CertGrid CertGrid

Cloud native command cheat sheet

The commands behind the four non-Kubernetes KCNA domains - the container runtime, observability, delivery and security - each with the output it actually produced on a four-node cluster.

Container runtime

  • sudo -n crictl version

    Which runtime the kubelet is talking to, and which CRI API version it speaks.

    Full guide
  • sudo -n grep -E 'container-runtime-endpoint|containerRuntimeEndpoint' /var/lib/kubelet/kubeadm-flags.env /var/lib/kubelet/config.yaml 2>&1 | head -4

    The socket the kubelet uses. There is no remote CRI - runtime and kubelet are always on the same host.

    Full guide
  • sudo -n crictl pods --namespace kube-system --no-trunc | head -6

    Pod sandboxes as the runtime sees them. Still answers when the API server does not.

    Full guide
  • sudo -n ctr -n k8s.io containers ls | grep -c pause

    One pause container per sandbox. The count should equal your Pod count on this node.

    Full guide
  • sudo -n grep -m1 cgroupDriver /var/lib/kubelet/config.yaml

    The kubelet side of the cgroup driver. Must match the runtime, or memory accounting silently misbehaves.

    Full guide

Prometheus and PromQL

  • kubectl --context cka1001 -n monitoring exec promq -- curl -sG http://kps-kube-prometheus-stack-prometheus:9090/api/v1/query --data-urlencode 'query=count(up)'

    How many scrape targets exist. The first query to run on any Prometheus.

    Full guide
  • kubectl --context cka1001 -n monitoring exec promq -- curl -sG http://kps-kube-prometheus-stack-prometheus:9090/api/v1/query --data-urlencode 'query=group by (job) (up == 0)'

    Which jobs have failing targets. A count is not a diagnosis; the job names are.

    Full guide
  • kubectl --context cka1001 -n monitoring exec promq -- curl -sG http://kps-kube-prometheus-stack-prometheus:9090/api/v1/query --data-urlencode 'query=sum by (node) (kube_pod_info) '

    Pod count per node, from kube-state-metrics. Answers "is scheduling even?".

    Full guide
  • kubectl --context cka1001 -n monitoring exec promq -- sh -c "curl -s http://alertmanager-operated:9093/api/v2/alerts | tr ',' '\n' | grep -c alertname"

    How many alerts Alertmanager is currently holding. Prometheus fires them; Alertmanager routes them.

    Full guide
  • kubectl --context cka1001 -n monitoring get configmap -l grafana_dashboard=1 --no-headers | wc -l

    Dashboards delivered as ConfigMaps and loaded by a sidecar. Editing them in the UI does not persist.

    Full guide

GitOps with Argo CD

  • kubectl --context cka1001 apply --server-side -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml 2>&1 | tail -4

    Install or update Argo CD. Server-side apply avoids the 256 KB annotation limit that breaks the plain apply.

    Full guide
  • kubectl --context cka1001 -n argocd get application guestbook -o custom-columns=NAME:.metadata.name,REVISION:.status.sync.revision,SYNC:.status.sync.status,HEALTH:.status.health.status

    The exact commit an Application reconciled, plus sync and health. Sync and health are independent.

    Full guide
  • kubectl --context cka1001 get crd -o name | grep argoproj.io

    Confirm all three CRDs exist. A partial install leaves ApplicationSet missing and fails weeks later.

    Full guide
  • kubectl --context cka1001 -n guestbook scale deploy/guestbook-ui --replicas=3 Caution

    With selfHeal on, this is reverted within a second. Change Git, not the cluster.

    Full guide

Admission and RBAC

  • kubectl --context cka1001 label namespace psa-strict pod-security.kubernetes.io/enforce=restricted pod-security.kubernetes.io/enforce-version=latest

    Turn on Pod Security enforcement for a namespace. Applies to new Pods only - it never evicts.

