Kubernetes & Kubectl Cheat Sheet

kubectl get pods -A -o wide

Lists all running and pending pods across every cluster namespace, including assigned node names and internal Pod IPs.

kubectl logs -f <pod-name> -c <container-name> --tail=100

Follows real-time standard output and error streams from a designated container inside a multi-container pod.

kubectl exec -it <pod-name> -n <namespace> -- /bin/sh

Spawns an interactive pseudo-TTY session inside the pod. Use /bin/bash for Debian/Ubuntu or /bin/sh for Alpine.

kubectl port-forward pod/<pod-name> 8080:80

Bypasses ingress and services to bind host port 8080 directly to container port 80 for local testing.

kubectl describe pod <pod-name> -n <namespace>

Inspects scheduling events, CrashLoopBackOff states, OOMKilled codes, and readiness/liveness probe failures.

kubectl delete pod <pod-name> --grace-period=0 --force

Immediately deletes a pod stuck in Terminating status without waiting for kubelet confirmation.

kubectl rollout restart deployment/<deployment-name> -n <namespace>

Triggers a zero-downtime rolling restart of all pods by updating the deployment's pod template annotation.

kubectl scale deployment/<deployment-name> --replicas=5 -n <namespace>

Adjusts the desired number of running pod instances to 5 without altering configuration YAML files.

kubectl rollout status deployment/<deployment-name>

Blocks terminal until all new pods reach Ready status or reports deployment failure/timeout.

kubectl rollout undo deployment/<deployment-name>

Reverts the deployment and its ReplicaSet to the previous successful revision.

kubectl rollout history deployment/<deployment-name>

Inspects recorded revision history numbers and change-cause annotations.

kubectl get svc -A

Displays all internal ClusterIPs, NodePorts, external LoadBalancers, and target ports across all namespaces.

kubectl port-forward svc/<service-name> 8080:80 -n <namespace>

Forwards traffic from local port 8080 directly to the service's load-balanced target endpoints.

kubectl get endpoints <service-name> -n <namespace>

Shows the exact pod IP addresses currently healthy and receiving traffic from the service.

kubectl get ingress -A

Displays configured hostnames, TLS terminations, path routing, and ingress controller IP addresses.

kubectl create configmap app-config --from-literal=ENV=production --from-literal=PORT=8080

Generates an in-cluster configuration map without authoring raw YAML documents.

kubectl create secret generic api-secrets --from-literal=API_KEY='secret123'

Encodes and stores sensitive credentials safely in base64 within cluster etcd.

kubectl get secret <secret-name> -o json | jq '.data | map_values(@base64d)'

Fetches secret object JSON and decodes all base64-encoded fields into plaintext directly in your terminal.

kubectl get deployment <name> -o yaml | kubectl neat

Exports clean Kubernetes YAML stripped of status, creationTimestamp, resourceVersion, and uid metadata.

kubectl config set-context --current --namespace=<namespace>

Switches default namespace context so subsequent kubectl commands do not require typing -n <namespace>.

kubectl config use-context <cluster-context-name>

Switches active kubeconfig target between production, staging, and local minikube/kind clusters.

kubectl config get-contexts

Displays all configured cluster endpoints, users, namespaces, and indicates current active context with an asterisk (*).

kubectl top nodes

Outputs live CPU (cores and %) and memory usage across all worker and control-plane nodes (requires Metrics Server).

kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data

Evicts all pods safely from a node so it can be upgraded or decommissioned without breaking service uptime.

kubectl cordon <node-name> && kubectl uncordon <node-name>

Marks a node as unschedulable (preventing new pods) or removes unschedulable restriction.

kubectl run test-dns --rm -it --image=curlimages/curl -- /bin/sh

Spawns an ephemeral container that cleans itself up upon exit (--rm) to verify internal cluster DNS and curl endpoints.

kubectl debug -it <pod-name> --image=nicolaka/netshoot --target=<container-name>

Injects a network diagnostic container (tcpdump, nmap, curl, dig) into an existing pod's network namespace.

kubectl apply -f manifest.yaml --dry-run=server

Submits manifest to API server admission controllers and webhooks without persisting to etcd database.

kubectl explain deployment.spec.template.spec.containers.resources

Displays built-in API reference and field explanations directly in your CLI terminal.