Toolbox · Kubernetes
Kubernetes Commands
Everyday kubectl: context, workloads, rollout control, RBAC checks and resource inspection.
On this page
Context and namespaces
| Command | Purpose |
|---|---|
kubectl config get-contexts | List clusters/contexts |
kubectl config use-context prod | Switch context |
kubectl config set-context --current --namespace=payments | Default namespace |
kubectl get ns --show-labels | Namespaces with Pod Security labels |
Workloads
| Command | Purpose |
|---|---|
kubectl get pods -o wide | Pods with node and IP |
kubectl get all -n payments | Common resources in a namespace |
kubectl describe pod <pod> | Events, conditions, mounts |
kubectl logs <pod> -c <container> --previous | Logs from the last crashed container |
kubectl logs -l app=api --all-containers --tail=200 | Logs by label |
kubectl exec -it <pod> -- sh | Shell (only if the image has one) |
kubectl debug -it <pod> --image=busybox:1.36 --target=<container> | Ephemeral debug container |
kubectl port-forward svc/api 8080:80 | Local access to a service |
kubectl top pods --containers | CPU/memory (metrics-server) |
Rollouts
| Command | Purpose |
|---|---|
kubectl rollout status deploy/api | Wait for rollout |
kubectl rollout history deploy/api | Revisions |
kubectl rollout undo deploy/api --to-revision=3 | Roll back |
kubectl rollout restart deploy/api | Recreate pods (e.g. after a ConfigMap change) |
kubectl scale deploy/api --replicas=0 | Caution stop serving without deleting |
Apply and diff
| Command | Purpose |
|---|---|
kubectl apply -k overlays/prod --dry-run=server | Server-side validation without applying |
kubectl diff -f manifest.yaml | Show what would change |
kubectl apply --server-side --field-manager=ci -f manifest.yaml | Server-side apply |
kubectl get deploy api -o yaml | kubectl neat | Clean YAML (krew plugin) |
RBAC and security checks
| Command | Purpose |
|---|---|
kubectl auth can-i create pods -n payments | Permission check |
kubectl auth can-i --list --as=system:serviceaccount:payments:api | Everything a service account can do |
kubectl get rolebindings,clusterrolebindings -A -o wide | All bindings |
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\t"}{.spec.securityContext.runAsNonRoot}{"\n"}{end}' | runAsNonRoot per pod |
kubectl get events -A --sort-by=.lastTimestamp | tail -30 | Recent cluster events |