kubectl Commands - Complete Cheatsheet

kubectl cluster-info

kubectl version

kubectl config view

kubectl api-resources

kubectl api-versions

kubectl get all --all-namespaces

kubectl get pod

kubectl get pod -o wide

kubectl describe pod nginx-1-xxxxx

kubectl logs nginx-1-xxxxx

kubectl logs -f nginx-1-xxxxx

kubectl logs --tail=20 nginx-1-xxxxx

kubectl logs --since=1h nginx-1-xxxxx

kubectl exec -it nginx-1-xxxxx -- /bin/bash

kubectl exec nginx-1-xxxxx -- ls /usr/share/nginx/html

kubectl top pod

kubectl delete pod nginx-1-xxxxx

kubectl get deployment

kubectl describe deployment nginx-1

kubectl get deployment nginx-1 -o yaml

kubectl edit deployment nginx-1

kubectl scale deployment nginx-1 --replicas=5

kubectl rollout status deployment nginx-1

kubectl rollout history deployment nginx-1

kubectl create deployment test-app --image=nginx:latest

kubectl delete deployment test-app

kubectl get services

kubectl describe services nginx-1

kubectl expose deployment nginx-1 --port=80 --type=LoadBalancer

kubectl expose deployment nginx-1 --port=80 --type=ClusterIP --name=nginx-internal

kubectl edit services nginx-1

kubectl delete service nginx-1

kubectl get events

kubectl get events --sort-by='.lastTimestamp'

kubectl get events --field-selector type=Warning

kubectl get events --field-selector involvedObject.kind!=Pod

kubectl get namespace

kubectl create namespace dev

kubectl describe namespace default

kubectl delete namespace dev

kubectl get pods -n kube-system

kubectl get all -n default

kubectl get node

kubectl describe node

kubectl top node

kubectl get pods -o wide --all-namespaces

kubectl cordon <node_name>

kubectl uncordon <node_name>

kubectl apply -f manifest.yaml

kubectl create -f manifest.yaml

kubectl delete -f manifest.yaml

kubectl apply -f ./k8s/

kubectl create configmap my-config --from-literal=key1=value1 --from-literal=key2=value2

kubectl get configmap

kubectl describe configmap my-config

kubectl create secret generic my-secret --from-literal=password=mysecretpass

kubectl get secrets

kubectl describe secrets my-secret

kubectl port-forward nginx-1-xxxxx 8080:80

kubectl port-forward service/nginx-1 8080:80

kubectl run debug --image=busybox:latest --rm -it -- sh

kubectl run test-pod --image=nginx:latest --port=80

kubectl get pods -w

kubectl get pod nginx-1-xxxxx -o json

kubectl get pods -o jsonpath='{.items[*].metadata.name}'

kubectl get daemonset

kubectl describe daemonset <daemonset_name>

kubectl edit daemonset <daemonset_name>

kubectl delete daemonset <daemonset_name>

kubectl get replicasets

kubectl describe replicasets <replicaset_name>

kubectl scale --replicas=3 replicaset/<replicaset_name>

kubectl get statefulset

kubectl describe statefulset <statefulset_name>

kubectl delete statefulset/<statefulset_name> --cascade=false

kubectl get serviceaccounts

kubectl describe serviceaccounts <sa_name>

kubectl delete serviceaccount <sa_name>

kubectl label pod <pod_name> environment=production

kubectl label node <node_name> disktype=ssd

kubectl label pod <pod_name> environment-

kubectl annotate pod <pod_name> description="My web app"

kubectl get pods -l environment=production

kubectl get pods -l 'environment in (production,staging)'

kubectl set resources deployment nginx-1 --limits=cpu=200m,memory=512Mi --requests=cpu=100m,memory=256Mi

