kubectl Cheat Sheet

Quick reference for kubectl, the Kubernetes command-line client: contexts, get/describe, apply, logs/exec, rollout, scaling and debugging — with common options and practical examples.

40 commands

Cluster & Context

kubectl version

Print client and server version info (useful for debugging version skew).

--client client only; -o yaml/json

kubectl version -o yaml | yq '.clientVersion.minor'

kubectl cluster-info

Show info about master and services in the cluster.

--context ctx; --output json|yaml

kubectl cluster-info --context prod-eu

kubectl config get-contexts

List all contexts in the kubeconfig file.

--minify; -o name|json|yaml

kubectl config get-contexts -o name | xargs -I{} echo {}

kubectl config use-context <name>

Switch the current context.

kubectl config use-context prod-eu

kubectl config current-context / set-context <name>

Read or rename / update a context (set namespace, cluster, user).

--current print current; set-context --namespace N --cluster C --user U

kubectl config set-context dev-team-a --namespace shop --cluster dev --user dev

kubectl config set <name> <value>

Change the per-context default namespace so subsequent commands skip -n.

kubectl config set-context --current --namespace=argocd && kubectl get pods

Get & Inspect

kubectl get all

List pods, services, deployments, replicasets, statefulsets, etc.

-A all namespaces; -n ns; -l label=key=value selector; -o wide|yaml|json|name|custom-columns; --sort-by

kubectl get all -A -o wide | grep -i Error

kubectl get pods / svc / deploy / ds / sts

List a specific resource type (the most common resources).

-A; -l app=api; -o wide (shows node, ip); --field-selector; --sort-by .metadata.creationTimestamp

kubectl get pod -n kube-system -l k8s-app=metrics-server -o wide

kubectl get -o yaml|json

Dump the full object as YAML/JSON for inspection or export.

-o yaml; --export save without cluster-set fields

kubectl get deploy api -n shop -o yaml | grep -E 'image|replicas|envFrom'

kubectl describe <type> <name>

Show low-level details, events, container state, lifecycle — best for debugging.

-n ns; -A all ns; --show-events=true

kubectl describe pod api-7c5d-xn2kq -n shop | tail -50

kubectl explain <resource[.field]>

Show schema / fields documentation straight from the API server.

kubectl explain pod.spec.containers.resources.limits

Apply & Manage

kubectl apply -f <file|dir|url>

Apply or update manifests to match the cluster state (declarative).

-f file|dir|URL; -R recursive dir; --prune; --force-conflicts server-side apply; --server-side

kubectl apply -k overlays/prod && kubectl apply -f https://.../manifests.yaml

kubectl diff -f <file>

Show what `apply` would change (requires KUBECTL_EXTERNAL_DIFF or diff binary).

-R; --server-side; --prune

kubectl diff -f overlays/prod | head -50

kubectl create|delete -f <file>

Imperative create or delete from a manifest (one-shot).

create -f; delete -f; delete pod foo; delete svc,deploy -l app=foo (composite)

kubectl delete -f bad-app.yaml --grace-period=0 --force

kubectl edit <type> <name>

Open the live object in your editor (defaults to vi).

-o yaml; --save-config; --windows-line-ending

KUBE_EDITOR="code --wait" kubectl edit deploy api -n shop

kubectl patch <type> <name> --patch '<json>'

Apply a strategic-merge or JSON-patch to the live object.

--type strategic|merge|json; --patch-file file.json

kubectl patch deploy api -n shop --type merge -p '{"spec":{"replicas":6}}'

kubectl set image <type> <name> container=image

Trigger a rollout with a new image; mirrors `set image env / resources`.

set image env / resources / serviceaccount / subject / selector

kubectl set image deploy/api api=ghcr.io/team/api:1.4.2 && kubectl rollout status deploy/api

kubectl label / annotate <type> <name>

Add or update labels / annotations on live objects.

key=value add; key- remove (ends in -); --overwrite

kubectl label pod -n shop -l app=api release=v1.4.2 --overwrite

Logs & Exec

kubectl logs <pod>

Print the logs of a pod (or a specific container with -c).

-f follow; --tail N; --since R|D|T; --timestamps; -c container; --all-containers; -p previous

kubectl logs -n shop -f --tail 100 --timestamps api-7c5d-xn2kq

kubectl logs --previous

Show the logs of the previous instance of a container (after a crash / rollout).

-c container; --tail N

kubectl logs -p api-7c5d-xn2kq -c api --tail 200 | grep panic

kubectl logs -l <label> --all-containers

Aggregate logs across all pods matching a label — great for deployments.

-l app=api; --all-containers=true; -f; --max-log-requests N

kubectl logs -n shop -l app=worker --all-containers -f --max-log-requests 8

kubectl exec -it <pod> -- <cmd>

Run a command inside a pod, optionally interactive (bash/sh).

