kubectl Cheat Sheet

Show the API server and core service endpoints for the current context.

List nodes with their roles, versions, and internal IPs.

Full detail on a node: capacity, conditions, and the pods scheduled to it.

See the control plane's own pods (API server, scheduler, controller-manager, CoreDNS) if they run as pods.

Show which cluster/context kubectl is currently pointed at.

Show both client (kubectl) and server (API server) versions — check for skew.

Watch pods in real time as controllers create, reschedule, or delete them.

See the cluster's own narration of what just happened, oldest first.

Look up what a field in a resource's spec means, straight from the API's built-in docs.

Delete a single pod — if it's controller-managed, watch the reconciliation loop recreate it.

Quickly create a single standalone pod (no controller) for a one-off test.

List pods across every namespace (short for --all-namespaces).

Create a new namespace to organize and isolate a set of objects.

Stop typing -n <ns> on every command by setting a default namespace for your context.

Dump a pod's full spec and live status as YAML.

Attach (or overwrite, with --overwrite) a label on an existing object.

Filter objects by a label selector — the same mechanism Services and Deployments use internally.

List pods with all of their current labels visible.

Print a pod's stdout/stderr — your first stop when a pod is crashing.

Show events, container statuses, and restart counts — the second stop when diagnosing CrashLoopBackOff.

Create a Deployment (and its ReplicaSet and pods) in one shot.

Change the desired replica count; the ReplicaSet controller reconciles the rest.

List ReplicaSets — notice one per revision of a Deployment, old ones scaled to 0.

See a Deployment's desired/current/up-to-date/available replica counts at a glance.

Trigger a rolling update by changing a container's image.

Block and report on the progress of an in-flight rollout.

List revisions kept for this Deployment.

Roll back to the previous revision (add --to-revision=<n> for a specific one).

Pause a rollout mid-flight (e.g. to inspect canary pods) and resume it later.

List all Services across every namespace, with their type and ClusterIP.

See which pod IPs a Service is actually routing to right now — empty means a selector mismatch.

Show a Service's selector, ports, and endpoints together in one view.

Resolve a Service name from inside a pod, exactly as the app would see it.

See the DNS server and search domains Kubernetes wrote into this pod.

Confirm which namespace a Service actually lives in before assuming a DNS bug.

Create a ConfigMap from literal key-value pairs without writing a YAML file.

See a ConfigMap's actual keys — the fastest way to catch a key-name mismatch.

Check what an env var actually resolved to inside a running container.

Create an Opaque Secret from literal key-value pairs.

Decode a Secret value — proof it's encoding, not encryption.

See the exact reason a container won't start, e.g. CreateContainerConfigError.

Check the Events section for 'Unhealthy'/probe-failed messages — the fastest way to see which probe is failing and why.

Empty address list + pod Running/0 restarts is the signature of a readiness-probe failure, not a crash.

Manually hit the exact path/port a probe uses from inside the container to confirm what it actually returns.

Print a pod's derived QoS class directly.

Check 'Last State'/'Reason: OOMKilled' to confirm a restart was the kernel OOM killer, not a crash.

Live CPU/memory usage per pod (needs metrics-server).

List PersistentVolumeClaims and their Bound/Pending status.

See why a claim is stuck Pending — the Events always name the exact cause.

List PersistentVolumes cluster-wide (not namespaced).

List StorageClasses; the one marked (default) is used when a PVC omits storageClassName.

Inspect a class's provisioner, reclaimPolicy, and volumeBindingMode.

Check ready vs. desired replicas for a StatefulSet.

StatefulSet pods list in strict ordinal order: name-0, name-1, ...

Force a StatefulSet pod's recreation — it comes back with the same name and the same per-pod PVC.

List all Ingress objects and which controller class each uses.

See resolved rules, backend status, and events for one Ingress.

List available Ingress controllers registered in the cluster, and which is default.

Test host/path routing from inside the cluster when there's no real external load balancer.

List registered Gateway API controllers (the GatewayClass layer).

List Gateways and whether each is PROGRAMMED (accepted by its controller).

