Kubernetes cheatsheet
Searchable reference of kubectl commands for pods, deployments, services, logs and debugging.
142 of 142 commands
| Section | Command | Description |
|---|---|---|
| Config & context | kubectl config get-contexts | List contexts in your kubeconfig; the current one is marked with *. |
| Config & context | kubectl config current-context | Print the current context. |
| Config & context | kubectl config use-context <context> | Switch to another cluster or user. |
| Config & context | kubectl config set-context --current --namespace=<namespace> | Change the default namespace of the context. |
| Config & context | kubectl config view --minify | Show only the configuration of the current context. |
| Config & context | kubectl config rename-context <old> <new> | Rename a context. |
| Config & context | kubectl config delete-context <context> | Remove a context from the kubeconfig. |
| Config & context | KUBECONFIG=<file1>:<file2> kubectl config view --flatten > <merged> | Merge several kubeconfig files into one. |
| Config & context | kubectl --context <context> get pods | Run one command against another context. |
| Config & context | kubectl cluster-info | Show the API server and core service addresses. |
| Config & context | kubectl version | Client and server versions. |
| Config & context | kubectl api-resources | List resource types with their short names and API groups. |
| Config & context | kubectl explain <resource>.spec | Document the fields of a resource, e.g. pod.spec.containers. |
| Config & context | kubectl explain deployment --recursive | Show the full field tree of a resource. |
| Config & context | source <(kubectl completion bash) | Enable shell completion (also zsh, fish, powershell). |
| Get & describe | kubectl get pods | List pods in the current namespace. |
| Get & describe | kubectl get pods -A | List pods in every namespace. |
| Get & describe | kubectl get pods -n <namespace> | List pods in a given namespace. |
| Get & describe | kubectl get pods -o wide | Include node, pod IP and more columns. |
| Get & describe | kubectl get pods -w | Watch for changes. |
| Get & describe | kubectl get all | List common resources: pods, services, deployments, replica sets, jobs. |
| Get & describe | kubectl get deploy,svc,ingress | List several resource types at once. |
| Get & describe | kubectl get pods -l app=<name> | Filter by label. |
| Get & describe | kubectl get pods --field-selector status.phase=Running | Filter by a field. |
| Get & describe | kubectl get pods --sort-by=.metadata.creationTimestamp | Sort by a field, oldest first. |
| Get & describe | kubectl get namespaces | List namespaces. |
| Get & describe | kubectl get crd | List CustomResourceDefinitions. |
| Get & describe | kubectl describe pod <pod> | Detailed state of a pod, including recent events. |
| Get & describe | kubectl describe deployment <name> | Detailed state of a deployment and its rollout. |
| Get & describe | kubectl describe svc <service> | Show the selector, ports and endpoints of a service. |
| Apply & delete | kubectl apply -f <file>.yaml | Create or update resources from a manifest. |
| Apply & delete | kubectl apply -f <dir>/ | Apply every manifest in a directory (add -R for subdirectories). |
| Apply & delete | kubectl apply -k <dir> | Apply a kustomization. |
| Apply & delete | kubectl apply --server-side -f <file>.yaml | Server-side apply with field ownership tracking. |
| Apply & delete | kubectl diff -f <file>.yaml | Show what apply would change. |
| Apply & delete | kubectl apply -f <file>.yaml --dry-run=server | Validate against the API server without saving. |
| Apply & delete | kubectl create deployment <name> --image=<image> | Create a deployment imperatively. |
| Apply & delete | kubectl create deployment <name> --image=<image> --dry-run=client -o yaml > <file>.yaml | Generate a manifest skeleton without creating anything. |
| Apply & delete | kubectl expose deployment <name> --port=80 --target-port=8080 | Create a service for a deployment. |
| Apply & delete | kubectl run <name> --image=<image> | Start a single pod. |
| Apply & delete | kubectl create namespace <namespace> | Create a namespace. |
| Apply & delete | kubectl create job <name> --from=cronjob/<cronjob> | Run a CronJob now as a one-off job. |
| Apply & delete | kubectl edit deployment <name> | Edit a live resource in your editor. |
| Apply & delete | kubectl patch deployment <name> -p '{"spec":{"replicas":2}}' | Patch fields of a live resource. |
| Apply & delete | kubectl replace --force -f <file>.yaml | Delete and recreate a resource from a manifest. |
| Apply & delete | kubectl delete -f <file>.yaml | Delete the resources defined in a manifest. |
| Apply & delete | kubectl delete pod <pod> | Delete a pod; its controller creates a new one. |
| Apply & delete | kubectl delete pods -l app=<name> | Delete every pod with a label. |
| Apply & delete | kubectl delete pod <pod> --grace-period=0 --force | Remove a stuck pod immediately. Use with care. |
| Apply & delete | kubectl delete namespace <namespace> | Delete a namespace and everything in it. |
