kubectl cheat sheet

List every context in the kubeconfig and mark the current one.

The first command to run when output surprises you: the wrong context explains symptoms that make no sense in the cluster you thought you were in.

Switch the active context.

Print the API server address the current context talks to.

Change the default namespace for the current context, so -n can be omitted.

Show the control plane endpoint and the CoreDNS proxy URL.

Client version, including the embedded kustomize version.

The kustomize number matters: a kustomization that works with the standalone binary and not with kubectl is nearly always a version difference.

Ask the API server whether you are permitted an action, without attempting it.

Everything you are allowed in a namespace, which is faster than reading bindings.

Every resource type this cluster serves, with short names and whether it is namespaced.

The honest answer to "what can this cluster do". CRDs appear here alongside built-in types.

Just one API group's resources, which is how you check a CRD registered.

Field documentation generated from the schema, including required fields and enums.

Works on CRDs too, and is the fastest way to check a field name before writing YAML.

Across every namespace, not just the current one.

The common workload and Service types in a namespace.

Misleading name: it does not include ConfigMaps, Secrets, PVCs, Ingresses or CRs. It is a shortcut, not an audit.

Make a raw HTTP request to the API and print the response.

kubectl is an HTTP client. Useful for endpoints with no kubectl verb, like /livez and /metrics.

Adds node, Pod IP and nominated node to the default columns.

The whole object as the API server stores it, spec and status.

One field, script-friendly. `state` is waiting, running or terminated.

Pick your own columns from any fields.

Better than jsonpath for lists, because it prints a header and aligns.

Every label on every Pod, which is what selectors actually match.

The first check when a Service has no endpoints or a NetworkPolicy is not matching.

Filter by label, including inequality.

Every Pod that is neither running nor finished. Scales to thousands of Pods.

Field selectors are evaluated by the API server, unlike a client-side grep.

Order by any field. Restart count finds the unstable Pods.

A readable summary plus the object's events at the bottom.

The From column in the events block names the component: default-scheduler is placement, kubelet is everything after it.

Send desired state. Idempotent: the same file twice reports `unchanged`.

What would change if you applied it. Exit 0 means the cluster already matches.

Usable as a CI drift check. No output and exit 0 is the pass condition.

Apply with server-side field ownership instead of a last-applied annotation.

Required for very large CRDs: client-side apply stores the manifest in an annotation and annotations are capped at 256KB.

Generate a manifest skeleton without creating anything.

The fastest way to start a manifest, and the standard exam technique.

Change specific fields without sending the whole object.

Write the status subresource, which the main endpoint ignores.

A plain patch writing status reports `patched (no change)`. That is the subresource split, not a failure.

Add or change a label. Without --overwrite an existing key is refused.

Change the replica count imperatively.

Leaves the cluster out of step with your manifests, and Helm or the next apply will revert it.

Delete an object. Children with owner references go with it.

Delete a CustomResourceDefinition, and with it every custom resource of that kind in every namespace.

No confirmation and no undo. Run `kubectl get <plural> -A` first, every time.

Wait for a rollout, with a non-zero exit if it does not finish in time.

The revisions a Deployment can be rolled back to.

Roll back to the previous revision.

On an object managed by `kubectl apply`, this warns that the last-applied record is now out of step. The warning is real.

Force a rolling restart by stamping the Pod template.

The correct way to make Pods pick up a changed ConfigMap that has a fixed name.

Change one container's image, triggering a rollout.

Block until a condition is met. Non-zero exit on timeout.

Wait on an arbitrary field when no condition expresses what you need.

ReplicaSets, which is where a stuck rollout is visible: a new one at 0 ready beside an old one still serving.

Run a CronJob immediately without waiting for its schedule.

The current container's stdout and stderr.

One container in a multi-container Pod. Required when there is more than one.

The previous run's logs, which is where a crash loop's cause is.

The single most useful flag on this command. The current run may show nothing at all.

Follow, starting from the last 50 lines.

Logs from every Pod matching a label selector.

Logs from one Pod of a Deployment, chosen for you.

One Pod, not all of them. With several replicas you may be reading the wrong one.

A shell in a running container.

Attach an ephemeral debug container sharing the target's process namespace.

The answer for a distroless or scratch image with no shell of its own.

A Pod on a node's host namespaces, for inspecting the node itself.

Copy a file out of a container. Needs tar in the image.

Tunnel a local port to a Service or Pod through the API server.

Bypasses Ingress and NetworkPolicy entirely, so it proves the backend works and nothing about the path to it.

A throwaway Pod for testing connectivity from inside the cluster.

In a script piped to a shell, -i consumes the rest of the script. Use --command with kubectl logs instead.

Node status, roles, version, addresses and OS image.

Check the version column: a node left behind by a partial upgrade explains behaviour that differs by node.

Conditions, allocated resources, taints and the Pods running there.

For the four pressure and network conditions, False is healthy. Only Ready inverts.

Actual CPU and memory usage, from metrics-server.

Usage, not requests. The scheduler places by requests, so a node can be idle and fully booked.

Per-container usage, which is what you compare against limits.

Mark unschedulable. Existing Pods stay.

Cordon and evict, respecting PodDisruptionBudgets.

Evicts Pods. --delete-emptydir-data destroys emptyDir contents, so know what is in them first.

Make the node schedulable again. Easy to forget after an upgrade.

Add a taint. A trailing minus removes it.

Every warning in the cluster, newest last. The single highest-value triage command.

Events expire after an hour by default, so no warnings is not proof of health.

One namespace in chronological order. Default ordering is not chronological.

API server health broken down by subsystem. A failing check is marked with a minus.

Whether the API server is ready to serve, as distinct from alive.

Which node currently holds the scheduler leadership lease.

The control plane and add-ons. Restart counts climbing means something is crash-looping.