-it; -c container; -n ns; -- /bin/sh

kubectl exec -n shop -it api-7c5d-xn2kq -- /bin/sh -c 'printenv | grep DATABASE'

kubectl cp <pod>:<src> <dest>

Copy files/folders in/out of a pod (uses tar over exec).

-c container; -n ns

kubectl cp shop/api-7c5d-xn2kq:app/config.yaml ./config.yaml

kubectl port-forward <pod> <local>:remote>

Forward one or more local ports to a pod (or svc, deploy).

pod/<name> <l>:r; svc/<name> <l>:r; --address 127.0.0.1

kubectl port-forward svc/argocd-server -n argocd 8443:443

Rollout & Scale

kubectl rollout status deploy/<name>

Watch the progress of a rolling update until it's ready (or times out).

--timeout 5m; --revision N

kubectl rollout status deploy/api -n shop --timeout 2m

kubectl rollout history / undo

Show the rollout history / roll back to a previous revision.

history --revision N; undo --to-revision N; --dry-run=client

kubectl rollout history deploy/api -n shop && kubectl rollout undo deploy/api --to-revision=3

kubectl rollout restart deploy/<name>

Restart a Deployment (or DaemonSet/StatefulSet) by patching the pod template.

-n ns

kubectl rollout restart deploy api -n shop && kubectl get pods -l app=api -w

kubectl scale deploy/<n> --replicas=N

Manually set replica count; doesn't change the manifest.

--current-replicas check first; --dry-run=client -o yaml

kubectl scale deploy/api -n shop --current-replicas 2 --replicas 6

kubectl autoscale deploy/<n> --min=2 --max=10 --cpu-percent=80

Create an HPA with the given bounds (or use `kubectl create hpa`).

--max --min --cpu-percent; --dry-run=client -o yaml

kubectl autoscale deploy/api -n shop --min=3 --max=15 --cpu-percent=70

Node & Pod Lifecycle

kubectl drain <node> --ignore-daemonsets --delete-emptydir-data

Safely evict pods from a node before maintenance (e.g. upgrade).

--grace-period N; --force; --skip-errors; --dry-run; --delete-emptydir-data

kubectl drain ip-10-0-1-7 --ignore-daemonsets --delete-emptydir-data --grace-period 60

kubectl cordon / uncordon <node>

Mark a node unschedulable (cordon) / schedulable (uncordon). Use uncordon after maintenance.

--name on implicit, no flag needed

kubectl cordon ip-10-0-1-7 && kubectl uncordon ip-10-0-1-7

kubectl delete pod <pod>

Delete a pod — for Deployments the controller will create a new one (used to force-restart a single instance).

--grace-period=0 --force; -n ns; --now

kubectl delete pod -n shop api-7c5d-xn2kq --grace-period=0 --force

Debug

kubectl top node / pod

Show live CPU/Memory usage (requires metrics-server).

--sort-by cpu|memory; --containers; -A; -l

kubectl top node && kubectl top pod -A --sort-by=memory | head

kubectl debug <pod>

Attach a debug container with extra debugging tools (kubectl-debug / Ephemeral Containers).

--image <img>; --target-container; --share-processes; --profile

kubectl debug -it api-7c5d-xn2kq --image=nicolaka/netshoot --target-container=api

kubectl get events --sort-by=.lastTimestamp

Tail cluster events to find scheduling / image pull / probe failures.

--field-selector involvedObject.name=podX; -A; -w; --watch-only-events

kubectl get events -n shop --sort-by=.lastTimestamp -w | grep -v 'Normal'

kubectl auth can-i <verb> <resource>

Check what your current user can do — great for RBAC debugging.

--as user; --as-group; -n ns; --all-namespaces

kubectl auth can-i create pods -n prod --as system:serviceaccount:team-a:deployer

kubectl wait --for=condition=Ready

Block until a resource reaches the desired condition (use in CI/scripts).

--for condition=Ready|Available; --timeout 60s; --all --selector

kubectl wait -n shop --for=condition=Available deploy/api --timeout 120s

Resources & Manifests

kubectl create cm|secret ... --from-file|--from-literal

Imperative create of ConfigMap / Secret (use `kubectl create secret generic ...`).

--from-file; --from-literal=KEY=val; --dry-run=client -o yaml

kubectl -n shop create secret generic api-creds --from-literal=API_KEY=$(cat key.txt)

kubectl create token <serviceaccount>

Mint a short-lived token for a ServiceAccount (recommended over static secrets).

--duration 24h

kubectl -n shop create token deployer --duration=12h | pbcopy

kubectl get secret <name> -o jsonpath='{.data.K}' | base64 -d

Decode a base64 secret key for one-off inspection.

kubectl -n shop get secret api-creds -o jsonpath='{.data.API_KEY}' | base64 -d

Cheatsheet version 1.0.0

Covers kubectl 1.28+