Skip to main content

kubectl Cheat Sheet 2026 — Quick CLI Command Reference

kubectl Cheat Sheet 2026 — Quick Command Reference

kubectl Cheat Sheet is the complete quick-reference of kubectl commands grouped by function. Copy any command with one click and find what you need with Ctrl+F in under 3 seconds.

Pods & Containers

Action Command Useful flags
Get
kubectl get pods --sort-by='.status.containerStatuses[0].restartCount'
--sort-by
Get
kubectl get pods -o json | jq '.items[].spec.containers[].env[]?.valueFrom.secretKeyRef.name' | grep -v null | sort | uniq
-o -v
Get
kubectl get pods --all-namespaces -o jsonpath='{range .items[*].status.initContainerStatuses[*]}{.containerID}{"n"}{end}' | cut -d/ -f3
--all-namespaces -d -f3 -o
View logs
kubectl logs -f -l name=myLabel --all-containers    # stream all pods logs with label name=myLabel (stdout)
--all-containers -f -l
Get
kubectl get pods -A -o=custom-columns='DATA:spec.containers[*].image'
-A -columns -o
Get
kubectl get pods --namespace default --output=custom-columns="NAME:.metadata.name,IMAGE:.spec.containers[*].image"
--namespace --output -columns
Get
kubectl get pods -A -o=custom-columns='DATA:spec.containers[?(@.image!="registry.k8s.io/coredns:1.6.2")].image'
-A -columns -o
Get
kubectl get pods --sort-by=.status.containerStatuses[0].restartCount
--sort-by
Explain pods
kubectl explain pods                           # get the documentation for pod manifests
Get
kubectl get pods --all-namespaces             # List all pods in all namespaces
--all-namespaces
Get
kubectl get pods -o wide                      # List all pods in the current namespace, with more details
-o
Get
kubectl get pods                              # List all pods in the namespace

Deployments & ReplicaSets

Action Command Useful flags
Rollout
kubectl rollout history deployment/frontend                      # Check the history of deployments including the revision
Create deployment
kubectl create deployment nginx --image=nginx
--image --replicas
Check rollout status
kubectl rollout status deployment/nginx
-n
Rollback to previous revision
kubectl rollout undo deployment/nginx
--to-revision -n
Restart pods gracefully
kubectl rollout restart deployment/nginx
-n
Update container image
kubectl set image deployment/nginx nginx=nginx:1.21
--record

Services & Networking

Action Command Useful flags
Get
kubectl get services                          # List all services in the namespace
Get
kubectl get services --sort-by=.metadata.name
--sort-by
Delete
kubectl delete pods,services -l name=myLabel                      # Delete pods and services with label name=myLabel
-l
My-ns
kubectl -n my-ns delete pod,svc --all                             # Delete all pods and services in namespace my-ns,
--all -n -ns
Get
kubectl get replicationcontroller,services
Delete
kubectl delete pods,services -l [label-key]=[label-value]
-key -l -value

Namespaces & Contexts

Action Command Useful flags
Configure
kubectl config get-contexts                          # display list of contexts
-contexts
Configure
kubectl config get-contexts -o name                  # get all context names
-contexts -o
Get
kubectl get pods --all-namespaces             # List all pods in all namespaces
--all-namespaces
Get
kubectl get pods --all-namespaces -o jsonpath='{range .items[*].status.initContainerStatuses[*]}{.containerID}{"n"}{end}' | cut -d/ -f3
--all-namespaces -d -f3 -o
Get
kubectl get namespaces
Top pods
kubectl top pods --all-namespaces --sort-by=memory
--all-namespaces --sort-by

ConfigMaps & Secrets

Action Command Useful flags
Merged kubeconfig
Show merged kubeconfig settings and raw certificate data and exposed secrets
Patch sa
kubectl patch sa default --type='json' -p='[{"op": "add", "path": "/secrets/1", "value": {"name": "whatever" } }]'
--type -p
Create secret generic from literals
kubectl create secret generic my-secret --from-literal=username=admin --from-literal=password=s3cret
--from-literal
Create secret generic from file
kubectl create secret generic my-secret --from-file=path/to/credentials.json
--from-file
Create docker-registry secret
kubectl create secret docker-registry regcred --docker-username=myuser --docker-password=mypass --docker-email=my@email.com
--docker-username --docker-password --docker-email