    Full guide
  • kubectl --context cka1001 -n psa-strict run rooty --image=busybox:1.37 --restart=Never --overrides='{"spec":{"containers":[{"name":"rooty","image":"busybox:1.37","command":["sleep","3600"],"securityContext":{"privileged":true}}]}}'

    What a rejection looks like: Forbidden at admission, naming the profile and the violation. Nothing is created.

    Full guide
  • kubectl --context cka1001 auth can-i --list --as=system:serviceaccount:psa-strict:reader -n psa-strict | head -6

    Everything an identity may do, without logging in as it. Note what operators granted to all authenticated users.

    Full guide
  • kubectl --context cka1001 auth can-i list pods --as=system:serviceaccount:psa-strict:reader -n default

    The same check in another namespace. A Role grants nothing outside its own namespace.

    Full guide
  • sudo -n grep -E 'enable-admission-plugins|--authorization-mode' /etc/kubernetes/manifests/kube-apiserver.yaml

    What the API server enforces before any of your policy. A default cluster is permissive about Pods.

    Full guide

The API model

  • kubectl --context cka1001 get pods -n kube-system --request-timeout=10s -v=6 2>&1 | grep -E 'GET|round_trippers' | head -4

    The HTTP request behind a kubectl command. Everything in Kubernetes is a client of this API.

    Full guide
  • kubectl --context cka1001 get --raw='/api/v1/namespaces/kube-system/pods?limit=1' | tr ',' '\n' | grep -E '"kind"|"resourceVersion"' | head -3

    The raw response. Lists are typed objects, and carry the resourceVersion a watch resumes from.

    Full guide
  • kubectl --context cka1001 -n hpa-demo get deploy cpu-demo -o jsonpath='{.metadata.generation} {.status.observedGeneration}{"\n"}'

    Whether the controller has caught up with your spec. Equal means done.

    Full guide
  • kubectl --context cka1001 -n hpa-demo get pod -l app=cpu-demo -o jsonpath='{.items[0].metadata.ownerReferences[0].kind}/{.items[0].metadata.ownerReferences[0].name}{"\n"}'

    Who owns a Pod. Deployment to ReplicaSet to Pod - deleting the Pod achieves nothing.

    Full guide
  • kubectl --context cka1001 get --raw='/readyz?verbose' | head -8

    Control plane health, check by check. Distinguishes an unhealthy API server from a denied request.

    Full guide

Autoscaling

  • kubectl --context cka1001 -n hpa-demo get hpa cpu-demo

    A working HPA shows a real percentage. `<unknown>` means the target declares no requests.

    Full guide
  • kubectl --context cka1001 -n guestbook describe hpa guestbook-ui | sed -n '/Conditions/,/Events/p' | head -8

    The conditions are the diagnosis. ScalingActive False with FailedGetResourceMetric is the classic missing-requests case.

    Full guide
  • kubectl --context cka1001 get apiservices | grep -E 'metrics|custom.metrics|external.metrics'

    Which metric APIs exist. Only metrics.k8s.io means CPU and memory only - no custom-metric autoscaling.

    Full guide

The standards

  • kubectl --context cka1001 get csidrivers

    CSI drivers register themselves as objects. An empty list means non-CSI storage, which is normal.

    Full guide
  • sudo -n crictl info | python3 -c "import json,sys; d=json.load(sys.stdin); print('CNI networks:', [n['Config']['Name'] for n in d['cniconfig']['Networks']])"

    The CNI networks the runtime knows about. Pod-IP problems live here, not in any Kubernetes object.

    Full guide
  • sudo -n ctr -n k8s.io content get $(sudo -n ctr -n k8s.io images ls name==registry.k8s.io/pause:3.10.1 | awk 'NR==2 {print $3}') | python3 -c "import json,sys; d=json.load(sys.stdin); print('mediaType:', d['mediaType']); print('platforms:', [m['platform']['architecture'] for m in d['manifests']][:8])"

    One image tag, several platform manifests. This is why the same tag runs on arm64 and amd64.

    Full guide
← Back to the KCNA path