ITInsightHub

kubectl cheat sheet: the commands

kubectl has two styles: imperative commands that tell the cluster what to do right now (kubectl run, kubectl create, kubectl delete) and declarative management where you describe the desired state in YAML and kubectl apply reconciles to it. The imperative path is fast for one-offs and exploring; apply -f is what you use for anything that lives in a repo.

The examples assume a namespace with a running Deployment named nginx. Add -n <namespace> to target another namespace, or -A (or --all-namespaces) to query across the whole cluster.

Published

Creating things

Imperative creation, from a bare pod to an exposed deployment
# Run a single pod
kubectl run nginx --image=nginx

# Create a deployment (preferred for anything long-running)
kubectl create deployment nginx --image=nginx --replicas=3

# Expose it as a Service on port 80
kubectl expose deployment nginx --port=80 --type=LoadBalancer

# Declarative — create or update from YAML (idempotent)
kubectl apply -f deploy.yaml

# Delete whatever the YAML defines
kubectl delete -f deploy.yaml
kubectl apply is idempotent — run it repeatedly and it converges the live object toward the YAML. kubectl create errors if the object already exists, which is why apply is the standard for repo-managed config. You can also generate a starting YAML from an imperative command with kubectl create deployment nginx --image=nginx --dry-run=client -o yaml.

Inspecting things

The read commands, in order of use
# List pods in the current namespace
kubectl get pods

# Wider view: node, IP and status columns
kubectl get pods -o wide

# All namespaces
kubectl get pods -A

# Full detail, including the events at the bottom
kubectl describe pod nginx-7c65d6f9b4-abcde

# Live YAML/JSON of any object
kubectl get pod nginx-7c65d6f9b4-abcde -o yaml

# Watch a resource update in real time
kubectl get pods -w

# Explain a field's meaning (the in-terminal reference)
kubectl explain pod.spec.containers
The output flags worth memorising
FlagEffect
-o wideextra columns (IP, node, image, reason)
-o yaml / -o jsonfull object as YAML/JSON
-Aall namespaces
-n <name>target a specific namespace
-l app=nginxfilter by label selector
-wwatch mode (stream changes)
--sort-by=.metadata.creationTimestampsort by a field

Logs, exec and port-forward

The three commands that get you inside a workload
# Stream logs (add -f to follow)
kubectl logs nginx-7c65d6f9b4-abcde

# Logs of a specific container in a multi-container pod
kubectl logs nginx-7c65d6f9b4-abcde -c sidecar

# Logs of the previous (crashed) container
kubectl logs nginx-7c65d6f9b4-abcde --previous

# Open a shell inside the pod
kubectl exec -it nginx-7c65d6f9b4-abcde -- bash

# Forward a local port to a pod or service
kubectl port-forward pod/nginx-7c65d6f9b4-abcde 8080:80
The -- before the command in kubectl exec matters: it separates kubectl's flags from the command to run inside the container. Without it, a command like kubectl exec -it pod ls -la has kubectl try to parse -la as its own flag and fail. The container also has to contain a shell — minimal images may only have sh or nothing at all.

Rollouts and scaling

Control a Deployment's rollout lifecycle
# Watch a rolling update progress
kubectl rollout status deployment/nginx

# Restart pods (rolling) to pick up a new config or secret
kubectl rollout restart deployment/nginx

# Undo the last rollout
kubectl rollout undo deployment/nginx

# Scale replicas up/down
kubectl scale deployment/nginx --replicas=5

# Live CPU/memory per pod or node (needs Metrics Server)
kubectl top pods
kubectl top nodes

References

FAQ

What is the difference between kubectl apply and kubectl create?

kubectl apply -f reconciles the live object toward the YAML and is idempotent — running it again applies changes, creating if needed and updating if it exists. kubectl create creates a new object and errors if it already exists. Use apply for anything in version control, create for quick one-offs.

How do I see all my pods across every namespace?

kubectl get pods -A (or --all-namespaces). Within one namespace, kubectl get pods shows only the current context's namespace; add -n to target another one. The -A flag works with any resource, not just pods.

Why does kubectl top say it cannot find metrics?

kubectl top depends on the Metrics Server add-on, which is not installed by default in every cluster. If it errors, metrics-server is missing or its API is not aggregated yet. Managed clusters usually ship it; self-hosted ones often need it installed separately.

What is the difference between kubectl logs and kubectl describe?

logs streams a container's stdout/stderr — what the app printed. describe summarizes the object's configuration, status, and the Events associated with it (scheduling failures, image pulls, restarts). When a pod is crashing, look at describe for why it was scheduled/failed and logs for what the app said before it died.