Kubernetes commands

One page per command. What it does, when to use it, how risky it is.

Look around

kubectl getLists objects as a table: pods, deployments, services and more.Risk: Safe
kubectl describeTells the whole story of one object, with its events at the end.Risk: Safe
kubectl explainShows the built-in docs for a field.Risk: Safe
kubectl waitWaits until something becomes true.Risk: Safe
kubectl versionShows the kubectl and cluster versions.Risk: Safe

Change the cluster

kubectl applyMakes the cluster match your YAML file. Creates or changes objects.Risk: Careful
kubectl createMakes one new object from flags, without a file.Risk: Careful
kubectl deleteRemoves objects. A deleted namespace takes everything inside with it.Risk: Can lose work
kubectl scale deploymentChanges how many copies the order asks for.Risk: Careful
kubectl expose deploymentMakes a Service: one order number for all matching pods.Risk: Careful
kubectl runStarts one lone pod. Nothing replaces it if it goes.Risk: Careful
kubectl labelAdds or removes a label. Selectors pick objects by labels.Risk: Careful
kubectl create roleMakes a job card: which verbs on which things, in one zone.Risk: Careful
kubectl create rolebindingPins a job card to a person or bot, in one zone.Risk: Careful
kubectl autoscale deploymentMakes a HorizontalPodAutoscaler that changes replicas from CPU use.Risk: Careful
kubectl create configmapPins a note of settings on the wall: a ConfigMap.Risk: Safe
kubectl create secret genericPuts a password or token in a Secret. It is only base64, not locked.Risk: Careful
kubectl set resourcesChanges the requests and limits in the pod template. A rolling update starts.Risk: Careful
kubectl create jobRuns a CronJob's task once, right now, as a new Job.Risk: Careful

Rollouts

kubectl set imagePuts a new image in the pod template. A rolling update starts.Risk: Careful
kubectl rollout statusWaits and reports until the new version is fully out.Risk: Safe
kubectl rollout historyLists the revisions: one per version of the pod template.Risk: Safe
kubectl rollout undoGoes back to the previous pod template, with a rolling update.Risk: Careful
kubectl rollout restartReplaces every pod with a fresh one, a few at a time.Risk: Careful

Debug

kubectl logsShows what a container printed.Risk: Safe
kubectl execRuns one command inside a running container.Risk: Careful
kubectl port-forwardOpens a private tunnel from your laptop to one pod.Risk: Safe
kubectl debugAdds a temporary debug container to a pod, with your own tools.Risk: Careful
kubectl topShows CPU and memory in use now (needs metrics-server).Risk: Safe
kubectl eventsShows the manager's notice board: scheduled, pulled, started, and warnings.Risk: Safe

Where am I?

kubectl config get-contextsLists your clusters. A star marks where commands go.Risk: Safe
kubectl config use-contextSwitches to another cluster. Every later command goes there.Risk: Careful
kubectl config set-contextChanges the namespace your commands use by default.Risk: Careful
kubectl auth can-iAsks RBAC: may this user do this? Answers yes or no.Risk: Safe
kubectl auth whoamiShows who gate 1 thinks you are: your user name and groups.Risk: Safe
kubectl config current-contextPrints the one context your commands go to right now.Risk: Safe
kubectl cluster-infoShows the address of the control plane (the API server) and CoreDNS.Risk: Safe
kind create clusterOpens a practice cluster on your laptop. Each node is a Docker container.Risk: Safe
kind delete clusterDeletes a kind cluster and everything in it.Risk: Can lose work

Nodes

kubectl cordonStops new pods going to a node. Pods already there stay.Risk: Careful
kubectl drainCordons a node and evicts its pods. emptyDir data is lost.Risk: Can lose work
kubectl taint nodesPuts a lock on a node. Only pods with the key (a toleration) may come.Risk: Careful

Packages and overlays

kubectl kustomizeBuilds YAML from a base plus an overlay (names, labels, images, replicas).Risk: Safe
helm templateFills a chart with values and prints the YAML. Installs nothing.Risk: Safe
helmInstalls a chart as a release, and later upgrades or rolls it back.Risk: Careful

Run the cluster itself (CKA)

sshOpens a shell inside one node: the stall's back room. exit takes you back.Risk: Safe
systemctlTalks to systemd, the machine's power room: is a service like the kubelet running? Start, restart or stop it.Risk: Careful
journalctlReads a service's diary: the log lines systemd keeps for it.Risk: Safe
crictl podsLooks straight at the stove: the pods, containers and images containerd has on this one node.Risk: Safe
kubeadm initTurns a fresh machine into the manager's office: certificates, kubeconfig files, static pod manifests and a join token.Risk: Careful
kubeadm joinBrings a new machine into the cluster as a stall, with a ticket and the office's ID check.Risk: Careful
sudo kubeadm upgrade planUpgrades a kubeadm cluster's control plane. plan only looks; apply changes the first control-plane node; node does the others.Risk: Careful
kubeadm certs check-expirationShows when the control plane's certificates expire, and renews them. The CAs are not renewed.Risk: Careful
etcdctlSaves a snapshot of the running etcd: a photocopy of the order book. Without the certificate flags it waits forever.Risk: Safe
etcdutlReads a snapshot file: its hash, revision, keys and size. In etcd 3.7, etcdctl no longer does this.Risk: Safe
etcdutlUnpacks a snapshot into a new data folder. Point etcd at it, and the cluster goes back in time. Newer objects are lost.Risk: Can lose work
kubectl certificate approveApproves a CertificateSigningRequest, so the cluster signs that ID card. It names who, not what they may do.Risk: Careful