The chroot /host note is a good catch, the UNKNOWN output would send most people down the wrong path. One small add for the loop: kubectl debug on a node leaves a node-debugger pod behind in default for each node, and they don't get cleaned up on their own. On a big cluster it's worth a kubectl delete pod for those afterwards so the check doesn't leave clutter.