kubectl Commands Cheatsheet: The Commands That Actually Matter

# ── STEP 1: Scan all pods across every namespace at a glance ──────────────────
# -A means --all-namespaces. Use this first when you inherit a cluster.
kubectl get pods -A

# ── STEP 2: Get pods in your target namespace with node placement info ─────────
# -o wide adds NODE, IP, NOMINATED NODE, and READINESS GATES columns
# Useful when pods on a specific node keep failing
kubectl get pods -n payments -o wide

# ── STEP 3: Get EVERYTHING in a namespace (deployments, services, ingress...) ──
# 'all' is a pseudo-resource type that expands to common resource groups
kubectl get all -n payments

# ── STEP 4: Deep-dive on a specific pod that shows as CrashLoopBackOff ─────────
# 'describe' gives you Conditions, Mounts, Environment variables, AND Events
# The Events block at the bottom is usually where the real error message lives
kubectl describe pod payment-processor-7d9f6b-xk2pq -n payments

# ── STEP 5: Export the live spec of a deployment for auditing ──────────────────
# -o yaml dumps the full Kubernetes object as it exists in the API server
# Redirect to a file if you want to diff it against your source manifest
kubectl get deployment payment-processor -n payments -o yaml > live_deployment.yaml

# ── APPLY: Safe for first-time AND subsequent deploys ─────────────────────────
# --record is deprecated in newer k8s but shown here for context
# The key point: apply works idempotently. Run it 50 times, same result.
kubectl apply -f payment-processor-deployment.yaml -n payments

# ── CHECK ROLLOUT STATUS: Blocks until rollout completes or fails ──────────────
# Use this in CI/CD scripts AFTER kubectl apply so the pipeline waits for health
# Exit code is non-zero if rollout fails — so your pipeline fails fast
kubectl rollout status deployment/payment-processor -n payments

# ── VIEW ROLLOUT HISTORY: See all versions with change causes ──────────────────
# Shows REVISION number, which you need for targeted rollbacks
kubectl rollout history deployment/payment-processor -n payments

# ── ROLLBACK TO PREVIOUS VERSION: Emergency eject button ──────────────────────
# No arguments = previous revision. Fast and safe.
kubectl rollout undo deployment/payment-processor -n payments

# ── ROLLBACK TO A SPECIFIC REVISION: When you need to jump back 3 versions ────
# Use the REVISION number from 'rollout history' above
kubectl rollout undo deployment/payment-processor -n payments --to-revision=4

# ── ROLLING RESTART: Force fresh pods without changing the image ───────────────
# Use this when pods are stuck or you've rotated a secret and need pods to re-read
# It does a zero-downtime rolling replacement of all pods in the deployment
kubectl rollout restart deployment/payment-processor -n payments

# ── SCALE UP: Increase replica count for a deployment ─────────────────────────
# Faster than editing the YAML when you need to handle a traffic spike right now
kubectl scale deployment/payment-processor --replicas=6 -n payments

# ── STEP 1: Read current logs (last 100 lines) ────────────────────────────────
# --tail limits output so you don't get flooded in a long-running container
# -n payments is the namespace flag — always specify it explicitly
kubectl logs payment-processor-7d9f6b-rv9ms -n payments --tail=100

# ── STEP 2: Stream logs in real-time during a deploy or incident ───────────────
# -f follows the log stream (like tail -f on a log file)
# Use this while simultaneously running kubectl rollout status in another terminal
kubectl logs -f payment-processor-7d9f6b-rv9ms -n payments

# ── STEP 3: Get logs from the PREVIOUS container run (crash-loop debugging) ────
# --previous is the lifesaver for CrashLoopBackOff — current container may be
# dead before it logs anything, but the previous run's logs are preserved
kubectl logs payment-processor-7d9f6b-xk2pq -n payments --previous

# ── STEP 4: Get aggregated logs from ALL pods matching a label ─────────────────
# -l is the label selector — matches pods that have app=payment-processor
# Essential for deployments with multiple replicas when you don't know which
# pod is handling the bad request
kubectl logs -l app=payment-processor -n payments --tail=50

# ── STEP 5: Forward local port 8080 to pod port 8080 (no firewall changes) ─────
# After running this, http://localhost:8080 hits the pod directly
# Ctrl+C ends the tunnel. Perfect for one-off debugging sessions.
kubectl port-forward pod/payment-processor-7d9f6b-rv9ms 8080:8080 -n payments

# ── STEP 6: Open an interactive shell inside a running container ───────────────
# -it = interactive tty (you want both for a shell session)
# -- /bin/sh is used when bash isn't available (minimal alpine images)
kubectl exec -it payment-processor-7d9f6b-rv9ms -n payments -- /bin/sh

# ── STEP 7: Run a one-off command inside a container without an interactive shell
# Useful in scripts — check an env var, curl an internal service, etc.
kubectl exec payment-processor-7d9f6b-rv9ms -n payments -- env | grep DB_HOST

# ── LIST ALL CONTEXTS: See clusters you have access to ────────────────────────
# The asterisk (*) marks your currently active context
# ALWAYS run this before destructive commands to confirm you're in the right cluster
kubectl config get-contexts

# ── SWITCH CONTEXT: Move from dev cluster to staging cluster ───────────────────
# Context names come from your kubeconfig — usually set by your cloud provider CLI
kubectl config use-context gke_myproject_us-east1_staging-cluster

# ── VERIFY CURRENT CONTEXT: Quick sanity check, pipe to less to see full config ─
kubectl config current-context

# ── SET DEFAULT NAMESPACE FOR YOUR SESSION ────────────────────────────────────
# After this you don't need -n payments on every command in this session
# WARNING: revert this when done so you don't accidentally hit the wrong NS later
kubectl config set-context --current --namespace=payments

# ── LIST ALL NAMESPACES IN THE CLUSTER ────────────────────────────────────────
kubectl get namespaces

# ── CREATE A NAMESPACE: Clean team or environment separation ──────────────────
kubectl create namespace fraud-detection

# ── CHECK RESOURCE USAGE ON NODES: Spot CPU/memory pressure ──────────────────
# kubectl top requires metrics-server to be installed in the cluster
kubectl top nodes

# ── CHECK RESOURCE USAGE FOR PODS IN A NAMESPACE ─────────────────────────────
kubectl top pods -n payments

# ── CORDON A NODE: Mark it unschedulable (no new pods) without evicting existing
# Use before maintenance when you don't want to disrupt running workloads yet
kubectl cordon worker-node-2

# ── DRAIN A NODE: Evict all pods gracefully before maintenance ────────────────
# --ignore-daemonsets needed because DaemonSet pods can't be evicted from nodes
# --delete-emptydir-data needed if any pods use emptyDir volumes
kubectl drain worker-node-2 --ignore-daemonsets --delete-emptydir-data

# ── UNCORDON: Bring the node back into rotation after maintenance ─────────────
kubectl uncordon worker-node-2

# ── DELETE A RESOURCE SAFELY: Always specify namespace explicitly ─────────────
# Deleting a deployment deletes it AND all its managed pods
kubectl delete deployment legacy-payment-v1 -n payments