This Kubectl Cheatsheet is a quick reference for many useful kubectl commands.

What Is Kubectl

This is the tool that most Kubernetes engineers primarily use when interacting with a Kubernetes cluster.

Behind the scenes, kubectl interacts directly with the Kubernetes API, converting the commands you type into API requests, which are then executed on the Kubernetes cluster.

With kubectl, you can perform a wide range of operations on the cluster, such as creating, deleting, and updating deployments, exposing your application, checking the logs of your running pods, and monitoring the health and capacity of your nodes and the overall cluster health.

To begin using kubectl, you must first install it on your local machine. Please refer to the next section for installation instructions.

How The Communication Works

The communication between kubectl and the Kubernetes cluster is based on RESTful HTTP requests and responses.

The following diagram illustrates how kubectl interacts with Kubernetes resources:

   Me
                                                     +--------------------------+
   x x                                               |    Kubernetes cluster    |
  x   x                                              |                          |
   x x                                               |      +---------+         |
    x                +---------+                     |      |         |         |
    x   commands     |         | GET, POST, PUT etc. |      |   api   |         |
    x -------------->| kubectl +---------------------+------+  server |         |
   x x               |         <---------------------+------+         |         |
  x x x <--------    +---------+     Response        |      +---------+         |
 x  x  x   displays                                  |                          |
x   x   x  commands                                  |                          |
    x                                                |                          |
    x                                                |                          |
    x                                                +--------------------------+
    x

When you issue a command using kubectl, the tool reads the kubeconfig file on your local machine and obtains all the necessary information to authenticate with the Kubernetes API server. This file includes details about the Kubernetes server's address, your credentials, and context information.

The connection between kubectl and the API server is usually secured by TLS encryption to ensure that no tampering or eavesdropping occurs.

Authentication and authorization occur before the API server processes your request. The API server validates your credentials. There are various ways Kubernetes can authenticate you, which are covered in detail in the following article: Kubernetes - RBAC And Admission Controllers

Once you have been authenticated and authorized, the kubectl command is translated into an API request that conforms to the Kubernetes API specification.

The request is typically a RESTful HTTP request, containing a specific method (GET, POST, PUT, DELETE, etc.). It also targets the relevant API endpoint (e.g., /api/v1/namespaces/default/pods) and includes the necessary data in JSON format (if applicable). The request is then sent over the secure connection to the Kubernetes API server, along with the required headers and your credentials.

Upon receiving the API request, the API server processes it and performs the necessary operations, such as creating or updating resources.

Kubectl receives the API response from the Kubernetes API server, which typically includes data in JSON format, log messages, and more.

Finally, kubectl displays the message to the user in the terminal 🏅

How To Install Kubectl

Download the latest version:

curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl"

Download a specific version:

curl -LO "https://dl.k8s.io/release/v1.24.0/bin/darwin/amd64/kubectl"

To make the kubectl binary executable:

chmod +x ./kubectl

To be able to run kubectl without specifying the path, move the kubectl binaries to a file location on your system PATH:

sudo mv ./kubectl /usr/local/bin/kubectl
sudo chown root: /usr/local/bin/kubectl

to check the version

kubectl version --client

Output:

Client Version: version.Info{Major:"1", Minor:"19", GitVersion:"v1.19.7", GitCommit:"1dd5338295409edcfff11505e7bb246f0d325d15", GitTreeState:"clean", BuildDate:"2021-01-13T13:23:52Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"darwin/amd64"}

Cluster Information

kubectl cluster-info # get info about the cluster
kubectl cluster-info dump # dump current cluster state to stdout

kubectl get nodes # list all nodes in the cluster
kubectl get pods # list all pods in the namespace or with --all-namespaces flag
kubectl get services
kubectl get deployments
kubectl get secrets
kubectl edit <resource-type> <resource-name> # edit a resource in the default editor


# Flags
--all-namespaces # list the requested object(s) across all namespaces
--watch # after listing/getting the requested object, watch for changes
-o # output format example -o yaml or -o json
--show-labels # show labels in the last column
--selector # filter results by label selector example --selector env=prod
--sort-by # sort list types using a jsonpath expression example --sort-by='{.metadata.name}'
--field-selector # filter results by a field selector example --field-selector metadata.name=nginx
--no-headers # when using the default or custom-column output format, don't print headers (default print headers) 
--output-watch-events # output watch event objects when --watch or --watch-only is used example kube get pods --watch --output-watch-events

kubectl describe nodes <node-name> # get detailed information about a node
kubectl describe pods <pod-name> # get detailed information about a pod
kubectl describe services <service-name> # get detailed information about a service
kubectl describe deployments <deployment-name> # get detailed information about a deployment
kubectl explain <resource-type> # get the documentation of a resource type example kubectl explain pods

kubectl create -f <file-name>
kubectl apply -f <file-name>
kubectl delete -f <file-name>

kubectl delete pods <pod-name>
kubectl delete services <service-name>
kubectl delete -f <file-name>
kubectl delete deployment <deployment-name> # delete a deployment
kubectl delete namespace <namespace-name> # delete a namespace

kubectl scale deployment <deployment-name> --replicas=<number-of-replicas>

kubectl expose deployment <deployment-name> --type=ClusterIP --port=<port> # Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster.
kubectl expose deployment <deployment-name> --type=NodePort --port=<port>
kubectl expose deployment <deployment-name> --type=LoadBalancer --port=<port> # In cloud providers that support load balancers, an external IP address would be provisioned to access the service.