| Logs, exec & port-forward | kubectl logs <pod> | Print the logs of a pod’s container. |
| Logs, exec & port-forward | kubectl logs -f <pod> | Follow the logs. |
| Logs, exec & port-forward | kubectl logs <pod> -c <container> | Logs of one container in a multi-container pod. |
| Logs, exec & port-forward | kubectl logs <pod> --previous | Logs of the previous, crashed instance of the container. |
| Logs, exec & port-forward | kubectl logs <pod> --since=1h --tail=100 | Only recent lines. |
| Logs, exec & port-forward | kubectl logs <pod> --timestamps | Prefix each line with its timestamp. |
| Logs, exec & port-forward | kubectl logs deploy/<name> | Logs of one pod of a deployment. |
| Logs, exec & port-forward | kubectl logs -l app=<name> --all-containers --prefix | Logs of every pod with a label, prefixed with the source. |
| Logs, exec & port-forward | kubectl exec -it <pod> -- sh | Open a shell in a pod. |
| Logs, exec & port-forward | kubectl exec -it <pod> -c <container> -- sh | Open a shell in a specific container. |
| Logs, exec & port-forward | kubectl exec <pod> -- env | Run one command in a pod. |
| Logs, exec & port-forward | kubectl port-forward <pod> 8080:80 | Forward local port 8080 to port 80 of a pod. |
| Logs, exec & port-forward | kubectl port-forward svc/<service> 8080:80 | Forward to a pod behind a service. |
| Logs, exec & port-forward | kubectl port-forward --address 0.0.0.0 <pod> 8080:80 | Listen on every local interface, not only localhost. |
| Logs, exec & port-forward | kubectl cp <pod>:<path> <local-path> | Copy files out of a pod (needs tar in the container). |
| Logs, exec & port-forward | kubectl cp <local-path> <pod>:<path> | Copy files into a pod. |
| Logs, exec & port-forward | kubectl attach -it <pod> | Attach to the main process of a running container. |
| Logs, exec & port-forward | kubectl proxy | Proxy the API server on localhost port 8001 using your credentials. |
| Debug & troubleshoot | kubectl debug -it <pod> --image=busybox --target=<container> | Add an ephemeral debug container that shares the target’s process namespace. |
| Debug & troubleshoot | kubectl debug <pod> -it --copy-to=<pod>-debug --container=<container> -- sh | Debug a copy of the pod with a shell in place of the container command. |
| Debug & troubleshoot | kubectl debug node/<node> -it --image=busybox | Shell on a node; its filesystem is mounted at /host. |
| Debug & troubleshoot | kubectl run tmp --rm -it --image=busybox --restart=Never -- sh | Throwaway pod for testing DNS or connectivity. |
| Debug & troubleshoot | kubectl get events --sort-by=.lastTimestamp | Recent events in the namespace, newest last. |
| Debug & troubleshoot | kubectl events --for pod/<pod> | Events about one object. |
| Debug & troubleshoot | kubectl get pods -A --field-selector=status.phase!=Running | Find pods that are not running. |
| Debug & troubleshoot | kubectl top pods | CPU and memory use per pod (needs metrics-server). |
| Debug & troubleshoot | kubectl top pod <pod> --containers | CPU and memory use per container. |
| Debug & troubleshoot | kubectl top nodes | CPU and memory use per node. |
| Debug & troubleshoot | kubectl get endpointslices -l kubernetes.io/service-name=<service> | Check that a service has ready endpoints. |
| Debug & troubleshoot | kubectl wait --for=condition=Ready pod -l app=<name> --timeout=120s | Block until pods are ready. |
| Debug & troubleshoot | kubectl auth can-i create deployments | Check whether you may perform an action. |
| Debug & troubleshoot | kubectl auth can-i --list --as=system:serviceaccount:<namespace>:<sa> | List what a service account is allowed to do. |
| Debug & troubleshoot | kubectl auth whoami | Show the user and groups the API server sees for you. |
| Debug & troubleshoot | kubectl get pod <pod> -o yaml | Full spec and status, including container state and exit codes. |
| Rollout | kubectl rollout status deployment/<name> | Wait for a rollout to finish. |
| Rollout | kubectl rollout history deployment/<name> | List revisions of a deployment. |
| Rollout | kubectl rollout history deployment/<name> --revision=2 | Show the pod template of one revision. |
| Rollout | kubectl rollout undo deployment/<name> | Roll back to the previous revision. |
| Rollout | kubectl rollout undo deployment/<name> --to-revision=2 | Roll back to a specific revision. |
| Rollout | kubectl rollout restart deployment/<name> | Recreate all pods with a rolling restart. |
| Rollout | kubectl rollout pause deployment/<name> | Pause a rollout to batch several changes. |
| Rollout | kubectl rollout resume deployment/<name> | Resume a paused rollout. |
| Rollout | kubectl set image deployment/<name> <container>=<image>:<tag> | Update a container image, starting a rollout. |
| Rollout | kubectl set env deployment/<name> KEY=value | Set an environment variable on a deployment. |
| Rollout | kubectl set resources deployment/<name> -c <container> --limits=cpu=500m,memory=256Mi | Set resource limits (or --requests). |
