DevOps cheatsheet

Commands 1,661 shown

• List all pods across namespaceskubectl
  kubectl get pods -A -o widecopy

  All pods with node placement and IPs

  pods

• Describe a podkubectl
  kubectl describe pod <name> -n <ns>copy

  Full details: events, conditions, volume mounts

  pods·debug

• Follow pod logskubectl
  kubectl logs -f <pod> -n <ns>copy

  Stream logs in real time; add -c <container> for multi-container pods

  logs·debug

• Logs from previous containerkubectl
  kubectl logs <pod> --previous -n <ns>copy

  Logs from the last crashed/restarted container instance

  logs·debug

• Exec into podkubectl
  kubectl exec -it <pod> -n <ns> -- bashcopy

  Interactive shell inside a running container

  pods·debug

• Port-forward a servicekubectl
  kubectl port-forward svc/<name> 8080:80 -n <ns>copy

  Tunnel a cluster service port to localhost

  debug·network

• Watch rollout statuskubectl
  kubectl rollout status deployment/<name> -n <ns>copy

  Block until rollout completes or times out (use in CI)

  deployments

• Rollback deploymentkubectl
  kubectl rollout undo deployment/<name> -n <ns>copy

  Revert to the previous revision

  deployments

• Scale deploymentkubectl
  kubectl scale deployment/<name> --replicas=3 -n <ns>copy

  Immediately change replica count

  deployments

• Get events sorted by timekubectl
  kubectl get events -A --sort-by='.lastTimestamp'copy

  Recent cluster events, oldest first — great for post-incident review

  debug

• Server-side dry-runkubectl
  kubectl apply --server-side --dry-run=server -f file.yamlcopy

  Validate manifest against live API without applying changes

  config

• Export live resource as YAMLkubectl
  kubectl get deployment/<name> -n <ns> -o yamlcopy

  Current live state with managed fields stripped; useful as a base

  config

• Force delete stuck podkubectl
  kubectl delete pod <name> -n <ns> --grace-period=0 --forcecopy

  Remove a Terminating pod immediately (use with caution)

  pods·debug

• Copy file from podkubectl
  kubectl cp <ns>/<pod>:/remote/path ./local-pathcopy

  Extract a file from a running container

  debug

• Cordon a nodekubectl
  kubectl cordon <node>copy

  Mark node as unschedulable — no new pods land here

  nodes

• Drain a nodekubectl
  kubectl drain <node> --ignore-daemonsets --delete-emptydir-datacopy

  Gracefully evict all pods before maintenance

  nodes

• Edit a live resourcekubectl
  kubectl edit deployment/<name> -n <ns>copy

  Open resource in $EDITOR; changes applied on save

  deployments·config

• Verify RBAC permissionskubectl
  kubectl auth can-i list pods --as=system:serviceaccount:<ns>:<sa> -n <ns>copy

  Check what a ServiceAccount is allowed to do

  rbac·debug

• Install chart with values filehelm
  helm install <release> <chart> -f values.yaml -n <ns> --create-namespacecopy

  Deploy a chart; creates namespace if it doesn't exist

• Upgrade or install (idempotent)helm
  helm upgrade --install <release> <chart> -f values.yaml -n <ns>copy

  Safe in CI — installs if absent, upgrades if present

• Diff before upgradehelm
  helm diff upgrade <release> <chart> -f values.yaml -n <ns>copy

  Show exactly what will change (requires helm-diff plugin)

  debug

• Render templates locallyhelm
  helm template <release> <chart> -f values.yaml --debugcopy

  Output rendered YAML to stdout without deploying

  debug

• Show release valueshelm
  helm get values <release> -n <ns> --allcopy

  All computed values for a deployed release

• List all releaseshelm
  helm list -A --output tablecopy

  All Helm releases across every namespace

• Rollback release to revisionhelm
  helm rollback <release> <revision> -n <ns>copy

  Revert to a specific historical revision

• Uninstall a releasehelm
  helm uninstall <release> -n <ns>copy

  Remove release and all managed resources

• Lint a charthelm
  helm lint <chart-dir> -f values.yaml --strictcopy

  Validate chart structure and values; fails on warnings in --strict mode

  debug

• Check Flux healthflux
  flux checkcopy

  Verify all Flux controllers are running and CRDs are installed

• Get all Flux resourcesflux
  flux get all -Acopy

  Summary table: Kustomizations, HelmReleases, Sources — with sync status

• Force reconcile Kustomizationflux
  flux reconcile kustomization <name> --with-source -n <ns>copy

  Trigger immediate git pull + apply

• Force reconcile HelmReleaseflux
  flux reconcile helmrelease <name> --with-source -n <ns>copy

