kubectl Command Cheat Sheet

Nine groups from context to cluster, each with a ready-to-use example

90 commands

kubectl config get-contextsContext and listing

List all contexts; switching to the wrong cluster is a classic outage.

kubectl config get-contexts

kubectl config use-context prodContext and listing

Switch the active context; confirm this before any change.

kubectl config use-context prod-cn

kubectl config current-contextContext and listing

Show the active cluster, useful as a script precondition.

kubectl config current-context

kubectl config set-context --current --namespace=stagingContext and listing

Pin the default namespace to skip repeating -n.

kubectl config set-context --current --namespace=staging

kubectl get nsContext and listing

List namespaces.

kubectl get ns

kubectl get all -n appContext and listing

Show the main resources in a namespace at once.

kubectl get all -n app

kubectl get pods -o wideContext and listing

Add IP and node columns; essential for scheduling and network issues.

kubectl get pods -o wide -n app

kubectl get pods -AContext and listing

List pods across all namespaces.

kubectl get pods -A --field-selector=status.phase!=Running

kubectl get pods -wContext and listing

Watch the list change over time, handy during rollouts.

kubectl get pods -w -n app

kubectl get pod web-0 -o yamlContext and listing

Dump the full YAML of a resource, including runtime status.

kubectl get pod web-0 -o yaml > pod-backup.yaml

kubectl get deploy web -o yaml --exportContext and listing

Strip cluster-generated fields so the YAML can be reapplied.

kubectl get deploy web -o yaml -n app

kubectl explain deploy.spec.strategyContext and listing

Look up field meaning and allowed values without leaving the terminal.

kubectl explain deploy.spec.strategy --recursive

kubectl api-resourcesContext and listing

List every resource type the cluster supports, with short names.

kubectl api-resources --namespaced=true

kubectl apply -f deploy.yamlContext and listing

Apply manifests declaratively; safe to run repeatedly.

kubectl apply -f k8s/ -n app

kubectl delete -f deploy.yamlContext and listing

Delete resources described by a manifest.

kubectl delete -f k8s/ -n app

kubectl create ns stagingContext and listing

Create a namespace.

kubectl create ns staging

kubectl describe pod <pod>Pod operations

Show pod details; the Events section at the bottom is where clues live.

kubectl describe pod web-0 -n app

kubectl logs <pod>Pod operations

Print container logs.

kubectl logs web-0 -n app --tail=200

kubectl logs -f <pod> -c appPod operations

Follow logs of one container; -c is required for multi-container pods.

kubectl logs -f web-0 -c app -n app

kubectl logs --previous <pod>Pod operations

Read logs from before the last crash; essential for CrashLoopBackOff.

kubectl logs web-0 --previous -n app

kubectl logs --since=10m <pod>Pod operations

Show logs from the last ten minutes.

kubectl logs web-0 --since=10m --timestamps -n app

kubectl exec -it <pod> -- shPod operations

Get a shell in a container; slim images usually lack bash.

kubectl exec -it web-0 -n app -- /bin/sh

kubectl exec <pod> -- envPod operations

Show the environment variables actually in effect.

kubectl exec web-0 -n app -- printenv

kubectl cp ./local.txt <pod>:/tmp/Pod operations

Copy files between the local machine and a pod.

kubectl cp ./dump.sql app/web-0:/tmp/dump.sql

kubectl port-forward <pod> 8080:80Pod operations

Forward a pod port locally to debug services that are not exposed.

kubectl port-forward pod/web-0 8080:80 -n app

kubectl run tmp --rm -it --image=busybox -- shPod operations

Throwaway debug pod that cleans itself up on exit.

kubectl run tmp --rm -it --image=busybox:1.36 --restart=Never -- sh

kubectl get pod <pod> -o jsonpath="{.status.podIP}"Pod operations

Read a pod IP in a script-friendly way.

kubectl get pod web-0 -o jsonpath="{.status.podIP}" -n app

kubectl delete pod <pod>Pod operations

Delete a pod; controller-managed pods are recreated automatically.

kubectl delete pod web-0 -n app

kubectl delete pod <pod> --grace-period=0 --forcePod operations

Force-delete a pod stuck in Terminating.

kubectl delete pod web-0 --grace-period=0 --force -n app

kubectl get pod <pod> -o jsonpath="{.status.containerStatuses[*].restartCount}"Pod operations

Check restart counts to spot a crash loop.

kubectl get pod web-0 -o jsonpath="{.status.containerStatuses[*].restartCount}" -n app

kubectl get deployDeploy and scale

List deployments with replica readiness.