kubectl rollout status deployment <deployment-name> # Check the status of a rollout
kubectl rollout history deployment <deployment-name> # Check the history of a rollout
kubectl rollout undo deployment <deployment-name> # Rollback to the previous revision
kubectl rollout undo deployment <deployment-name> --to-revision=<revision-number> # Rollback to a specific revision

kubectl logs <pod-name>
kubectl logs -f <pod-name> # follow the logs
kubectl logs -p <pod-name> # print the logs for the previous instance of the container in a pod if it exists

kubectl exec <pod-name> -- <command> # execute a command in a container
kubectl exec -it <pod-name> -- <command> # execute a command in a container interactively
# enter the container's shell
kubectl exec -it <pod-name> -- /bin/bash # bash shell, very common to get into a container
# copy files to and from a container
kubectl cp <pod-name>:<path-to-file> <path-to-local-file> -c <container-name> # copy a file from a container to the local machine
kubectl cp <path-to-local-file> <pod-name>:<path-to-file> -c <container-name> # copy a file from the local machine to a container

kubectl port-forward <pod-name> <local-port>:<container-port>
kubectl port-forward <service-name> <local-port>:<container-port>

kubectl label pods <pod-name> <label-key>=<label-value>
kubectl annotate pods <pod-name> <annotation-key>=<annotation-value>

kubectl taint nodes <node-name> <key>=<value>:<effect> # taint a node
kubectl taint nodes <node-name> <key>:<effect> # remove a taint from a node
kubectl taint nodes <node-name> <key>:NoSchedule # prevent pods from being scheduled on the node
kubectl taint nodes <node-name> <key>:NoExecute # prevent pods from being scheduled on the node and evict existing pods
kubectl taint nodes <node-name> <key>:PreferNoSchedule # prefer not to schedule pods on the node

apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    env: test
spec:
    containers:
    - name: nginx
        image: nginx
    tolerations:
    - key: "key"
        operator: "Equal"
        value: "value"
        effect: "NoSchedule"

kubectl config view # display merged kubeconfig settings or a specified kubeconfig file
kubectl config current-context # display the current-context
kubectl config use-context <context-name> # set the current-context in a kubeconfig file
kubectl config set-context <context-name> # set a context entry in kubeconfig
kubectl config set-cluster <cluster-name> # set a cluster entry in kubeconfig
kubectl config set-credentials <user-name> # set a user entry in kubeconfig
kubectl config unset users.<name> # unset a user entry in kubeconfig

kubectl config set-cluster <cluster-name> \
--certificate-authority=<path-to-ca-file> \
--embed-certs=<true|false> \
--server=<address-and-port-of-api-server> \
--kubeconfig=<path-to-kubeconfig-file>

kubectl apply --dry-run=client -f <file-name>

kubectl get pods -o name | cut -d/ -f2 | xargs -I {} kubectl delete pod {}
for pod in $(kubectl get pods -o name | cut -d/ -f2); do kubectl delete pod $pod; done

cat <<EOF | kubectl create -f -
# create a n nginx pod
apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
    containers:
    - name: nginx
        image: nginx
EOF

kubectl api-resources
kubectl api-resources --namespaced=true # lists  namespaced resources only
# how to get curl call from kubectl with log level 9
kubectl get pods -v=9 2>&1 | grep curl # get curl call for a specific resource
kubectl get pods -v=9 2>&1 | grep curl | sed 's/.*curl -k -v -XGET/https/' | sed 's/ -H .*//' # get curl call for a specific resource

kubectl get pods -v=9  2>&1 | grep curl

# Output
3076 round_trippers.go:466] curl -v -XGET  -H "User-Agent: kubectl/v1.25.2 (darwin/arm64) kubernetes/5835544" -H "Authorization: Bearer <masked>" -H "Accept: application/json;as=Table;v=v1;g=meta.k8s.io,application/json;as=Table;v=v1beta1;g=meta.k8s.io,application/json" 'https://192.168.64.2:16443/api/v1/namespaces/web-app/pods?limit=500'

kubectl get pods -o custom-columns=NAME:.metadata.name

kubectl get pods -o custom-columns=NAME:.metadata.name,STATUS:.status.phase

NAME                                               STATUS
keda-operator-metrics-apiserver-5bb87b6cc5-hqmrb   Running
devoriales-rabbitmq-0                              Running
keda-admission-webhooks-6b4b4b64fc-4wc8b           Running
keda-operator-7fdd98c445-9ljhj                     Running
consumer-deployment-58f8855bb7-hr7px               Running

 kubectl get pods -o custom-columns=MY_SUPER_PODS:.metadata.name,STATUS:.status.phase

MY_SUPER_PODS                                      STATUS
keda-operator-metrics-apiserver-5bb87b6cc5-hqmrb   Running
devoriales-rabbitmq-0                              Running
keda-admission-webhooks-6b4b4b64fc-4wc8b           Running
keda-operator-7fdd98c445-9ljhj                     Running
consumer-deployment-58f8855bb7-hr7px               Running

kubectl auth can-i <VERB> <RESOURCE> --namespace <NAMESPACE> --as <USER>

kubectl auth can-i create pods --namespace default

kubectl auth can-i create pods --namespace default --as=system:serviceaccount:default:default

yes