Kubernetes cheat sheet

The commands you learned, in one place.

Look around

kubectl get podsShow my trays and how they are doing.
kubectl get pods -o wideAlso show each pod's IP and node.
kubectl get deployment shop -o yamlShow the whole object, spec and status.
kubectl get pods -l app=shopOnly pods with the label app=shop.
kubectl get pods -APods in every namespace.
kubectl describe pod trayWhy is this tray not ready? Read the Events.
kubectl explain deployment.spec.replicasWhat does replicas mean?
kubectl wait --for=condition=Ready pod/tray --timeout=60sWait until the tray is ready.
kubectl versionWhich Kubernetes am I using?

Change the cluster

kubectl apply -f shop.yamlPut up the order written in shop.yaml.Risk: Careful
kubectl apply -f shop.yaml --dry-run=serverAsk the cluster to check it, change nothing.Risk: Careful
kubectl diff -f shop.yamlSee what apply would change first.Risk: Careful
kubectl create deployment shop --image=nginx:1.29-alpine --replicas=3A standing order: always 3 trays of nginx.Risk: Careful
kubectl create deployment shop --image=nginx:1.29-alpine --dry-run=client -o yamlPrint the YAML, create nothing.Risk: Careful
kubectl create namespace foodMake a new zone called food.Risk: Careful
kubectl delete pod trayTake away one tray.Risk: Can lose work
kubectl delete -f shop.yamlRemove what the file made.Risk: Can lose work
kubectl scale deployment shop --replicas=5Want 5 now. The manager makes 2 more.Risk: Careful
kubectl expose deployment shop --port=80Give the shop the order number shop.Risk: Careful
kubectl run tray --image=nginx:1.29-alpineOne tray, no manager.Risk: Careful
kubectl label pod tray tier=frontStick a tier=front sticker on the tray.Risk: Careful
kubectl create role deployer --verb=get,list,patch --resource=deploymentsA card for reading and patching Deployments.Risk: Careful
kubectl create clusterrole node-reader --verb=get,list --resource=nodesA card for every zone, and things with no zone.Risk: Careful
kubectl create rolebinding ci-bot-deployer --role=deployer --serviceaccount=default:ci-botGive the CI bot the deployer card here.Risk: Careful
kubectl create serviceaccount ci-botFirst, make the bot's badge.Risk: Careful
kubectl autoscale deployment shop --cpu=50% --min=3 --max=103 to 10 trays, aiming at half-busy CPU.Risk: Careful
kubectl create configmap settings --from-literal=GREETING=HaiA note that says GREETING is Hai.
kubectl create configmap settings --from-literal=GREETING=Hai --dry-run=client -o yamlPrint the YAML, create nothing.
kubectl create secret generic till --from-literal=PASSWORD=practice-onlyA Secret called till with one key, PASSWORD.Risk: Careful
kubectl get secret till -o jsonpath={.data.PASSWORD}Show the base64 text. Anyone who can read it can decode it.Risk: Careful
kubectl set resources deployment big --requests=cpu=100mBook a tenth of a CPU, not 64.Risk: Careful
kubectl set resources deployment shop --limits=memory=128MiCap each tray at 128Mi of memory.Risk: Careful
kubectl create job tally-now --from=cronjob/nightlyCount the plates now, with tonight's recipe.Risk: Careful

Rollouts

kubectl set image deployment/shop web=nginx:1.30-alpineSwap the trays to version 1.30, a few at a time.Risk: Careful
kubectl rollout status deployment/shopTell me when all new trays are ready.
kubectl rollout history deployment/shopWhich versions has the shop had?
kubectl rollout undo deployment/shopBack to the last good version.Risk: Careful
kubectl rollout restart deployment/shopFresh trays, same recipe.Risk: Careful

Debug

kubectl logs deployment/oops --previousWhat did it say before it crashed?
kubectl exec client -- wget -qO- http://shopFrom the client pod, ask the shop for its page.Risk: Careful
kubectl port-forward svc/shop 8080:80localhost:8080 now reaches a shop pod.
kubectl debug -it tray --image=busybox:1.37 --target=webBring a toolbox into the tray.Risk: Careful
kubectl top podsWho is using the most?
kubectl eventsWhat happened in this zone lately?
kubectl get events --field-selector reason=FailedSchedulingOnly the notes about trays with no stall.