kubectl top pod --containers

kubectl describe nodes | grep Allocated -A 5

kubectl rollout pause deployment nginx-1

kubectl rollout resume deployment nginx-1

kubectl rollout undo deployment nginx-1

kubectl rollout undo deployment nginx-1 --to-revision=2

kubectl rollout restart deployment nginx-1

kubectl config current-context

kubectl config get-contexts

kubectl config use-context <context_name>

kubectl config set-context --current --namespace=dev

kubectl config view

kubectl cp <pod_name>:/path/to/file /local/path

kubectl cp /local/path <pod_name>:/path/to/file

kubectl drain <node_name> --ignore-daemonsets --delete-emptydir-data

kubectl drain <node_name> --ignore-daemonsets --delete-emptydir-data --force

kubectl taint nodes <node_name> key=value:NoSchedule

kubectl taint nodes <node_name> key=value:NoSchedule-

kubectl label nodes <node_name> disktype=ssd

kubectl get roles

kubectl get clusterroles

kubectl describe role <role_name>

kubectl get rolebindings

kubectl get clusterrolebindings

kubectl create role pod-reader --verb=get,list,watch --resource=pods

kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods

kubectl create rolebinding read-pods --role=pod-reader --user=jane

kubectl create clusterrolebinding read-pods --clusterrole=pod-reader --user=jane

kubectl auth can-i create pods

kubectl auth can-i create pods --as=jane

kubectl auth can-i create pods --as=jane -n dev

kubectl auth can-i --list

kubectl get pv

kubectl get pvc

kubectl describe pv <pv_name>

kubectl describe pvc <pvc_name>

kubectl apply -f pvc.yaml

kubectl delete pvc <pvc_name>

kubectl get pvc -o custom-columns=NAME:.metadata.name,CAPACITY:.spec.resources.requests.storage,STATUS:.status.phase

kubectl get jobs

kubectl get cronjobs

kubectl create job test-job --image=busybox -- echo "Hello"

kubectl create cronjob test-cron --image=busybox --schedule="*/5 * * * *" -- echo "Hello"

kubectl describe job <job_name>

kubectl logs job/<job_name>

kubectl delete jobs --field-selector status.successful=1

kubectl patch cronjob <cronjob_name> -p '{"spec":{"suspend":true}}'

kubectl patch cronjob <cronjob_name> -p '{"spec":{"suspend":false}}'

kubectl create job --from=cronjob/<cronjob_name> <job_name>

kubectl get ingress

kubectl describe ingress <ingress_name>

kubectl get ingress -o wide

kubectl edit ingress <ingress_name>

kubectl create ingress simple --rule="foo.com/bar=svc:8080"

kubectl get ingressclass

kubectl get networkpolicy

kubectl describe networkpolicy <policy_name>

kubectl delete networkpolicy <policy_name>

kubectl get hpa

kubectl autoscale deployment nginx-1 --cpu-percent=50 --min=1 --max=10

kubectl describe hpa <hpa_name>

kubectl delete hpa <hpa_name>

kubectl get hpa -w

kubectl get resourcequota

kubectl describe resourcequota <quota_name>

kubectl create quota my-quota --hard=cpu=1,memory=1G,pods=2

kubectl get limitrange

kubectl describe limitrange <limitrange_name>

kubectl get pdb

kubectl describe pdb <pdb_name>

kubectl create pdb my-pdb --selector=app=nginx --min-available=2

kubectl debug <pod_name> -it --image=busybox

kubectl debug <pod_name> -it --copy-to=debug-pod --container=myapp

kubectl debug node/<node_name> -it --image=ubuntu

kubectl debug <pod_name> -it --image=busybox --target=<container_name>

kubectl debug <pod_name> -it --copy-to=debug-pod -- sh

kubectl get pods -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,NODE:.spec.nodeName

kubectl get pods --sort-by=.metadata.creationTimestamp

kubectl get pods -o jsonpath='{.items[0].spec.containers[0].image}'

kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.podIP}{"\n"}{end}'

kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].resources.limits.memory}{"\n"}{end}'

kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | sort -u

kubectl patch deployment nginx-1 -p '{"spec":{"replicas":5}}'

kubectl patch pod <pod_name> --type='json' -p='[{"op":"replace","path":"/spec/containers/0/image","value":"nginx:1.21"}]'

