# kubectl cheat sheet: the commands

> kubectl cheat sheet of the commands you type daily: run, get, describe, logs, exec, apply, delete, expose, port-forward and rollout — verified against the official docs.

- Page URL: https://itinsighthub.com/kubectl/commands/
- Markdown variant of this page: append `?format=md` to any URL on this site or send `Accept: text/markdown`.
- Full site index for AI assistants: https://itinsighthub.com/llms.txt
- Full site export: https://itinsighthub.com/llms-full.txt

# kubectl cheat sheet: the commands

kubectl has two styles: **imperative** commands that tell the cluster what to do right now (`kubectl run`, `kubectl create`, `kubectl delete`) and **declarative** management where you describe the desired state in YAML and `kubectl apply` reconciles to it. The imperative path is fast for one-offs and exploring; `apply -f` is what you use for anything that lives in a repo.

The examples assume a namespace with a running Deployment named `nginx`. Add `-n ` to target another namespace, or `-A` (or `--all-namespaces`) to query across the whole cluster.

Published August 22, 2026

## Creating things

Imperative creation, from a bare pod to an exposed deployment

```
# Run a single pod
kubectl run nginx --image=nginx

# Create a deployment (preferred for anything long-running)
kubectl create deployment nginx --image=nginx --replicas=3

# Expose it as a Service on port 80
kubectl expose deployment nginx --port=80 --type=LoadBalancer

# Declarative — create or update from YAML (idempotent)
kubectl apply -f deploy.yaml

# Delete whatever the YAML defines
kubectl delete -f deploy.yaml
```

kubectl apply is idempotent — run it repeatedly and it converges the live object toward the YAML. kubectl create errors if the object already exists, which is why apply is the standard for repo-managed config. You can also generate a starting YAML from an imperative command with kubectl create deployment nginx --image=nginx --dry-run=client -o yaml.

## Inspecting things

The read commands, in order of use

```
# List pods in the current namespace
kubectl get pods

# Wider view: node, IP and status columns
kubectl get pods -o wide

# All namespaces
kubectl get pods -A

# Full detail, including the events at the bottom
kubectl describe pod nginx-7c65d6f9b4-abcde

# Live YAML/JSON of any object
kubectl get pod nginx-7c65d6f9b4-abcde -o yaml

# Watch a resource update in real time
kubectl get pods -w

# Explain a field's meaning (the in-terminal reference)
kubectl explain pod.spec.containers
```

*The output flags worth memorising*

| Flag | Effect |
| --- | --- |
| -o wide | extra columns (IP, node, image, reason) |
| -o yaml / -o json | full object as YAML/JSON |
| -A | all namespaces |
| -n  | target a specific namespace |
| -l app=nginx | filter by label selector |
| -w | watch mode (stream changes) |
| --sort-by=.metadata.creationTimestamp | sort by a field |

## Logs, exec and port-forward

The three commands that get you inside a workload

```
# Stream logs (add -f to follow)
kubectl logs nginx-7c65d6f9b4-abcde

# Logs of a specific container in a multi-container pod
kubectl logs nginx-7c65d6f9b4-abcde -c sidecar

# Logs of the previous (crashed) container
kubectl logs nginx-7c65d6f9b4-abcde --previous

# Open a shell inside the pod
kubectl exec -it nginx-7c65d6f9b4-abcde -- bash

# Forward a local port to a pod or service
kubectl port-forward pod/nginx-7c65d6f9b4-abcde 8080:80
```

The -- before the command in kubectl exec matters: it separates kubectl's flags from the command to run inside the container. Without it, a command like kubectl exec -it pod ls -la has kubectl try to parse -la as its own flag and fail. The container also has to contain a shell — minimal images may only have sh or nothing at all.

## Rollouts and scaling

Control a Deployment's rollout lifecycle

```
# Watch a rolling update progress
kubectl rollout status deployment/nginx

# Restart pods (rolling) to pick up a new config or secret
kubectl rollout restart deployment/nginx

# Undo the last rollout
kubectl rollout undo deployment/nginx

# Scale replicas up/down
kubectl scale deployment/nginx --replicas=5

# Live CPU/memory per pod or node (needs Metrics Server)
kubectl top pods
kubectl top nodes
```

## References

- [kubectl cheatsheet](https://kubernetes.io/docs/reference/kubectl/cheatsheet/) — the official quick reference.
- [kubectl command reference](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands) — every subcommand, generated from the source.

## FAQ

**What is the difference between kubectl apply and kubectl create?**

kubectl apply -f reconciles the live object toward the YAML and is idempotent — running it again applies changes, creating if needed and updating if it exists. kubectl create creates a new object and errors if it already exists. Use apply for anything in version control, create for quick one-offs.

**How do I see all my pods across every namespace?**

kubectl get pods -A (or --all-namespaces). Within one namespace, kubectl get pods shows only the current context's namespace; add -n to target another one. The -A flag works with any resource, not just pods.

**Why does kubectl top say it cannot find metrics?**

kubectl top depends on the Metrics Server add-on, which is not installed by default in every cluster. If it errors, metrics-server is missing or its API is not aggregated yet. Managed clusters usually ship it; self-hosted ones often need it installed separately.

**What is the difference between kubectl logs and kubectl describe?**

logs streams a container's stdout/stderr — what the app printed. describe summarizes the object's configuration, status, and the Events associated with it (scheduling failures, image pulls, restarts). When a pod is crashing, look at describe for why it was scheduled/failed and logs for what the app said before it died.

## Related tools

- [IPv4 subnet calculator](https://itinsighthub.com/subnet-calculator/) — break any CIDR block into network, range, broadcast and usable hosts.
- [IP range to CIDR](https://itinsighthub.com/ip-range-to-cidr/) — turn an arbitrary address range into its minimal covering CIDR blocks.
- [VLSM calculator](https://itinsighthub.com/vlsm-calculator/) — split a block into right-sized subnets by host requirements.

---

© 2026 ITInsightHub · [About](https://itinsighthub.com/about/) · [Contact](https://itinsighthub.com/contact/) · [Privacy](https://itinsighthub.com/privacy/)