k8s-debug commands

27 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 27 shown

  • Ephemeral debug container
    kubectl debug -it <pod> --image=nicolaka/netshoot -n <ns>

    Attach a debug container (netshoot) to a running pod — shares PID/net namespaces

    debug · network · pods

  • Node resource usage
    kubectl top nodes

    CPU and memory per node (requires metrics-server)

    nodes · monitoring

  • Pod resource usage sorted
    kubectl top pods -A --sort-by=memory

    Memory-sorted pod usage across all namespaces — find the hungry ones

    pods · monitoring

  • Check what's in a ConfigMap
    kubectl get cm <name> -n <ns> -o jsonpath='{.data}'

    Print just the data field; pipe to python -m json.tool for formatting

    config · debug

  • Decode a Secret
    kubectl get secret <name> -n <ns> -o jsonpath='{.data}' | python3 -c "import sys,json,base64; [print(k,'=',base64.b64decode(v).decode()) for k,v in json.load(sys.stdin).items()]"

    Dump and base64-decode all fields in a k8s Secret

    secrets · debug

  • List all resources in namespace
    kubectl api-resources --verbs=list --namespaced -o name | xargs -I{} kubectl get {} -n <ns> --ignore-not-found

    Enumerate every resource type in a namespace — useful for auditing

    debug

  • JSONPath on any resource
    kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}\t{.metadata.name}\t{.status.phase}\n{end}'

    Extract specific fields from k8s API objects without jq

    debug · pods

  • Debug pod with ephemeral container
    kubectl debug -it mypod --image=busybox --target=app

    Attach an ephemeral debug container to a running pod

    kubectl

  • Run debug pod on node
    kubectl debug node/my-node -it --image=ubuntu

    Get privileged shell on a cluster node via debug pod

    kubectl

  • Exec into sidecar container
    kubectl exec -it mypod -c sidecar-name -- /bin/sh

    Open shell in a specific container of a multi-container pod

    kubectl

  • Check resource requests/limits
    kubectl get pod mypod -o jsonpath='{range .spec.containers[*]}{.name}{"\t"}{.resources}{"\n"}{end}'

    Show resource requests and limits for each container

    kubectl

  • Describe node conditions
    kubectl describe node my-node | grep -A5 'Conditions:'

    Check node conditions: Ready, MemoryPressure, DiskPressure

    kubectl

  • Find pods by resource usage
    kubectl top pods -A --sort-by=memory | head -20

    Top 20 pods sorted by memory consumption

    kubectl · monitoring

  • Watch pod events
    kubectl get events -n mynamespace --field-selector involvedObject.name=mypod --watch

    Stream events for a specific pod

    kubectl

  • Copy file from pod
    kubectl cp mynamespace/mypod:/var/log/app.log ./app.log

    Download a file from a running container

    kubectl

  • Top pods by restart count
    kubectl get po -A --sort-by='.status.containerStatuses[0].restartCount' | tail -20

    Rank pods cluster-wide by restart count to spot crash loops fast

    troubleshooting · k8s · observability

  • Detect OOMKilled containers
    kubectl get po -A -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{" "}{.status.containerStatuses[*].lastState.terminated.reason}{"\n"}{end}' | grep OOMKilled

    List pods whose last container exit was OOMKilled across all namespaces

    troubleshooting · performance · k8s

  • Pending pods scheduling reason
    kubectl get po -A --field-selector=status.phase=Pending -o name | xargs -I{} kubectl describe {} -n <ns> | grep -A3 FailedScheduling

    Extract FailedScheduling reasons for every Pending pod (taints, resources, affinity)

    troubleshooting · k8s · performance

  • Node NotReady triage
    kubectl describe node <node> | grep -A12 Conditions; ssh <node> 'journalctl -u kubelet -n 100 --no-pager'

    Read node Conditions then tail kubelet journal to find why node is NotReady

    troubleshooting · k8s · kernel

  • ImagePullBackOff root cause
    kubectl get events -n <ns> --field-selector reason=Failed -o wide | grep -i 'pull\|manifest\|unauthorized'

    Surface registry pull failures: bad tag, missing imagePullSecret, or rate limit

    troubleshooting · k8s · security

  • Cleanup evicted pods
    kubectl get po -A | grep Evicted | awk '{print $2" -n "$1}' | xargs -L1 kubectl delete po

    Bulk-delete all Evicted pods left behind by node-pressure eviction

    troubleshooting · k8s · disk

  • Force-remove stuck Terminating pod
    kubectl patch po <pod> -n <ns> -p '{"metadata":{"finalizers":null}}' --type=merge; kubectl delete po <pod> -n <ns> --grace-period=0 --force

    Clear finalizers to unstick a pod hung in Terminating; note: confirm node is gone first

    troubleshooting · k8s

  • Raw kubelet stats summary
    kubectl get --raw /api/v1/nodes/<node>/proxy/stats/summary | jq '.pods[] | {name:.podRef.name, mem:.memory.workingSetBytes}'

    Pull live per-pod memory from kubelet Summary API, bypassing metrics-server

    monitoring · performance · k8s

  • Conntrack stats on node
    kubectl debug node/<node> -it --image=nicolaka/netshoot -- conntrack -S

    Check per-CPU conntrack drops/insert_failed; nf_conntrack table exhaustion drops packets

    network · troubleshooting · kernel

  • In-cluster DNS resolution test
    kubectl run dnstest --rm -it --image=nicolaka/netshoot --restart=Never -- dig +short <name>.<ns>.svc.cluster.local

    Resolve a Service FQDN from an ephemeral pod to isolate CoreDNS vs app DNS issues

    dns · network · troubleshooting

  • Ordered events for a pod
    kubectl events --for pod/<pod> -n <ns> --types=Warning

    Stream only Warning events scoped to one pod in chronological order; modern: replaces get events filter

    troubleshooting · observability · k8s

  • Previous crash logs with timestamps
    kubectl logs <pod> -n <ns> -c <name> --previous --timestamps --tail=200

    Tail the crashed container's prior instance logs to catch the pre-restart stack trace

    troubleshooting · debug · k8s