Reference
The commands worth keeping close, and the tools that make working with clusters noticeably less tedious. Everything here is filterable — start typing to narrow it down.
The commands that cover roughly ninety percent of day-to-day cluster work.
| Command | What it does |
|---|---|
kubectl config get-contexts | List every configured cluster context. |
kubectl config use-context <name> | Switch the active cluster. |
kubectl config set-context --current --namespace=<ns> | Set the default namespace so you can stop typing -n. |
kubectl cluster-info | Show the control plane and CoreDNS endpoints. |
kubectl api-resources | Every resource kind the cluster knows, with short names. |
kubectl explain deploy.spec.strategy | Inline schema documentation for any field path. |
kubectl get pods -o wide | Pods with node, pod IP, and nominated node columns. |
kubectl get all -n <ns> | The common workload kinds in one namespace. |
kubectl get pods -A --field-selector=status.phase!=Running | Everything that is not healthy, cluster wide. |
kubectl get pods --sort-by=.status.containerStatuses[0].restartCount | Rank pods by restart count — the fastest way to spot a crash loop. |
kubectl get pod <pod> -o jsonpath='{.spec.nodeName}' | Extract a single field for scripting. |
kubectl describe pod <pod> | Full state plus the Events that explain it. Read the bottom first. |
kubectl get events --sort-by=.lastTimestamp | Cluster events in chronological order. |
kubectl top pod --containers | Live CPU and memory per container (needs metrics-server). |
kubectl get endpointslices -l kubernetes.io/service-name=<svc> | The ready pod IPs actually behind a Service. |
kubectl logs <pod> --previous | Logs from the container instance that crashed, not the new one. |
kubectl logs -l app=web --prefix --all-containers -f | Follow logs from every pod matching a label. |
kubectl logs <pod> --since=15m --timestamps | Recent logs with timestamps attached. |
kubectl exec -it <pod> -- sh | Interactive shell inside a running container. |
kubectl exec <pod> -- env | sort | Dump the container environment without an interactive session. |
kubectl debug -it <pod> --image=nicolaka/netshoot --target=<container> | Ephemeral debug container sharing the pod namespaces. Works on distroless. |
kubectl port-forward svc/<name> 8080:80 | Tunnel a Service port to localhost through the API server. |
kubectl cp <pod>:/var/log/app.log ./app.log | Copy a file out of a container. |
kubectl auth can-i <verb> <resource> --as <user> | Check RBAC without trial and error. |
kubectl apply -f <file|dir> | Create or update via a three-way merge. The only one safe to repeat. |
kubectl diff -f <file> | Show exactly what applying would change on the live object. |
kubectl apply -f <file> --dry-run=server | Validate against the real API server without writing anything. |
kubectl scale deploy/<name> --replicas=5 | Change replica count immediately. |
kubectl set image deploy/<name> <container>=<image> | Trigger a rolling update to a new image. |
kubectl rollout status deploy/<name> --timeout=120s | Block until the rollout completes or times out. |
kubectl rollout restart deploy/<name> | Recreate every pod with no spec change, respecting surge limits. |
kubectl rollout undo deploy/<name> --to-revision=2 | Scale a previous ReplicaSet back up. |
kubectl label pod <pod> tier=canary --overwrite | Add or change a label in place. |
kubectl delete pod <pod> --grace-period=0 --force | Last resort for a stuck pod. Skips graceful shutdown. |
kubectl get nodes -o wide | Node status, roles, versions, and internal IPs. |
kubectl describe node <node> | Conditions, allocatable resources, and what is already claimed. |
kubectl drain <node> --ignore-daemonsets --delete-emptydir-data | Evict workloads before maintenance. |
kubectl uncordon <node> | Mark a node schedulable again. |
kubectl taint node <node> key=value:NoSchedule | Repel pods that do not tolerate the taint. |
Real projects, honestly described. Every link goes to the upstream source, not an affiliate page.
Terminal UI for Kubernetes
A full-screen curses interface over the cluster. Navigate resources, tail logs, exec into pods, and edit objects without typing a kubectl command. Replaces most of the get/describe loop.
brew install k9sApache-2.0Switch cluster and namespace in one word
Two tiny scripts that replace the verbose kubectl config incantations. With fzf installed they become interactive pickers.
brew install kubectxApache-2.0Multi-pod log tailing
Tail logs from every pod matching a regex, colour-coded per pod, following new pods as they appear. What kubectl logs -f should have been.
brew install sternApache-2.0Desktop IDE for Kubernetes
A graphical cluster browser with built-in metrics, terminal, and multi-cluster management. The freely available OpenLens builds are community-maintained from the open source core.
Download from k8slens.devMixed / proprietaryKubernetes in Docker
Runs each node as a Docker container. Multi-node clusters in about thirty seconds, and what the Kubernetes project itself uses for conformance testing.
brew install kindApache-2.0k3s clusters in Docker
Like kind but wrapping k3s, Rancher’s lightweight distribution. Starts faster and uses less memory, with a built-in load balancer and local registry support.
brew install k3dMITStrip the noise from kubectl output
Removes managedFields, status, and default values from get -o yaml, leaving something you can actually read or commit to Git.
kubectl krew install neatApache-2.0Plugin manager for kubectl
A kubectl SIG project that installs and updates kubectl plugins. The index has hundreds of them, including neat, tree, and access-matrix.
brew install krewApache-2.0Explore image layers
An interactive viewer for what each image layer added, changed, or deleted, with an efficiency score that points straight at wasted space.
brew install diveMITDocker-compatible CLI for containerd
A containerd project providing familiar docker-style commands, plus features Docker lacks such as lazy-pulling and image encryption.
brew install nerdctlApache-2.0Daemonless container engine
Runs containers without a privileged background daemon, with first-class rootless support and a docker-compatible CLI. Can generate Kubernetes YAML from running containers.
brew install podmanApache-2.0A container full of network tools
Not a CLI but an image: dig, curl, tcpdump, nmap, iperf, ss, and jq in one place. The fastest way to test connectivity from inside the cluster network.
kubectl run netshoot --rm -it --image=nicolaka/netshoot -- bashApache-2.0Fast manifest schema validation
Validates manifests against the Kubernetes OpenAPI schemas offline. Fast enough to run on every commit, and supports CRD schemas.
brew install kubeconformApache-2.0Template-free manifest customisation
Overlays and strategic merge patches instead of a templating language. Built into kubectl as `kubectl apply -k`.
Built into kubectlApache-2.0GitOps continuous delivery
A CNCF graduated project that runs inside the cluster, watches a Git repository, and continuously reconciles the cluster to match it — including drift detection.
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yamlApache-2.0Scanner for images, filesystems, and manifests
Finds vulnerabilities, misconfigurations, exposed secrets, and licence issues. Runs in CI, as a Kubernetes operator, or straight from your terminal.
brew install trivyApache-2.0Sign and verify container images
Part of Sigstore. Keyless signing via OIDC means no private key to store, with signatures recorded in the Rekor transparency log.
brew install cosignApache-2.0CIS Benchmark checks for Kubernetes
Runs the CIS Kubernetes Benchmark against a cluster and reports which controls pass, fail, or need manual review.
kubectl apply -f job.yamlApache-2.0