Check a Gateway's per-listener Accepted/Programmed conditions and attached-route counts.

List HTTPRoutes and the hostnames/parentRefs each attaches to.

See per-parentRef Accepted status and resolved backendRefs for one HTTPRoute.

List Jobs and their completion status.

See a Job's Events — why it retried or gave up (BackoffLimitExceeded).

Read a Job's pod output directly by its job-name label.

Check SCHEDULE and LAST SCHEDULE for a CronJob.

Confirm a CronJob has actually fired successfully, not just that it exists.

Compare DESIRED/CURRENT/READY — DESIRED already accounts for nodeSelector/tolerations.

List only worker nodes — the usual baseline to compare DaemonSet coverage against.

Confirm a DaemonSet's pods landed one-per-node, on the nodes you expect.

Add a taint (NoSchedule, PreferNoSchedule, or NoExecute) to a node.

Remove a taint — trailing dash after the effect.

Show a node's current taints under the Taints: field.

Check Events for 'untolerated taint(s)' when a pod won't schedule.

See which node a pod actually landed on.

See what topology/label keys your nodes actually carry before writing affinity rules.

Add a label to a node (for nodeAffinity/nodeSelector targeting).

Remove a node label — trailing dash.

Check which node each pod landed on — essential for verifying spread.

Look up topologySpreadConstraints fields (maxSkew, topologyKey, whenUnsatisfiable, nodeTaintsPolicy) directly from the API.

Imperatively create a Role (useful for drafting before writing YAML).

Bind a Role to a ServiceAccount.

Check an RBAC decision directly against the API server, without a running pod.

List the RBAC objects in a namespace.

Enforce a Pod Security Standard on a namespace at admission time.

List NetworkPolicies in a namespace.

See exactly which Pod Security constraint a rejected pod violated.

Render a chart to plain YAML locally — no cluster contact. Always check this before install/upgrade when something looks wrong.

Install a chart for the first time under a given release name.

Re-render against new values and apply the diff to an existing release.

Revert a release to an older revision — the chart-level equivalent of kubectl rollout undo.

Remove every object a release created.

Render a kustomization to plain YAML locally — no cluster contact. The Kustomize equivalent of helm template.

Render and apply a kustomization in one step.

Show what apply -k would change against the live cluster, without changing anything.

Read the crashed container's logs after it's been replaced, not the new one's.

Logs from one specific container in a multi-container pod.

Full status plus chronological Events — check Last State/Reason/Exit Code for crashes.

Namespace- or cluster-wide event timeline, oldest first — use when you don't yet know which object to describe.

Live CPU/memory from metrics-server (a separate add-on from the API server).

Check whether a Service actually has any backing pods before assuming the Service itself is broken.

Pull just the live status block to compare against spec — fast way to spot a mismatch.

Imperatively create an HPA (equivalent to applying a HorizontalPodAutoscaler YAML).

Watch an HPA's current vs. target metric and replica count live.

See why an HPA isn't scaling — Events name the exact blocker (e.g. missing resource requests).

Point-in-time CPU/memory usage per pod, from metrics-server.

List VerticalPodAutoscaler objects and their current recommendations (requires the VPA controller installed).

List Karpenter NodePools (requires Karpenter installed — this is an EKS-world command).

See a pod's real IP — on EKS this is a routable VPC address, not an overlay address.

Inspect a NetworkPolicy's ipBlock CIDRs — on EKS these must match your real VPC/subnet ranges.

Check a ServiceAccount's eks.amazonaws.com/role-arn annotation for IRSA.

Confirm a Deployment's pods actually reference the IAM-mapped ServiceAccount.

Check which provisioner (e.g. ebs.csi.aws.com) a StorageClass actually points at.

Inspect AWS Load Balancer Controller annotations (aws-load-balancer-type, -nlb-target-type) on a Service.

One-shot overview of every resource kind in a multi-tier namespace.

Shows HPA Conditions — the fastest way to see why it can't find its scale target or can't read metrics.

Quick TCP reachability test from inside the cluster — how you verify a NetworkPolicy is actually blocking (not just that the object exists).