kubectl set image deployment/nginx-1 nginx=nginx:1.21

kubectl set env deployment/nginx-1 ENV=production

kubectl set serviceaccount deployment nginx-1 myserviceaccount

kubectl diff -f manifest.yaml

kubectl apply --server-side -f manifest.yaml

kubectl apply -f manifest.yaml --record

kubectl apply -f manifest.yaml --prune -l app=myapp

kubectl apply -k ./kustomize/overlays/production

kubectl kustomize ./kustomize/overlays/production

kubectl diff -k ./kustomize/overlays/production

kubectl wait --for=condition=available --timeout=300s deployment/nginx-1

kubectl wait --for=condition=ready pod -l app=nginx

kubectl wait --for=condition=complete --timeout=600s job/my-job

kubectl wait --for=delete pod/<pod_name> --timeout=60s

kubectl explain pod

kubectl explain pod.spec.containers

kubectl explain deployment --recursive

kubectl api-resources --api-group=apps

kubectl api-resources --namespaced=true

kubectl api-resources --namespaced=false

kubectl api-resources --verbs=list,get

kubectl get csr

kubectl certificate approve <csr_name>

kubectl certificate deny <csr_name>

kubectl plugin list

kubectl version --short

kubectl top pods --sort-by=cpu

kubectl top pods --sort-by=memory

kubectl top nodes --sort-by=memory

kubectl top pods -A --sort-by=memory

kubectl top pod <pod_name> --containers

kubectl get <resource>                    # List resources
kubectl get <resource> <name>             # Get specific resource
kubectl get <resource> -o wide            # More details
kubectl describe <resource> <name>        # Detailed info
kubectl logs <pod>                        # Container logs
kubectl top <resource>                    # Resource usage

kubectl create <resource>                 # Create resource
kubectl apply -f <file>                   # Create/update from file
kubectl edit <resource> <name>            # Edit resource
kubectl delete <resource> <name>          # Delete resource
kubectl replace -f <file>                 # Replace resource

kubectl run <name> --image=<image>        # Create pod
kubectl exec <pod> -- <command>           # Execute command
kubectl exec -it <pod> -- /bin/bash       # Interactive shell
kubectl port-forward <pod> <local>:<pod>  # Forward port

kubectl scale <resource> --replicas=<n>   # Scale resource
kubectl rollout status <resource>         # Check rollout
kubectl rollout history <resource>        # Rollout history
kubectl rollout undo <resource>           # Rollback

kubectl get po,svc,ing,cm -n production

# Check pod events
kubectl describe pod <pod_name>
 
# Check node resources
kubectl top nodes
 
# Check if nodes are schedulable
kubectl get nodes
 
# Check if there are taints on nodes
kubectl describe node <node_name> | grep Taints
 
# Check resource quotas
kubectl get resourcequota -n <namespace>
 
# Check PVC status if using volumes
kubectl get pvc

# Check logs
kubectl logs <pod_name>
kubectl logs <pod_name> --previous  # Logs from crashed container
 
# Describe pod for events
kubectl describe pod <pod_name>
 
# Debug with ephemeral container
kubectl debug <pod_name> -it --image=busybox
 
# Check liveness/readiness probes
kubectl get pod <pod_name> -o yaml | grep -A 10 livenessProbe
 
# Copy pod and change command to debug
kubectl debug <pod_name> --copy-to=debug-pod -it -- sh

# Check service endpoints
kubectl get endpoints <service_name>
kubectl describe svc <service_name>
 
# Check if pods match service selector
kubectl get pods -l app=myapp
kubectl get svc <service_name> -o yaml | grep selector
 
