kubectl Cheat Sheet is the complete quick-reference of kubectl commands grouped by function. Copy any command with one click and find what you need with Ctrl+F in under 3 seconds.
Pods & Containers
Action
Command
Useful flags
Get
kubectl get pods --sort-by='.status.containerStatuses[0].restartCount'
kubectl get pv -o custom-columns=NAME:.metadata.name,CAPACITY:.spec.capacity.storage,STATUS:.status.phase,CLAIM:.spec.claimRef.name,STORAGECLASS:.spec.storageClassName,ACCESSMODES:.spec.accessModes
-o custom-columns=...
List PVs by status
kubectl get pv --field-selector status.phase=Available
--field-selector
Watch PVs for changes
kubectl get pv --watch
--watch
Get PV as YAML
kubectl get pv <pv-name> -o yaml
-o yaml
RBAC & Security
Action
Command
Useful flags
Security context
Get security context
Get
kubectl get pods my-pod -o jsonpath='{.spec.securityContext}'
-o -pod
Get service account token secret
kubectl get secret $(kubectl get sa <sa-name> -n <namespace> -o jsonpath='{.secrets[0].name}') -n <namespace> -o jsonpath='{.data.token}' | base64 -d
What is the difference between Pods & Containers and Deployments & ReplicaSets?
Each group in this kubectl cheat sheet covers a distinct area. Pods & Containers focuses on its specific scope, while Deployments & ReplicaSets and the remaining groups cover networking, storage, security and diagnostics respectively.
How do I check the installed kubectl version?
Run the version command (usually kubectl version or kubectl --version). The output shows the client and, when applicable, the server version.
Why does kubectl return ‘permission denied’?
A ‘permission denied’ error in kubectl usually means the current user lacks sufficient privileges or credentials are not configured. Check: (1) assigned IAM/RBAC roles, (2) an active authentication context via the corresponding login command.
How do I filter kubectl output by status or name?
Use flags such as --filter, --selector or --query depending on the tool. You can also pipe into grep or jq to process JSON:
kubectl list | grep RUNNING
What is the fastest way to debug a kubectl error?
Add the verbose flag (--verbose, -v or --debug) to the failing command. This reveals the underlying HTTP/API calls and the full error response body.
Official sources & references
Commands cross-checked against vendor documentation and high-authority repositories: