kubectl cheat sheet for hands-on exams

The commands that save the most time when you're solving tasks on a live cluster, grouped by what you're trying to do.

Last reviewed 9 November 2026. Image tags and versions are examples. Check flags against kubectl <command> --help for your cluster's version.

Contexts and namespaces

Command	What it does
`kubectl config get-contexts`	List contexts; the current one has a *
`kubectl config use-context <name>`	Switch cluster: run the one from the task first
`kubectl config current-context`	Confirm where you are
`kubectl get pods -n <ns>`	Name the namespace on every command
`kubectl get pods -A`	All namespaces

Command	What it does
`export do="--dry-run=client -o yaml"`	Shortcut used below
`kubectl run web --image=nginx:1.27 --port=80 $do > pod.yaml`	Pod skeleton
`kubectl create deploy web --image=nginx:1.27 --replicas=3 $do`	Deployment skeleton
`kubectl create job once --image=busybox:1.36 $do -- date`	Job
`kubectl create cronjob tick --image=busybox:1.36 --schedule="/5 * * *" $do -- date`	CronJob
`kubectl create cm app --from-literal=MODE=prod --from-file=app.conf $do`	ConfigMap
`kubectl create secret generic db --from-literal=PASS=s3cret $do`	Secret
`kubectl expose deploy web --port=80 --target-port=8080 --type=NodePort $do`	Service for a Deployment
`kubectl create ingress web --rule='app.lab.internal/=web:80' $do`	Ingress
`kubectl get deploy web -o yaml > web.yaml`	Start from a live object

Command	What it does
`kubectl apply -f file.yaml`	Create or update from a file
`kubectl edit deploy web -n app`	Edit live (opens $EDITOR)
`kubectl replace --force -f pod.yaml`	Delete and recreate, for immutable Pod fields
`kubectl set image deploy/web nginx=nginx:1.28`	Change a container image
`kubectl scale deploy web --replicas=5`	Scale
`kubectl autoscale deploy web --min=2 --max=6 --cpu-percent=70`	HorizontalPodAutoscaler
`kubectl label node node01 disk=ssd`	Add a label (--overwrite to change one)
`kubectl label node node01 disk-`	Remove a label
`kubectl taint node node01 dedicated=gpu:NoSchedule`	Add a taint ('-' at the end removes it)
`kubectl patch deploy web -p '{"spec":{"replicas":2}}'`	Small merge patch

Command	What it does
`kubectl rollout status deploy/web`	Wait for a rollout to finish
`kubectl rollout history deploy/web`	Revisions
`kubectl rollout undo deploy/web --to-revision=2`	Roll back
`kubectl rollout restart deploy/web`	Restart all Pods, e.g. after a ConfigMap change
`kubectl rollout pause deploy/web`	Batch several changes into one rollout (resume to continue)

Command	What it does
`kubectl cordon node01`	Stop new Pods landing on a node
`kubectl drain node01 --ignore-daemonsets --delete-emptydir-data`	Evict Pods before maintenance
`kubectl uncordon node01`	Back in service
`kubeadm upgrade plan`	Show available upgrades (control plane)
`kubeadm upgrade apply v1.X.Y`	Upgrade the first control-plane node
`kubeadm upgrade node`	Upgrade other nodes, then the kubelet package
`kubeadm token create --print-join-command`	Command for joining a new worker
`kubeadm certs check-expiration`	When the cluster's certificates expire

Command	What it does
`ETCDCTL_API=3 etcdctl snapshot save /opt/backup.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key`	Snapshot (paths as on a kubeadm control plane)
`etcdutl snapshot status /opt/backup.db -w table`	Check the snapshot
`etcdutl snapshot restore /opt/backup.db --data-dir=/var/lib/etcd-restored`	Restore into a new directory
`grep -A2 etcd-data /etc/kubernetes/manifests/etcd.yaml`	Then point the etcd static Pod's data volume at it

Command	What it does
`kubectl create sa builder -n ci`	ServiceAccount
`kubectl create role deployer --verb=get,list,create,update --resource=deployments -n ci`	Role
`kubectl create rolebinding deployer --role=deployer --serviceaccount=ci:builder -n ci`	Bind it
`kubectl auth can-i create deployments --as=system:serviceaccount:ci:builder -n ci`	Prove it works
`kubectl auth can-i --list --as=jane -n dev`	Everything a user may do
`kubectl certificate approve jane`	Approve a CertificateSigningRequest

Command	What it does
`kubectl describe pod web-x -n app`	Events at the bottom say why
`kubectl get events -n app --sort-by=.lastTimestamp`	Recent events, newest last
`kubectl logs web-x -c sidecar --previous`	Logs of the last crashed container
`kubectl logs deploy/web --all-containers --since=10m`	Logs across a Deployment
`kubectl exec -it web-x -- sh`	Shell inside a container
`kubectl debug -it web-x --image=busybox:1.36 --target=web`	Ephemeral debug container
`kubectl run t --rm -it --image=busybox:1.36 --restart=Never -- wget -qO- http://web.app`	Test a Service from inside the cluster
`kubectl top pods -A --sort-by=memory`	Resource use (needs metrics-server)
`crictl ps -a`	Containers on a node, even when the API server is down
`journalctl -u kubelet -f`	Kubelet log on a node

Command	What it does
`kubectl get svc,endpointslices -n app`	Does the Service have endpoints?
`kubectl get pods -n app --show-labels`	Compare Pod labels with the Service selector
`kubectl get netpol -A`	NetworkPolicies that might block traffic
`kubectl get gateway,httproute -A`	Gateway API objects
`kubectl get sc`	StorageClasses; the default is marked
`kubectl get pv,pvc -A`	Volumes and their claims, with status

Command	What it does
`kubectl get pods -o wide`	Node and Pod IP
`kubectl get nodes -o jsonpath='{.items[*].status.addresses[?(@.type=="InternalIP")].address}'`	One field from every item
`kubectl get pods -o custom-columns=NAME:.metadata.name,NODE:.spec.nodeName`	Your own table
`kubectl get pods --sort-by=.metadata.creationTimestamp`	Sort
`kubectl get pods -l app=web,tier!=cache`	Filter by label
`kubectl get pods --field-selector=status.phase!=Running`	Filter by field
`kubectl explain deploy.spec.strategy --recursive`	Field reference without leaving the terminal

Every lab gives you a kubeadm cluster with root on both nodes, so every command on this page works there.