☸️
kubectl cheat sheet
kubectl talks to a Kubernetes cluster. Add -n NAMESPACE to target a namespace, or -A for all namespaces. Confirm your context before running anything that changes state.
Click any command to copy it.
Context and namespace
| Command | What it does |
|---|---|
kubectl config get-contexts | List contexts (clusters). |
kubectl config current-context | Show the active context. |
kubectl config use-context NAME | Switch cluster. |
kubectl config set-context --current --namespace=NAME | Set the default namespace for this context. |
kubectl get ns | List namespaces. |
Inspect
| Command | What it does |
|---|---|
kubectl get pods -A | Pods in all namespaces. |
kubectl get pods -o wide | Include node and IP. |
kubectl get deploy,svc,ing | Several resource types at once. |
kubectl get all | Common resources in the namespace. |
kubectl describe pod NAME | Detailed state and recent events for a pod. |
kubectl get events --sort-by=.lastTimestamp | Recent cluster events, newest last. |
kubectl top pods | CPU and memory use (needs metrics-server). |
kubectl get nodes | List nodes and their status. |
kubectl get pod NAME -o yaml | Full definition as YAML. |
Logs and debugging
| Command | What it does |
|---|---|
kubectl logs -f pod/NAME | Follow a pod's logs. |
kubectl logs pod/NAME -c CONTAINER | Logs from a specific container. |
kubectl logs pod/NAME --previous | Logs from the previous, crashed container. |
kubectl exec -it pod/NAME -- sh | Open a shell in a pod. |
kubectl port-forward pod/NAME 8080:80 | Forward a local port to a pod. |
kubectl run test --image=busybox -it --rm -- sh | Start a temporary pod for debugging. |
kubectl cp NAME:/path ./local | Copy files from a pod (use NAMESPACE/NAME:/path for another namespace). |
Apply and change
| Command | What it does |
|---|---|
kubectl apply -f file.yaml | Create or update resources from a file. |
kubectl delete -f file.yaml | Destructive: Delete the resources defined in a file. |
kubectl delete pod NAME | Destructive: Delete a pod (a Deployment will recreate it). |
kubectl scale deploy/NAME --replicas=3 | Change the number of replicas. |
kubectl edit deploy/NAME | Edit a resource in your editor. |
kubectl apply -f file.yaml --dry-run=client | Validate without changing anything. |
kubectl create deploy web --image=nginx --dry-run=client -o yaml | Generate YAML to start from. |
Rollouts and nodes
| Command | What it does |
|---|---|
kubectl rollout status deploy/NAME | Watch a rollout until it finishes. |
kubectl rollout restart deploy/NAME | Restart all pods of a deployment gradually. |
kubectl rollout undo deploy/NAME | Roll back to the previous revision. |
kubectl rollout history deploy/NAME | Show revision history. |
kubectl cordon NODE | Mark a node unschedulable. |
kubectl drain NODE --ignore-daemonsets | Destructive: Evict pods from a node to prepare for maintenance. |
kubectl auth can-i create pods | Check whether you have a permission. |
Frequently asked questions
Why is my pod in CrashLoopBackOff?
The container keeps exiting. Check kubectl logs pod/NAME --previous for the crash output and kubectl describe pod NAME for events such as failing probes or out-of-memory kills.
How do I read a secret value?
Run kubectl get secret NAME -o jsonpath='{.data.KEY}' | base64 -d. Remember that Secrets are only base64-encoded, not encrypted, by default.