cheatsheet · Anton Novikov

List all pods across namespaces kubectl

All pods with node placement and IPs

kubectl get pods -A -o wide

#pods

Describe a pod kubectl

Full details: events, conditions, volume mounts

kubectl describe pod <name> -n <ns>

#pods#debug

Follow pod logs kubectl

Stream logs in real time; add -c <container> for multi-container pods

kubectl logs -f <pod> -n <ns>

#logs#debug

Logs from previous container kubectl

Logs from the last crashed/restarted container instance

kubectl logs <pod> --previous -n <ns>

#logs#debug

Exec into pod kubectl

Interactive shell inside a running container

kubectl exec -it <pod> -n <ns> -- bash

#pods#debug

Port-forward a service kubectl

Tunnel a cluster service port to localhost

kubectl port-forward svc/<name> 8080:80 -n <ns>

#debug#network

Watch rollout status kubectl

Block until rollout completes or times out (use in CI)

kubectl rollout status deployment/<name> -n <ns>

#deployments

Rollback deployment kubectl

Revert to the previous revision

kubectl rollout undo deployment/<name> -n <ns>

#deployments

Scale deployment kubectl

Immediately change replica count

kubectl scale deployment/<name> --replicas=3 -n <ns>

#deployments

Get events sorted by time kubectl

Recent cluster events, oldest first — great for post-incident review

kubectl get events -A --sort-by='.lastTimestamp'

#debug

Server-side dry-run kubectl

Validate manifest against live API without applying changes

kubectl apply --server-side --dry-run=server -f file.yaml

#config

Export live resource as YAML kubectl

Current live state with managed fields stripped; useful as a base

kubectl get deployment/<name> -n <ns> -o yaml

#config

Force delete stuck pod kubectl

Remove a Terminating pod immediately (use with caution)

kubectl delete pod <name> -n <ns> --grace-period=0 --force

#pods#debug

Copy file from pod kubectl

Extract a file from a running container

kubectl cp <ns>/<pod>:/remote/path ./local-path

#debug

Cordon a node kubectl

Mark node as unschedulable — no new pods land here

kubectl cordon <node>

#nodes

Drain a node kubectl

Gracefully evict all pods before maintenance

kubectl drain <node> --ignore-daemonsets --delete-emptydir-data

#nodes

Edit a live resource kubectl

Open resource in $EDITOR; changes applied on save

kubectl edit deployment/<name> -n <ns>

#deployments#config

Verify RBAC permissions kubectl

Check what a ServiceAccount is allowed to do

kubectl auth can-i list pods --as=system:serviceaccount:<ns>:<sa> -n <ns>

#rbac#debug

Install chart with values file helm

Deploy a chart; creates namespace if it doesn't exist

helm install <release> <chart> -f values.yaml -n <ns> --create-namespace

#helm

Upgrade or install (idempotent) helm

Safe in CI — installs if absent, upgrades if present

helm upgrade --install <release> <chart> -f values.yaml -n <ns>

#helm

Diff before upgrade helm

Show exactly what will change (requires helm-diff plugin)

helm diff upgrade <release> <chart> -f values.yaml -n <ns>

#helm#debug

Render templates locally helm

Output rendered YAML to stdout without deploying

helm template <release> <chart> -f values.yaml --debug

#helm#debug

Show release values helm

All computed values for a deployed release

helm get values <release> -n <ns> --all

#helm

List all releases helm

All Helm releases across every namespace

helm list -A --output table

#helm

Rollback release to revision helm

Revert to a specific historical revision

helm rollback <release> <revision> -n <ns>

#helm

Uninstall a release helm

Remove release and all managed resources

helm uninstall <release> -n <ns>

#helm

Lint a chart helm

Validate chart structure and values; fails on warnings in --strict mode

helm lint <chart-dir> -f values.yaml --strict

#helm#debug

Check Flux health flux

Verify all Flux controllers are running and CRDs are installed

flux check

#flux

Get all Flux resources flux

Summary table: Kustomizations, HelmReleases, Sources — with sync status

flux get all -A

#flux

Force reconcile Kustomization flux

Trigger immediate git pull + apply

flux reconcile kustomization <name> --with-source -n <ns>

#flux

Force reconcile HelmRelease flux

Re-run Helm install/upgrade cycle immediately

flux reconcile helmrelease <name> --with-source -n <ns>

#flux

Trace a resource flux

Show which Flux objects own and manage this resource

flux trace <kind>/<name> -n <ns>

#flux#debug

Suspend reconciliation flux

Pause sync — useful while doing manual hotfixes

flux suspend kustomization <name> -n <ns>

#flux

Resume reconciliation flux

Re-enable a suspended Kustomization or HelmRelease

flux resume kustomization <name> -n <ns>

#flux

Export all Flux resources flux

Backup current Flux config as plain YAML for bootstrapping another cluster

flux export kustomization --all > clusters/cluster.yaml

#flux#config

Multi-platform build and push docker

Cross-compile and push directly to registry with BuildKit

docker buildx build --platform linux/amd64,linux/arm64 -t reg/img:tag --push .

