Satellite status is **Offline**:
    * The K8s cluster may not be active in the respective cloud service provider.

## Search and Investigate Issues

If the SLA for resource ingestion is met and there aren’t any results for the query:

* Run the same RQL search as the previous time, however change the `effective.action` value to `Any` and check if you see a 'Reject' path.
  * If you see a 'Reject' path, it indicates that certain security configurations, such as security groups, NACLS, firewalls, NSGs, or Kubernetes network policies, are hindering the flow of traffic.
  * If you do not see a 'Reject' path, that is no path is observed to K8s Service, run the same RQL query without any Kubernetes-specific filters, ensure that the `effective.action` is `Any` and `dest.resource.type` is set to `Instance`.
  * If you see an 'Allow' path for the new RQL query above, that is to the K8s Nodes within the K8s cluster, follow the steps listed below to troubleshoot:
    * Ensure that the K8s service is of type 'LoadBalancer'
      * Verify that the service slated for exposure has been assigned an External-IP.
      * Ensure that the K8s service intended for investigation has endpoints, by running the `kubectl describe service <service name> -n <namespace name>` command. If no endpoints are observed, check the selectors used in the K8s service because there may be a problem with the K8s deployment.
      * Check if the target port in the K8s Service aligns with the actual container port where the application runs inside the pod.

If each of the above troubleshooting steps work as expected, there can be an issue with K8s resource ingestion.

* If there is a 'Reject' path to the nodes, it indicates that certain security configurations, such as security groups, NACLS, firewalls, NSGS are hindering the flow of traffic.
* If there is no path, there might be an issue with resource ingestion of non-k8s resources, such as instances or load balancers.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/network-security/container-network-exposure/troubleshoot-container-network-exposure.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.