Where am I?

kubectl config get-contextsWhich cluster am I talking to?
kubectl config use-context kind-devBack to my practice cluster.Risk: Careful
kubectl config set-context --current --namespace=foodFrom now on, work in the food zone.Risk: Careful
kubectl auth can-i delete pods --as=system:serviceaccount:default:ci-botMay the CI bot delete pods?
kubectl auth whoamiWho am I in this cluster?
kubectl config current-contextWhere am I? kind-dev, good.
kubectl cluster-infoSay hello to the manager's office.
kind create cluster --name dev --config kind-dev.yamlOpen the food court dev with 3 stalls. kubectl now points at kind-dev.
kind delete cluster --name devClose the practice food court for the night.Risk: Can lose work

Nodes

kubectl cordon dev-workerNo new trays at this stall.Risk: Careful
kubectl uncordon dev-workerThe stall takes trays again.Risk: Careful
kubectl drain dev-worker --ignore-daemonsetsMove every tray off this stall.Risk: Can lose work
kubectl taint nodes dev-worker2 gpu=yes:NoScheduleOnly GPU pods at this stall.Risk: Careful

Packages and overlays

kubectl kustomize overlays/prodShow the prod version before applying it.
helm template shop ./kedai --set replicaCount=3Show the YAML for 3 replicas.
helm install shop ./kedaiInstall the kedai chart as release shop.Risk: Careful

Run the cluster itself (CKA)

ssh dev-workerStep into dev-worker's back room, like on the exam.
docker exec -it dev-worker bashThe same on kind: each node is a Docker container with no SSH server.
systemctl status kubeletIs the supervisor on duty, and since when?Risk: Careful
systemctl start kubeletBring a stopped supervisor back. The stall turns Ready.Risk: Careful
systemctl restart kubeletStop and start it, after a kubelet setting changes.Risk: Careful
systemctl is-enabled kubeletDoes it start by itself at boot?Risk: Careful
systemctl stop kubeletCareful: the stall goes NotReady soon after. Throwaway clusters only.Risk: Careful
journalctl -u kubelet -n 20 --no-pagerThe kubelet's last 20 diary lines, printed all at once.
journalctl -u kubelet -fKeep watching for new lines. Ctrl+C stops.
crictl ps -aEvery container on this stall, stopped ones too.
crictl pods --name ovenOnly the pods whose name matches oven.
crictl logs <container id>A container's last words. The first letters of the id are enough.
crictl imagesWhat the stove has pulled onto this machine.
sudo kubeadm init --pod-network-cidr 10.244.0.0/16Build the office, and give pods their own address range.Risk: Careful
sudo kubeadm join 172.18.0.2:6443 --token abcdef.0123456789abcdef --discovery-token-ca-cert-hash sha256:<hash>Join the food court at the office's front counter.Risk: Careful
kubeadm token create --print-join-commandOn the office machine: print a fresh join command. Tokens last 24 hours by default.Risk: Careful
sudo kubeadm upgrade planLook only: can we upgrade, and to which versions?Risk: Careful
sudo kubeadm upgrade apply v1.37.2Upgrade the first control-plane node. Back up etcd first.Risk: Careful
sudo kubeadm upgrade nodeOn every other node, after the first one is done.Risk: Careful
kubeadm certs check-expirationOn the control-plane node: when does each card expire? It only looks.Risk: Careful
kubeadm certs renew apiserverRenew one card. Then restart the API server's pod.Risk: Careful
kubeadm certs renew allRenew every card kubeadm manages. Copy the new admin.conf after.Risk: Careful
etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /opt/backup.dbOn the control-plane node: save the whole cluster to /opt/backup.db.
kubectl -n kube-system exec etcd-dev-control-plane -- etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /var/lib/etcd/backup.dbOn kind: the nodes have no etcdctl, so run it in the etcd pod.
etcdutl --write-out=table snapshot status /opt/backup.dbIs this copy healthy? Show it as a table.
etcdutl --data-dir /var/lib/etcd-restore snapshot restore /opt/backup.dbRestore the copy into a new folder, never the live one.Risk: Can lose work
sed -i 's#/var/lib/etcd$#/var/lib/etcd-restore#' /etc/kubernetes/manifests/etcd.yamlThen point etcd's static pod at that folder. The kubelet restarts etcd.Risk: Can lose work
kubectl certificate approve ainaSign Aina's ID card. Then give her rights with RBAC.Risk: Careful
kubectl get csrList the requests and their CONDITION.Risk: Careful
kubectl get csr aina -o jsonpath='{.status.certificate}' | base64 -d > aina.crtSave the signed card as a file.Risk: Careful