  Re-run Helm install/upgrade cycle immediately

• Trace a resourceflux
  flux trace <kind>/<name> -n <ns>copy

  Show which Flux objects own and manage this resource

  debug

• Suspend reconciliationflux
  flux suspend kustomization <name> -n <ns>copy

  Pause sync — useful while doing manual hotfixes

• Resume reconciliationflux
  flux resume kustomization <name> -n <ns>copy

  Re-enable a suspended Kustomization or HelmRelease

• Export all Flux resourcesflux
  flux export kustomization --all > clusters/cluster.yamlcopy

  Backup current Flux config as plain YAML for bootstrapping another cluster

  config

• Multi-platform build and pushdocker
  docker buildx build --platform linux/amd64,linux/arm64 -t reg/img:tag --push .copy

  Cross-compile and push directly to registry with BuildKit

• Run container with env filedocker
  docker run --rm -it --env-file .env -p 8000:8000 img:tagcopy

  Local run with env vars from file; --rm auto-removes on exit

• Inspect image layersdocker
  docker history --no-trunc img:tagcopy

  See each layer, its command, and size; identify bloat

  debug

• Prune everything unuseddocker
  docker system prune -af --volumescopy

  Remove stopped containers, unused images, networks, volumes

• Copy image between registriesdocker
  docker pull src-reg/img:tag && docker tag src-reg/img:tag dst-reg/img:tag && docker push dst-reg/img:tagcopy

  Re-tag and push to another registry

• Save image to tarballdocker
  docker save img:tag | gzip > img.tar.gzcopy

  Export an image for air-gapped transfer

• Plan with var fileterraform
  terraform plan -var-file=prod.tfvars -out=plan.tfplancopy

  Show changes; save plan artifact for CI gating

• Apply a saved planterraform
  terraform apply plan.tfplancopy

  Apply exactly the previously generated plan — no interactive prompts

• Import existing resourceterraform
  terraform import module.path.resource_type.name <remote-id>copy

  Bring an already-existing resource under Terraform control

• Show state for a resourceterraform
  terraform state show module.path.resource_type.namecopy

  Inspect Terraform state attributes for a single resource

• Move resource in stateterraform
  terraform state mv old.address new.addresscopy

  Rename/reorganize resource without destroying and recreating it

• Ephemeral debug containerk8s-debug
  kubectl debug -it <pod> --image=nicolaka/netshoot -n <ns>copy

  Attach a debug container (netshoot) to a running pod — shares PID/net namespaces

  debug·network·pods

• Node resource usagek8s-debug
  kubectl top nodescopy

  CPU and memory per node (requires metrics-server)

  nodes·monitoring

• Pod resource usage sortedk8s-debug
  kubectl top pods -A --sort-by=memorycopy

  Memory-sorted pod usage across all namespaces — find the hungry ones

  pods·monitoring

• Check what's in a ConfigMapk8s-debug
  kubectl get cm <name> -n <ns> -o jsonpath='{.data}'copy

  Print just the data field; pipe to python -m json.tool for formatting

  config·debug

• Decode a Secretk8s-debug
  kubectl get secret <name> -n <ns> -o jsonpath='{.data}' | python3 -c "import sys,json,base64; [print(k,'=',base64.b64decode(v).decode()) for k,v in json.load(sys.stdin).items()]"copy

  Dump and base64-decode all fields in a k8s Secret

  secrets·debug

• List all resources in namespacek8s-debug
  kubectl api-resources --verbs=list --namespaced -o name | xargs -I{} kubectl get {} -n <ns> --ignore-not-foundcopy

  Enumerate every resource type in a namespace — useful for auditing

  debug

• JSONPath on any resourcek8s-debug
  kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}\t{.metadata.name}\t{.status.phase}\n{end}'copy

  Extract specific fields from k8s API objects without jq

  debug·pods

• Get resource with custom columnskubectl
  kubectl get pods -n <ns> -o custom-columns='NAME:.metadata.name,NODE:.spec.nodeName,STATUS:.status.phase'copy

  Print only the fields you care about without jq

  pods

• Patch resource fieldkubectl
  kubectl patch deployment <name> -n <ns> -p '{"spec":{"replicas":2}}'copy

  Inline JSON patch without editing the whole manifest

  deployments·config

• Annotate resourcekubectl
  kubectl annotate pod <pod> -n <ns> key=value --overwritecopy

  Set or update an annotation; --overwrite replaces existing value

  config

• Label resourcekubectl
  kubectl label node <node> role=worker --overwritecopy

  Add or change a label on any resource

  nodes·config

• Add taint to nodekubectl
  kubectl taint nodes <node> key=value:NoSchedulecopy

  Prevent pods without matching toleration from scheduling on node

  nodes

• Remove taint from nodekubectl
  kubectl taint nodes <node> key=value:NoSchedule-copy

  Remove a taint by appending a dash at the end

  nodes

• Set image on deploymentkubectl
  kubectl set image deployment/<name> <container>=image:tag -n <ns>copy

  Rolling-update the container image without editing YAML

  deployments