# Test from within cluster
kubectl run test --rm -it --image=busybox -- wget -O- <service_name>:<port>
 
# Check network policies
kubectl get networkpolicy
 
# Check DNS resolution
kubectl run test --rm -it --image=busybox -- nslookup <service_name>

# Check node resources
kubectl top nodes
kubectl describe node <node_name> | grep -A 5 Allocated
 
# Find resource-heavy pods
kubectl top pods -A --sort-by=memory
 
# Check for evicted pods
kubectl get pods -A | grep Evicted
 
# Drain and cordon node
kubectl cordon <node_name>
kubectl drain <node_name> --ignore-daemonsets --delete-emptydir-data
 
# Scale down deployments if needed
kubectl scale deployment <name> --replicas=2

# Check rollout status
kubectl rollout status deployment <name>
 
# Check rollout history
kubectl rollout history deployment <name>
 
# Check replica sets
kubectl get rs
 
# Describe deployment
kubectl describe deployment <name>
 
# Check pod template hash mismatch
kubectl get pods --show-labels
 
# Pause and resume rollout
kubectl rollout pause deployment <name>
kubectl rollout resume deployment <name>

# Find pods without resource limits
kubectl get pods -A -o json | jq '.items[] | select(.spec.containers[].resources.limits == null) | .metadata.name'
 
# Check resource usage vs requests
kubectl top pods -A
kubectl get pods -A -o custom-columns=NAME:.metadata.name,CPU_REQ:.spec.containers[*].resources.requests.cpu,MEM_REQ:.spec.containers[*].resources.requests.memory
 
# Find unused PVCs
kubectl get pvc -A --no-headers | while read ns name rest; do 
  kubectl get pods -n $ns -o json | jq -e ".items[].spec.volumes[]?.persistentVolumeClaim.claimName == \"$name\"" > /dev/null || echo "$ns/$name"
done
 
# Check for over-provisioned resources
kubectl top pods -A --sort-by=memory | head -20

resources:
  requests:
    memory: "64Mi"
    cpu: "250m"
  limits:
    memory: "128Mi"
    cpu: "500m"

livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 30
  periodSeconds: 10
 
readinessProbe:
  httpGet:
    path: /ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 5

metadata:
  labels:
    app: myapp
    tier: frontend
    environment: production
    version: v1.2.3

# Bad
image: nginx:latest
 
# Good
image: nginx:1.21.6

kubectl create namespace production
kubectl create namespace staging
kubectl create namespace development

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  fsGroup: 2000

securityContext:
  readOnlyRootFilesystem: true

securityContext:
  capabilities:
    drop:
      - ALL
    add:
      - NET_BIND_SERVICE

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

# Create role with minimal permissions
kubectl create role pod-reader --verb=get,list --resource=pods
 
# Bind to specific user
kubectl create rolebinding read-pods --role=pod-reader --user=jane

# Use tools like trivy, aqua, snyk
trivy image nginx:1.21

# Don't use ConfigMaps for sensitive data
kubectl create secret generic db-secret --from-literal=password=supersecret
 
# Mount as environment variable or volume

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

# Good - self-healing, rolling updates
kubectl create deployment myapp --image=nginx:1.21
 
# Bad - no self-healing
kubectl run myapp --image=nginx:1.21

spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: myapp-pdb
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: myapp

kubectl autoscale deployment myapp --cpu-percent=70 --min=2 --max=10

affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    - labelSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - myapp
      topologyKey: "kubernetes.io/hostname"

apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi

apiVersion: v1
kind: LimitRange
metadata:
  name: mem-limit-range
spec:
  limits:
  - default:
      memory: 512Mi
      cpu: 500m
    defaultRequest:
      memory: 256Mi
      cpu: 250m
    type: Container

kubectl top nodes
kubectl top pods -A --sort-by=memory

resources:
  requests:
    cpu: "100m"
    memory: "128Mi"
  limits:
    cpu: "500m"
    memory: "512Mi"

# Bad
image: nginx:latest
 
# Good
image: nginx:1.21.6-alpine

livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
readinessProbe:
  httpGet:
    path: /ready
    port: 8080

securityContext:
  runAsNonRoot: true
  runAsUser: 1000

# Bad - imperative, no history
kubectl create deployment myapp --image=nginx
 
# Good - declarative, version controlled
kubectl apply -f deployment.yaml

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: myapp-pdb
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: myapp