| Rollout | kubectl annotate deployment/<name> kubernetes.io/change-cause="<reason>" | Record why a revision was made; shown in rollout history. |
| Scale | kubectl scale deployment/<name> --replicas=3 | Set the number of replicas. |
| Scale | kubectl scale statefulset/<name> --replicas=0 | Stop all pods of a StatefulSet, keeping its volumes. |
| Scale | kubectl autoscale deployment/<name> --min=2 --max=10 --cpu-percent=80 | Create a HorizontalPodAutoscaler that targets 80% CPU (needs metrics-server). |
| Scale | kubectl get hpa | List autoscalers with current and target metrics. |
| Scale | kubectl describe hpa <name> | Show autoscaler conditions and scaling events. |
| Labels & annotations | kubectl get pods --show-labels | Show all labels as a column. |
| Labels & annotations | kubectl get pods -L app,env | Show the values of specific labels as columns. |
| Labels & annotations | kubectl label pod <pod> env=prod | Add a label. |
| Labels & annotations | kubectl label pod <pod> env=staging --overwrite | Change an existing label. |
| Labels & annotations | kubectl label pod <pod> env- | Remove a label (trailing minus). |
| Labels & annotations | kubectl get pods -l 'env in (prod,staging)' | Set-based selector. |
| Labels & annotations | kubectl get pods -l 'app=<name>,tier!=db' | Combine selectors; all must match. |
| Labels & annotations | kubectl annotate pod <pod> note="<text>" | Add an annotation. |
| Labels & annotations | kubectl annotate pod <pod> note- | Remove an annotation. |
| Output formats | kubectl get pods -o yaml | Full objects as YAML. |
| Output formats | kubectl get pods -o json | Full objects as JSON. |
| Output formats | kubectl get pods -o name | Only <type>/<name>, handy for piping into other commands. |
| Output formats | kubectl get pods --no-headers | Omit the header row. |
| Output formats | kubectl get pods -o jsonpath='{.items[*].metadata.name}' | Extract one field from every item. |
| Output formats | kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.phase}{"\n"}{end}' | One line per item with tab-separated fields. |
| Output formats | kubectl get pods -o jsonpath='{.items[?(@.status.phase=="Running")].metadata.name}' | Filter items inside a JSONPath expression. |
| Output formats | kubectl get pods -o custom-columns=NAME:.metadata.name,IMAGE:.spec.containers[*].image | Choose your own columns. |
| Output formats | kubectl get pods -o json | jq -r '.items[].metadata.name' | Post-process JSON with jq. |
| Nodes | kubectl get nodes -o wide | List nodes with IPs, OS image and container runtime. |
| Nodes | kubectl get nodes -L topology.kubernetes.io/zone | Show the zone of each node. |
| Nodes | kubectl describe node <node> | Capacity, allocated resources, conditions and taints. |
| Nodes | kubectl get pods -A --field-selector spec.nodeName=<node> | List the pods running on a node. |
| Nodes | kubectl cordon <node> | Mark a node unschedulable; running pods stay. |
| Nodes | kubectl drain <node> --ignore-daemonsets --delete-emptydir-data | Evict pods before maintenance. |
| Nodes | kubectl uncordon <node> | Allow scheduling on the node again. |
| Nodes | kubectl taint nodes <node> key=value:NoSchedule | Only pods that tolerate the taint will be scheduled. |
| Nodes | kubectl taint nodes <node> key=value:NoSchedule- | Remove a taint. |
| Nodes | kubectl label nodes <node> disktype=ssd | Label a node for nodeSelector or affinity rules. |
| Secrets & ConfigMaps | kubectl create secret generic <name> --from-literal=password=<value> | Create a secret from a literal. |
| Secrets & ConfigMaps | kubectl create secret generic <name> --from-file=<file> | Create a secret with a file as a key. |
| Secrets & ConfigMaps | kubectl create secret generic <name> --from-env-file=.env | One key per line of a .env file. |
| Secrets & ConfigMaps | kubectl create secret docker-registry <name> --docker-server=<registry> --docker-username=<user> --docker-password=<token> | Credentials for pulling private images (imagePullSecrets). |
| Secrets & ConfigMaps | kubectl create secret tls <name> --cert=tls.crt --key=tls.key | TLS secret, e.g. for an Ingress. |
| Secrets & ConfigMaps | kubectl get secret <name> -o jsonpath='{.data.<key>}' | base64 -d | Decode one value of a secret. |
| Secrets & ConfigMaps | kubectl create secret generic <name> --from-literal=<key>=<value> --dry-run=client -o yaml | kubectl apply -f - | Create or update a secret idempotently. |
| Secrets & ConfigMaps | kubectl create configmap <name> --from-literal=KEY=value | Create a ConfigMap from a literal. |
| Secrets & ConfigMaps | kubectl create configmap <name> --from-file=<file> | Create a ConfigMap from a file. |
| Secrets & ConfigMaps | kubectl get configmap <name> -o yaml | Show the contents of a ConfigMap. |
| Secrets & ConfigMaps | kubectl set env deployment/<name> --from=configmap/<name> | Import every key of a ConfigMap as env variables. |
| Secrets & ConfigMaps | kubectl create serviceaccount <name> | Create a service account. |
| Secrets & ConfigMaps | kubectl create token <serviceaccount> | Issue a short-lived token for a service account. |