kubectl get deploy -n app -o wide

kubectl scale deploy/web --replicas=3Deploy and scale

Change the replica count; the simplest way to scale.

kubectl scale deploy/web --replicas=3 -n app

kubectl set image deploy/web web=app:1.1Deploy and scale

Roll out a new image version.

kubectl set image deploy/web web=registry.example.com/app:1.1 -n app

kubectl edit deploy/webDeploy and scale

Edit the live spec; saving applies it immediately.

kubectl edit deploy/web -n app

kubectl patch deploy/web --type=merge -p "{\"spec\":{\"replicas\":2}}"Deploy and scale

Patch a field with inline JSON, better than edit in scripts.

kubectl patch deploy/web --type=merge -p "{\"spec\":{\"replicas\":2}}" -n app

kubectl autoscale deploy/web --min=2 --max=10 --cpu-percent=70Deploy and scale

Set up horizontal pod autoscaling.

kubectl autoscale deploy/web --min=2 --max=10 --cpu-percent=70 -n app

kubectl get rsDeploy and scale

List ReplicaSets; past versions live here.

kubectl get rs -n app

kubectl get deploy web -o jsonpath="{.spec.template.spec.containers[*].image}"Deploy and scale

Confirm which image is actually running.

kubectl get deploy web -o jsonpath="{.spec.template.spec.containers[*].image}" -n app

kubectl annotate deploy/web note="release-1.1"Deploy and scale

Attach an annotation to record release info.

kubectl annotate deploy/web note="release-1.1" --overwrite -n app

kubectl label deploy/web tier=webDeploy and scale

Add a label used by Service selectors and queries.

kubectl label deploy/web tier=web --overwrite -n app

kubectl rollout status deploy/webRollout and rollback

Watch rollout progress; always check after a release.

kubectl rollout status deploy/web -n app --timeout=120s

kubectl rollout history deploy/webRollout and rollback

Show revision history and change causes.

kubectl rollout history deploy/web -n app

kubectl rollout undo deploy/webRollout and rollback

Roll back to the previous revision; the fastest way to stop the bleeding.

kubectl rollout undo deploy/web -n app

kubectl rollout undo deploy/web --to-revision=2Rollout and rollback

Roll back to a specific revision; check history first.

kubectl rollout undo deploy/web --to-revision=2 -n app

kubectl rollout restart deploy/webRollout and rollback

Restart all pods in place, common after config changes.

kubectl rollout restart deploy/web -n app

kubectl rollout pause deploy/webRollout and rollback

Pause a rollout so you can inspect before resuming.

kubectl rollout pause deploy/web -n app

kubectl rollout resume deploy/webRollout and rollback

Resume a paused rollout.

kubectl rollout resume deploy/web -n app

kubectl get svcService and network

List services with ClusterIP and ports.

kubectl get svc -n app -o wide

kubectl get endpoints webService and network

Show the pod IPs behind a service; empty means the selector matches nothing.

kubectl get endpoints web -n app

kubectl describe svc webService and network

Show service details including selector and port mapping.

kubectl describe svc web -n app

kubectl expose deploy/web --port=80 --target-port=8080Service and network

Expose a deployment with a service.

kubectl expose deploy/web --port=80 --target-port=8080 --type=ClusterIP -n app

kubectl port-forward svc/web 8080:80Service and network

Forward a service port to verify locally without Ingress.

kubectl port-forward svc/web 8080:80 -n app

kubectl get ingressService and network

List ingresses and the hostnames they expose.

kubectl get ingress -n app

kubectl describe ingress webService and network

Show ingress rules and resolved backends.

kubectl describe ingress web -n app

kubectl get netpolService and network

List network policies; check them when pods cannot reach each other.

kubectl get netpol -n app

kubectl get svc web -o jsonpath="{.spec.clusterIP}"Service and network

Read the ClusterIP for configs or scripts.

kubectl get svc web -o jsonpath="{.spec.clusterIP}" -n app

kubectl get cmConfig and secrets

List ConfigMaps.

kubectl get cm -n app

kubectl create cm app-config --from-file=app.yamlConfig and secrets

Create a ConfigMap from a file.

kubectl create cm app-config --from-file=config/app.yaml -n app

kubectl describe cm app-configConfig and secrets

Show ConfigMap contents.

kubectl describe cm app-config -n app

kubectl get secretConfig and secrets

List secrets; values are base64-encoded, not encrypted.

kubectl get secret -n app

kubectl create secret generic db --from-literal=password=changeitConfig and secrets

Create a secret from literals.

kubectl create secret generic db --from-literal=password=changeit -n app

kubectl get secret db -o jsonpath="{.data.password}" | base64 -dConfig and secrets

