kubectl commands

73 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 73 shown

  • List all pods across namespaces
    kubectl get pods -A -o wide

    All pods with node placement and IPs

    pods

  • Describe a pod
    kubectl describe pod <name> -n <ns>

    Full details: events, conditions, volume mounts

    pods · debug

  • Follow pod logs
    kubectl logs -f <pod> -n <ns>

    Stream logs in real time; add -c <container> for multi-container pods

    logs · debug

  • Logs from previous container
    kubectl logs <pod> --previous -n <ns>

    Logs from the last crashed/restarted container instance

    logs · debug

  • Exec into pod
    kubectl exec -it <pod> -n <ns> -- bash

    Interactive shell inside a running container

    pods · debug

  • Port-forward a service
    kubectl port-forward svc/<name> 8080:80 -n <ns>

    Tunnel a cluster service port to localhost

    debug · network

  • Watch rollout status
    kubectl rollout status deployment/<name> -n <ns>

    Block until rollout completes or times out (use in CI)

    deployments

  • Rollback deployment
    kubectl rollout undo deployment/<name> -n <ns>

    Revert to the previous revision

    deployments

  • Scale deployment
    kubectl scale deployment/<name> --replicas=3 -n <ns>

    Immediately change replica count

    deployments

  • Get events sorted by time
    kubectl get events -A --sort-by='.lastTimestamp'

    Recent cluster events, oldest first — great for post-incident review

    debug

  • Server-side dry-run
    kubectl apply --server-side --dry-run=server -f file.yaml

    Validate manifest against live API without applying changes

    config

  • Export live resource as YAML
    kubectl get deployment/<name> -n <ns> -o yaml

    Current live state with managed fields stripped; useful as a base

    config

  • Force delete stuck pod
    kubectl delete pod <name> -n <ns> --grace-period=0 --force

    Remove a Terminating pod immediately (use with caution)

    pods · debug

  • Copy file from pod
    kubectl cp <ns>/<pod>:/remote/path ./local-path

    Extract a file from a running container

    debug

  • Cordon a node
    kubectl cordon <node>

    Mark node as unschedulable — no new pods land here

    nodes

  • Drain a node
    kubectl drain <node> --ignore-daemonsets --delete-emptydir-data

    Gracefully evict all pods before maintenance

    nodes

  • Edit a live resource
    kubectl edit deployment/<name> -n <ns>

    Open resource in $EDITOR; changes applied on save

    deployments · config

  • Verify RBAC permissions
    kubectl auth can-i list pods --as=system:serviceaccount:<ns>:<sa> -n <ns>

    Check what a ServiceAccount is allowed to do

    rbac · debug

  • Get resource with custom columns
    kubectl get pods -n <ns> -o custom-columns='NAME:.metadata.name,NODE:.spec.nodeName,STATUS:.status.phase'

    Print only the fields you care about without jq

    pods

  • Patch resource field
    kubectl patch deployment <name> -n <ns> -p '{"spec":{"replicas":2}}'

    Inline JSON patch without editing the whole manifest

    deployments · config

  • Annotate resource
    kubectl annotate pod <pod> -n <ns> key=value --overwrite

    Set or update an annotation; --overwrite replaces existing value

    config

  • Label resource
    kubectl label node <node> role=worker --overwrite

    Add or change a label on any resource

    nodes · config

  • Add taint to node
    kubectl taint nodes <node> key=value:NoSchedule

    Prevent pods without matching toleration from scheduling on node

    nodes

  • Remove taint from node
    kubectl taint nodes <node> key=value:NoSchedule-

    Remove a taint by appending a dash at the end

    nodes

  • Set image on deployment
    kubectl set image deployment/<name> <container>=image:tag -n <ns>

    Rolling-update the container image without editing YAML

    deployments

  • List rollout history
    kubectl rollout history deployment/<name> -n <ns>

    Show all revisions with change cause (requires --record or annotations)

    deployments

  • Restart deployment (rolling)
    kubectl rollout restart deployment/<name> -n <ns>

    Trigger zero-downtime pod rotation without changing spec

    deployments

  • Create namespace
    kubectl create namespace <ns>

    Create a new namespace; idempotent with --dry-run=client | apply

    config

  • Set resource requests/limits
    kubectl set resources deployment/<name> -c <container> --requests=cpu=100m,memory=128Mi --limits=cpu=500m,memory=512Mi -n <ns>

