kubectl Cheat Sheet
A searchable kubectl cheat sheet: contexts, pods, logs, exec and debug containers, apply and diff, rollouts and rollbacks, scaling, events, secrets, jobs, draining nodes and RBAC checks.
Free · No sign-up · Your inputs stay in your browser
Reference
kubectl cheat sheet
| Command | Does | Notes |
|---|---|---|
| kubectl config get-contexts / use-context prod | Which cluster you are talking to | Check this before anything destructive. |
| kubectl get pods -A -o wide | Pods in every namespace, with node and IP | -n ns for one namespace. |
| kubectl get pods -w | Watch pods change | |
| kubectl describe pod web-7d9f | Events and state of a pod | The Events section explains Pending and CrashLoopBackOff. |
| kubectl logs -f deploy/web --tail=100 | Follow a deployment's logs | -p shows the previous, crashed container; -c picks a container. |
| kubectl exec -it web-7d9f -- sh | Shell into a pod | |
| kubectl debug -it web-7d9f --image=busybox --target=web | Ephemeral debug container | For distroless images with no shell. |
| kubectl apply -f manifests/ | Create or update from files | --dry-run=server -o yaml to preview. |
| kubectl diff -f manifests/ | What apply would change | |
| kubectl rollout status deploy/web | Wait for a rollout | |
| kubectl rollout undo deploy/web | Roll back to the previous ReplicaSet | --to-revision=N; history lists them. |
| kubectl rollout restart deploy/web | Restart every pod gracefully | Picks up changed ConfigMaps and Secrets. |
| kubectl scale deploy/web --replicas=5 | Change the replica count | An HPA will override it. |
| kubectl set image deploy/web web=ghcr.io/acme/web:1.4.3 | Deploy a new image | |
| kubectl port-forward svc/web 8080:80 | Reach a service from your machine | |
| kubectl get events --sort-by=.lastTimestamp | Recent cluster events | |
| kubectl top pods / top nodes | CPU and memory use | Needs metrics-server. |
| kubectl get deploy web -o yaml | The live object as YAML | -o jsonpath='{.spec.replicas}' for one field. |
| kubectl explain deployment.spec.strategy | Documentation for any field | |
| kubectl create secret generic app --from-env-file=.env | Secret from a .env file | --dry-run=client -o yaml to write it to a file instead. |
| kubectl get secret app -o jsonpath='{.data.DB_PASSWORD}' | base64 -d | Read one secret value | |
| kubectl create job --from=cronjob/report report-now | Run a CronJob immediately | |
| kubectl drain node-3 --ignore-daemonsets --delete-emptydir-data | Empty a node for maintenance | kubectl uncordon node-3 afterwards. |
| kubectl auth can-i delete pods --as=system:serviceaccount:app:web | Check RBAC permissions | |
| kubectl delete pod web-7d9f --grace-period=0 --force | Remove a stuck pod | Last resort: it skips graceful shutdown. |
deploy/, svc/ and cronjob/ prefixes let commands address a workload rather than one pod. alias k=kubectl and kubectl completion bash (or zsh) save a lot of typing; kubens and kubectx switch namespaces and clusters faster than config set-context.
About this tool
Method, assumptions, practical next steps, and limits.
Address workloads, not pods
Prefixes such as deploy/, svc/ and cronjob/ let commands target a workload instead of a pod with a random suffix: kubectl logs deploy/web picks a pod for you. The kubectl quick reference lists many more.
Speed
alias k=kubectl, shell completion (kubectl completion bash or zsh) and kubectx and kubens for switching clusters and namespaces save most of the typing.