Decode a secret value to debug a config that is not taking effect.

kubectl get secret db -o jsonpath="{.data.password}" -n app | base64 -d

kubectl get saConfig and secrets

List service accounts, the identity pods use to reach the API.

kubectl get sa -n app

kubectl auth can-i get pods --as=system:serviceaccount:app:webConfig and secrets

Check whether an identity has a permission; useful for RBAC debugging.

kubectl auth can-i get pods --as=system:serviceaccount:app:web -n app

kubectl get nodesNodes and scheduling

List nodes and their status.

kubectl get nodes -o wide

kubectl describe node <node>Nodes and scheduling

Show node details including allocated resources and taints.

kubectl describe node node-1

kubectl top nodesNodes and scheduling

Show real node usage; requires metrics-server.

kubectl top nodes

kubectl top podsNodes and scheduling

Show pod usage to find what is eating memory.

kubectl top pods -n app --sort-by=memory

kubectl cordon <node>Nodes and scheduling

Mark a node unschedulable without evicting existing pods.

kubectl cordon node-1

kubectl drain <node> --ignore-daemonsets --delete-emptydir-dataNodes and scheduling

Evict pods from a node before maintenance.

kubectl drain node-1 --ignore-daemonsets --delete-emptydir-data

kubectl uncordon <node>Nodes and scheduling

Make a node schedulable again.

kubectl uncordon node-1

kubectl taint nodes node-1 dedicated=gpu:NoScheduleNodes and scheduling

Taint a node so only tolerant pods land on it.

kubectl taint nodes node-1 dedicated=gpu:NoSchedule

kubectl get events --sort-by=.lastTimestampTroubleshooting

List events newest-first; cluster-level problems show up here.

kubectl get events --sort-by=.lastTimestamp -n app | tail -30

kubectl get events -wTroubleshooting

Watch the event stream while reproducing an issue.

kubectl get events -w -n app

kubectl get pod --field-selector=status.phase=FailedTroubleshooting

Filter for pods in a failed phase.

kubectl get pod --field-selector=status.phase=Failed -A

kubectl get pod <pod> -o jsonpath="{.status.conditions[?(@.type==\"Ready\")].reason}"Troubleshooting

Read the not-ready reason faster than scrolling describe.

kubectl get pod web-0 -o jsonpath="{.status.conditions[?(@.type==\"Ready\")].reason}" -n app

kubectl debug -it <pod> --image=busybox --target=appTroubleshooting

Inject an ephemeral container sharing the target process namespace.

kubectl debug -it web-0 --image=busybox:1.36 --target=app -n app

kubectl debug node/<node> -it --image=busyboxTroubleshooting

Start a debug pod on a node with access to the host filesystem.

kubectl debug node/node-1 -it --image=busybox:1.36

kubectl logs <pod> --all-containersTroubleshooting

Show logs from every container in a pod.

kubectl logs web-0 --all-containers --prefix -n app

kubectl wait --for=condition=Ready pod/web-0 --timeout=60sTroubleshooting

Wait until a pod is ready; useful as a script barrier.

kubectl wait --for=condition=Ready pod/web-0 --timeout=60s -n app

kubectl get pod web-0 -o json | jq .statusTroubleshooting

Pipe to jq for status fields when jsonpath gets unwieldy.

kubectl get pod web-0 -o json -n app | jq .status

kubectl get pod web-0 -o yaml --show-managed-fieldsTroubleshooting

See which controller last touched a field.

kubectl get pod web-0 -o yaml --show-managed-fields -n app

kubectl cluster-infoCluster and resources

Show the control plane address and add-on locations.

kubectl cluster-info

kubectl version --shortCluster and resources

Show client and server versions; mind the version skew.

kubectl version --short

kubectl apply --dry-run=server -f deploy.yamlCluster and resources

Server-side dry run: real validation without persisting.

kubectl apply --dry-run=server -f deploy.yaml -n app

kubectl diff -f deploy.yamlCluster and resources

Preview what apply would change before running it.

kubectl diff -f deploy.yaml -n app

kubectl get pv,pvcCluster and resources

List volumes and claims; Pending usually means a storage class issue.

kubectl get pv,pvc -n app

kubectl get hpaCluster and resources

Show autoscaler status and current metrics.

kubectl get hpa -n app

kubectl get crdCluster and resources

List custom resource definitions installed in the cluster.

kubectl get crd | head -30

kubectl api-resources --verbs=list --namespaced -o nameCluster and resources

List listable namespaced resources, handy for backup scripts.

kubectl api-resources --verbs=list --namespaced -o name

Something broken or missing?

Send feedback