    Update resource requests and limits on a running deployment

    deployments · config

  • Run one-off pod
    kubectl run tmp --image=nicolaka/netshoot -it --rm --restart=Never -n <ns> -- bash

    Ephemeral pod for debugging; deleted on exit

    debug · pods

  • Get node labels
    kubectl get nodes --show-labels

    See all labels assigned to each node

    nodes

  • Uncordon a node
    kubectl uncordon <node>

    Re-enable scheduling on a previously cordoned node

    nodes

  • Get HPA status
    kubectl get hpa -A

    Horizontal Pod Autoscaler current/desired replicas and metrics

    deployments · monitoring

  • View resource quotas
    kubectl describe resourcequota -n <ns>

    Used vs hard limits for CPU, memory, object counts in namespace

    config

  • Get PodDisruptionBudget
    kubectl get pdb -A

    Show min-available and current healthy pod counts

    deployments

  • View LimitRange
    kubectl describe limitrange -n <ns>

    Default and max resource limits applied to pods in namespace

    config

  • Get all CRDs
    kubectl get crds --sort-by='.metadata.creationTimestamp'

    List all Custom Resource Definitions sorted by creation time

    config · debug

  • Get service endpoints
    kubectl get endpoints <svc> -n <ns>

    Show pod IPs backing a Service — diagnose selector mismatch

    network · debug

  • Check certificate expiry (cert-manager)
    kubectl get certificate -A -o wide

    See cert-manager Certificate ready status and expiry dates

    network · debug

  • View pod topology spread
    kubectl get pod <pod> -n <ns> -o jsonpath='{.spec.topologySpreadConstraints}'

    Inspect topology spread constraints on a pod

    pods · config

  • Apply with prune
    kubectl apply -f ./dir/ --prune -l app=<label> -n <ns>

    Apply manifests and remove stale objects matching the label selector

    config

  • Diff live vs local
    kubectl diff -f file.yaml

    Show what would change if you applied this manifest now

    config · debug

  • Exec command in all pods
    kubectl get pods -n <ns> -l app=<label> -o name | xargs -I{} kubectl exec {} -n <ns> -- <cmd>

    Run a command in every pod matching a label selector

    pods · debug

  • Watch pod status changes
    kubectl get pods -n <ns> -w

    Live-refresh pod list as statuses change

    pods · debug

  • Top pods by CPU
    kubectl top pods -A --sort-by=cpu

    CPU-sorted pod usage across all namespaces

    pods · monitoring

  • Create ServiceAccount token
    kubectl create token <sa-name> -n <ns> --duration=1h

    Generate a short-lived bound service account token

    rbac · config

  • Check who can do what (audit)
    kubectl auth can-i --list -n <ns>

    Show all permissions the current user has in a namespace

    rbac · debug

  • Delete all pods in namespace
    kubectl delete pods --all -n <ns>

    Force recreation of all pods — useful after ConfigMap changes

    pods

  • Get ingress list
    kubectl get ingress -A

    All Ingress resources with hosts and addresses

    network

  • Dump all pod YAML to file
    kubectl get pods -n <ns> -o yaml > pods-dump.yaml

    Backup/inspect entire pod state in a namespace

    debug · pods

  • Jsonpath — all container images
    kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{range .spec.containers[*]}{.image}{"\n"}{end}{end}'

    Enumerate every container image running in the cluster

    debug · pods

  • Switch kubeconfig context
    kubectl config use-context <context>

    Switch the active cluster context

    config

  • List kubeconfig contexts
    kubectl config get-contexts

    Show all contexts in current kubeconfig

    config

  • Merge kubeconfigs
    KUBECONFIG=~/.kube/config:~/.kube/cluster2.yaml kubectl config view --flatten > ~/.kube/merged.yaml

    Combine multiple kubeconfig files into one

    config

  • Set default namespace for context
    kubectl config set-context --current --namespace=<ns>

    Avoid typing -n on every command for this context

    config

  • Get cluster info
    kubectl cluster-info

    Show API server and CoreDNS endpoints

    debug · config

  • Get node conditions
    kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{": "}{range .status.conditions[*]}{.type}={.status},{" "}{end}{"\n"}{end}'

