A customer's on-prem Kubernetes cluster can't reach your SaaS control plane because of restrictive egress rules. Walk through how you diagnose and fix this without direct VPN or shell access.
Quick Answer
Work through the path methodically with the customer: confirm DNS resolution, confirm the required outbound ports/hosts are allow-listed, check for an egress proxy or NAT gateway that needs explicit rules, and validate TLS/cert trust — using tools the customer can run and share output from, since you likely can't exec into their cluster yourself.
Detailed Answer
Start by defining the exact failure: connection refused, timeout, DNS failure, or TLS handshake failure each point to a different layer. Since you probably cannot exec into the customer's cluster, hand them a small, safe diagnostic pod/job and read-only commands to run, and have them paste back output rather than trying to debug blind over a call.
Check, in order: (1) DNS — can the cluster resolve your control-plane hostname at all; (2) egress allow-list — many enterprise clusters route all outbound traffic through a proxy or firewall that only permits specific IPs/hostnames/ports, so your SaaS endpoint may simply not be on the list; (3) NAT/proxy configuration inside the cluster (HTTP_PROXY/NO_PROXY env vars, egress gateway rules in a service mesh); (4) TLS — corporate proxies sometimes MITM outbound TLS with a custom root CA that your client doesn't trust. Keep a clear paper trail of what was tested and its result — customer network teams often need documented evidence to get a firewall change approved.
Code Example
# Diagnostics to hand to a customer (they run these, you interpret results) # DNS nslookup api.yourproduct.com # Raw TCP reachability nc -vz api.yourproduct.com 443 # TLS handshake + cert chain openssl s_client -connect api.yourproduct.com:443 -servername api.yourproduct.com # From inside the cluster (as a throwaway debug pod) kubectl run netdebug --rm -it --image=nicolaka/netshoot -- \ sh -c "nslookup api.yourproduct.com && curl -v https://api.yourproduct.com/health"
Interview Tip
Emphasize working through the customer's process rather than assuming direct access — that constraint is the whole point of the question.