#docker

Run container with env file docker

Local run with env vars from file; --rm auto-removes on exit

docker run --rm -it --env-file .env -p 8000:8000 img:tag

#docker

Inspect image layers docker

See each layer, its command, and size; identify bloat

docker history --no-trunc img:tag

#docker#debug

Prune everything unused docker

Remove stopped containers, unused images, networks, volumes

docker system prune -af --volumes

#docker

Copy image between registries docker

Re-tag and push to another registry

docker pull src-reg/img:tag && docker tag src-reg/img:tag dst-reg/img:tag && docker push dst-reg/img:tag

#docker

Save image to tarball docker

Export an image for air-gapped transfer

docker save img:tag | gzip > img.tar.gz

#docker

Plan with var file terraform

Show changes; save plan artifact for CI gating

terraform plan -var-file=prod.tfvars -out=plan.tfplan

#terraform

Apply a saved plan terraform

Apply exactly the previously generated plan — no interactive prompts

terraform apply plan.tfplan

#terraform

Import existing resource terraform

Bring an already-existing resource under Terraform control

terraform import module.path.resource_type.name <remote-id>

#terraform

Show state for a resource terraform

Inspect Terraform state attributes for a single resource

terraform state show module.path.resource_type.name

#terraform

Move resource in state terraform

Rename/reorganize resource without destroying and recreating it

terraform state mv old.address new.address

#terraform

Ephemeral debug container k8s-debug

Attach a debug container (netshoot) to a running pod — shares PID/net namespaces

kubectl debug -it <pod> --image=nicolaka/netshoot -n <ns>

#debug#network#pods

Node resource usage k8s-debug

CPU and memory per node (requires metrics-server)

kubectl top nodes

#nodes#monitoring

Pod resource usage sorted k8s-debug

Memory-sorted pod usage across all namespaces — find the hungry ones

kubectl top pods -A --sort-by=memory

#pods#monitoring

Check what's in a ConfigMap k8s-debug

Print just the data field; pipe to python -m json.tool for formatting

kubectl get cm <name> -n <ns> -o jsonpath='{.data}'

#config#debug

Decode a Secret k8s-debug

Dump and base64-decode all fields in a k8s Secret

kubectl get secret <name> -n <ns> -o jsonpath='{.data}' | python3 -c "import sys,json,base64; [print(k,'=',base64.b64decode(v).decode()) for k,v in json.load(sys.stdin).items()]"

#secrets#debug

List all resources in namespace k8s-debug

Enumerate every resource type in a namespace — useful for auditing

kubectl api-resources --verbs=list --namespaced -o name | xargs -I{} kubectl get {} -n <ns> --ignore-not-found

#debug

JSONPath on any resource k8s-debug

Extract specific fields from k8s API objects without jq

kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}\t{.metadata.name}\t{.status.phase}\n{end}'

#debug#pods

Get resource with custom columns kubectl

Print only the fields you care about without jq

kubectl get pods -n <ns> -o custom-columns='NAME:.metadata.name,NODE:.spec.nodeName,STATUS:.status.phase'

#pods

Patch resource field kubectl

Inline JSON patch without editing the whole manifest

kubectl patch deployment <name> -n <ns> -p '{"spec":{"replicas":2}}'

#deployments#config

Annotate resource kubectl

Set or update an annotation; --overwrite replaces existing value

kubectl annotate pod <pod> -n <ns> key=value --overwrite

#config

Label resource kubectl

Add or change a label on any resource

kubectl label node <node> role=worker --overwrite

#nodes#config

Add taint to node kubectl

Prevent pods without matching toleration from scheduling on node

kubectl taint nodes <node> key=value:NoSchedule

#nodes

Remove taint from node kubectl

Remove a taint by appending a dash at the end

kubectl taint nodes <node> key=value:NoSchedule-

#nodes

Set image on deployment kubectl

Rolling-update the container image without editing YAML

kubectl set image deployment/<name> <container>=image:tag -n <ns>

#deployments

devops cheatsheet