    Show all conditions per node (Ready, MemoryPressure, DiskPressure)

    nodes · debug

  • Trigger CronJob manually
    kubectl create job --from=cronjob/<name> manual-run -n <ns>

    Immediately run a CronJob as a one-off Job

    config · debug

  • Wait for pod ready
    kubectl wait pod -l app=<label> -n <ns> --for=condition=Ready --timeout=120s

    Block until matching pods are Ready or timeout

    pods · config

  • Scrape apiserver metrics endpoint
    kubectl get --raw /metrics | grep apiserver_request_total

    Pull raw Prometheus metrics from the apiserver without a metrics stack

    metrics · observability · performance

  • Check etcd health via apiserver
    kubectl get --raw '/healthz/etcd?verbose'

    Verify etcd connectivity through the apiserver health endpoint

    etcd · troubleshooting · k8s

  • Node metrics from metrics.k8s.io API
    kubectl get --raw '/apis/metrics.k8s.io/v1beta1/nodes' | jq '.items[] | {name:.metadata.name, cpu:.usage.cpu, mem:.usage.memory}'

    Raw node usage from metrics API; bypasses kubectl top formatting

    metrics · monitoring · performance

  • Ephemeral debug copy with shared PIDs
    kubectl debug <pod> -n <ns> --copy-to=<pod>-dbg --share-processes --image=nicolaka/netshoot -- sleep infinity

    Clone pod with a debug container sharing the PID namespace; original stays untouched

    debug · troubleshooting · k8s

  • Explain deployment spec recursively
    kubectl explain deploy.spec --recursive | less

    Dump the full nested field tree of a resource spec; great for hunting valid fields

    k8s · troubleshooting

  • Pause and resume a rollout
    kubectl rollout pause deploy/<name> -n <ns>; kubectl rollout resume deploy/<name> -n <ns>

    Batch multiple edits without triggering rollouts, then resume to apply once

    gitops · k8s

  • View last applied configuration
    kubectl apply view-last-applied deploy/<name> -n <ns> -o yaml

    Show the last-applied-configuration annotation; diff intent vs live state

    gitops · troubleshooting

  • Warning events across all namespaces
    kubectl get events -A --field-selector type=Warning --sort-by=.lastTimestamp

    Cluster-wide Warning events newest last; fast triage of failing workloads

    troubleshooting · monitoring · debug

  • Find all failed pods cluster-wide
    kubectl get pods -A --field-selector status.phase=Failed

    List pods in Failed phase across namespaces for cleanup or investigation

    troubleshooting · debug · k8s

  • Wait on a jsonpath condition
    kubectl wait --for=jsonpath='{.status.loadBalancer.ingress[0].ip}' svc/<name> -n <ns> --timeout=120s

    Block in CI until a Service gets its external IP; works on any jsonpath field

    ci · gitops · k8s

  • Impersonate a user and group
    kubectl auth can-i list secrets -n <ns> --as=<name> --as-group=system:serviceaccounts

    Test RBAC as another identity without their kubeconfig; needs impersonate verb

    security · troubleshooting · k8s

  • Sort pods by container restart count
    kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.status.containerStatuses[0].restartCount}{"\n"}{end}' | sort -k3 -rn | head

    Surface the most-restarting pods to catch crashloops fast

    troubleshooting · debug · monitoring

  • Compare node allocatable vs capacity
    kubectl get nodes -o json | jq -r '.items[] | {node:.metadata.name, capCPU:.status.capacity.cpu, allocCPU:.status.allocatable.cpu, capMem:.status.capacity.memory, allocMem:.status.allocatable.memory}'

    Show reserved overhead per node; gap = kube/system reservations

    performance · monitoring · k8s

  • ConfigMap from env-file with patch op
    kubectl create configmap <name> --from-env-file=app.env -n <ns> --dry-run=client -o yaml | kubectl apply -f -; kubectl patch deploy/<name> -n <ns> --type=json -p='[{"op":"add","path":"/spec/template/spec/containers/0/envFrom/-","value":{"configMapRef":{"name":"<name>"}}}]'

    Build a CM from KEY=VALUE file, then JSON-patch it into a container's envFrom

    secrets · gitops · k8s