# create - fails if exists
kubectl create -f deployment.yaml
 
# apply - creates or updates (preferred)
kubectl apply -f deployment.yaml
 
# replace - deletes then creates
kubectl replace -f deployment.yaml --force

# Taint node
kubectl taint nodes node1 key=value:NoSchedule
 
# Pod must have toleration to schedule on node1
tolerations:
- key: "key"
  operator: "Equal"
  value: "value"
  effect: "NoSchedule"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: production
  labels:
    app: myapp
    version: v1.2.3
    tier: frontend
  annotations:
    description: "My production application"
    git-commit: "abc123def456"
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
        version: v1.2.3
        tier: frontend
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9090"
    spec:
      # Security
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 2000
        seccompProfile:
          type: RuntimeDefault
      
      # Service Account
      serviceAccountName: myapp-sa
      
      # Anti-affinity for HA
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - myapp
              topologyKey: kubernetes.io/hostname
      
      # Containers
      containers:
      - name: myapp
        image: myregistry.io/myapp:1.2.3
        imagePullPolicy: IfNotPresent
        
        # Ports
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
        - name: metrics
          containerPort: 9090
          protocol: TCP
        
        # Environment
        env:
        - name: ENV
          value: "production"
        - name: DB_HOST
          valueFrom:
            configMapKeyRef:
              name: myapp-config
              key: db_host
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: myapp-secret
              key: db_password
        
        # Resources
        resources:
          requests:
            cpu: "250m"
            memory: "256Mi"
          limits:
            cpu: "1000m"
            memory: "512Mi"
        
        # Health Checks
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 3
        
        startupProbe:
          httpGet:
            path: /startup
            port: 8080
          initialDelaySeconds: 0
          periodSeconds: 10
          timeoutSeconds: 3
          failureThreshold: 30
        
        # Volume Mounts
        volumeMounts:
        - name: config
          mountPath: /config
          readOnly: true
        - name: cache
          mountPath: /cache
        
        # Security
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
      
      # Volumes
      volumes:
      - name: config
        configMap:
          name: myapp-config
      - name: cache
        emptyDir:
          sizeLimit: 500Mi
      
      # Image Pull Secrets
      imagePullSecrets:
      - name: registry-secret
---
apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: production
  labels:
    app: myapp
spec:
  type: ClusterIP
  selector:
    app: myapp
  ports:
  - name: http
    port: 80
    targetPort: 8080
    protocol: TCP
  sessionAffinity: None
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Percent
        value: 50
        periodSeconds: 15
    scaleUp:
      stabilizationWindowSeconds: 0
      policies:
      - type: Percent
        value: 100
        periodSeconds: 15
      - type: Pods
        value: 4
        periodSeconds: 15
      selectPolicy: Max
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: myapp-pdb
  namespace: production
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: myapp
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: myapp-netpol
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: myapp
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: production
    - podSelector:
        matchLabels:
          tier: frontend
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432
  - to:
    - namespaceSelector: {}
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53

kubectl get all,cm,secret,ing,pvc -n production

kubectl delete all -l app=myapp

kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | sort -u

kubectl get pods -A --field-selector=status.phase!=Running

kubectl rollout restart deployment myapp

kubectl get all -o yaml > all-resources.yaml

kubectl top pods -A --sort-by=memory | head -20

kubectl get pods -o wide --all-namespaces | awk '{print $8}' | sort | uniq -c

kubectl get pods -A --field-selector=status.phase=Failed

kubectl delete pod <pod_name> --grace-period=0 --force

kubectl get pods -o custom-columns=NAME:.metadata.name,QOS:.status.qosClass

alias k='kubectl'
alias kgp='kubectl get pods'
alias kgs='kubectl get svc'
alias kgd='kubectl get deployment'
alias kgn='kubectl get nodes'
alias kdp='kubectl describe pod'
alias kds='kubectl describe svc'
alias kdd='kubectl describe deployment'
alias kl='kubectl logs'
alias klf='kubectl logs -f'
alias kex='kubectl exec -it'
alias kctx='kubectl config current-context'
alias kns='kubectl config set-context --current --namespace'
alias kga='kubectl get all'
alias kgaa='kubectl get all --all-namespaces'
alias kdel='kubectl delete'
alias kapp='kubectl apply -f'
alias keti='kubectl exec -ti'
alias kcuc='kubectl config use-context'
alias kcgc='kubectl config get-contexts'