Persistent Volumes

Action Command Useful flags
List all PersistentVolumes
kubectl get pv
Create PV from YAML file
kubectl create -f pv.yaml
-f
List PVs with custom columns
kubectl get pv -o custom-columns=NAME:.metadata.name,CAPACITY:.spec.capacity.storage,STATUS:.status.phase,CLAIM:.spec.claimRef.name,STORAGECLASS:.spec.storageClassName,ACCESSMODES:.spec.accessModes
-o custom-columns=...
List PVs by status
kubectl get pv --field-selector status.phase=Available
--field-selector
Watch PVs for changes
kubectl get pv --watch
--watch
Get PV as YAML
kubectl get pv <pv-name> -o yaml
-o yaml

RBAC & Security

Action Command Useful flags
Security context
Get security context
Get
kubectl get pods my-pod -o jsonpath='{.spec.securityContext}'
-o -pod
Get service account token secret
kubectl get secret $(kubectl get sa <sa-name> -n <namespace> -o jsonpath='{.secrets[0].name}') -n <namespace> -o jsonpath='{.data.token}' | base64 -d
-d -n -name -o
Check RBAC permission for user
kubectl auth can-i create deployments --as <user> -n <namespace>
--as -i -n
Apply a network policy from file
kubectl apply -f network-policy.yaml
-f -policy
Create Generic Secret
kubectl create secret generic <name> --from-literal=key=value -n <namespace>
--from-literal -n

Diagnostics & Troubleshooting

Action Command Useful flags
Describe pod details
kubectl describe pod <pod-name>
-n <namespace>
View pod logs
kubectl logs <pod-name>
-f --tail 50
Show cluster node resource usage
kubectl top node
Show pod resource usage
kubectl top pod
-n <namespace> --containers
List cluster events
kubectl get events
--all-namespaces --watch
Check pod status with conditions
kubectl get pods -o wide
--field-selector=status.phase!=Running
Inspect node conditions
kubectl describe node <node-name>
-name
Check K8s API server health
kubectl cluster-info dump
--output-directory=./dump

⚠️ Dangerous / Destructive Commands

These commands are irreversible. Verify your environment (dev/staging vs prod) before running them.

Action Command Warning
⚠️ Delete
kubectl delete pods,services -l name=myLabel                      # Delete pods and services with label name=myLabel
Irreversible — verify the target before running
⚠️ My-ns
kubectl -n my-ns delete pod,svc --all                             # Delete all pods and services in namespace my-ns,
Irreversible — verify the target before running
⚠️ Delete
kubectl delete pods,services -l [label-key]=[label-value]
Irreversible — verify the target before running

FAQ — Frequently Asked Questions

What is the difference between Pods & Containers and Deployments & ReplicaSets?

Each group in this kubectl cheat sheet covers a distinct area. Pods & Containers focuses on its specific scope, while Deployments & ReplicaSets and the remaining groups cover networking, storage, security and diagnostics respectively.

How do I check the installed kubectl version?

Run the version command (usually kubectl version or kubectl --version). The output shows the client and, when applicable, the server version.

Why does kubectl return ‘permission denied’?

A ‘permission denied’ error in kubectl usually means the current user lacks sufficient privileges or credentials are not configured. Check: (1) assigned IAM/RBAC roles, (2) an active authentication context via the corresponding login command.

How do I filter kubectl output by status or name?

Use flags such as --filter, --selector or --query depending on the tool. You can also pipe into grep or jq to process JSON:

kubectl list | grep RUNNING

What is the fastest way to debug a kubectl error?

Add the verbose flag (--verbose, -v or --debug) to the failing command. This reveals the underlying HTTP/API calls and the full error response body.

Official sources & references

Commands cross-checked against vendor documentation and high-authority repositories: