Kubernetes

kubectl config current-context
kubectl get pods -n my-namespace -o wide
kubectl describe pod my-pod -n my-namespace | sed -n '/Events:/,$p'
kubectl logs my-pod -n my-namespace -c app --previous --tail 100

kubectl config get-contexts
kubectl config use-context prod
kubectl config set-context --current --namespace=my-namespace   # default namespace for this context

kubectl get deploy,sts,ds,job -A                          # workloads in every namespace
kubectl get pods -A -o wide --field-selector status.phase!=Running
kubectl get pod my-pod -o jsonpath='{.spec.containers[*].image}{"\n"}'
kubectl explain deployment.spec.strategy --recursive       # schema served by this cluster
kubectl api-resources --namespaced=true                    # kinds this cluster serves
kubectl diff -f manifest.yaml                              # what applying would change, exit 1 if different
kubectl apply -f manifest.yaml --server-side               # server tracks field ownership per manager

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }
  selector:
    matchLabels: { app: my-app }                 # immutable after creation
  template:
    metadata:
      labels: { app: my-app }
    spec:
      terminationGracePeriodSeconds: 45
      securityContext:
        runAsNonRoot: true
        seccompProfile: { type: RuntimeDefault }
      containers:
        - name: app
          image: registry.example.com/my-app@sha256:<digest>   # digest, not a moving tag
          ports: [{ containerPort: 8080 }]
          resources:
            requests: { cpu: 100m, memory: 256Mi }   # what the scheduler reserves
            limits: { memory: 512Mi }                # what the kernel enforces
          readinessProbe:
            httpGet: { path: /readyz, port: 8080 }
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /healthz, port: 8080 }
            initialDelaySeconds: 20
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }

kubectl rollout status deploy/my-app -n my-namespace --timeout=5m
kubectl rollout history deploy/my-app -n my-namespace
kubectl rollout undo deploy/my-app --to-revision=3 -n my-namespace
kubectl rollout restart deploy/my-app -n my-namespace    # new pods, same spec: picks up rotated Secrets in env vars
kubectl scale deploy/my-app --replicas=0 -n my-namespace  # stops every pod; the Deployment remains

    startupProbe:
      httpGet: { path: /healthz, port: 8080 }
      periodSeconds: 5
      failureThreshold: 60             # up to 5 minutes to start; liveness and readiness wait
    readinessProbe:
      httpGet: { path: /readyz, port: 8080 }
      periodSeconds: 5
      timeoutSeconds: 2
      failureThreshold: 2              # out of the endpoints after 10 s of failures
    livenessProbe:
      grpc: { port: 9090 }             # gRPC health protocol; kubelet speaks it natively
      periodSeconds: 20
      timeoutSeconds: 5
    lifecycle:
      preStop:
        sleep: { seconds: 5 }          # stable in v1.34; keeps serving while endpoint removal propagates

kubectl exec my-pod -n my-namespace -- cat /proc/1/cmdline | tr '\0' ' '   # what PID 1 is; sh -c 'app' does not forward SIGTERM
kubectl get pod my-pod -n my-namespace -o jsonpath='{.metadata.deletionTimestamp} {.metadata.deletionGracePeriodSeconds}{"\n"}'

kubectl get pods -n my-namespace -o custom-columns='POD:.metadata.name,QOS:.status.qosClass,NODE:.spec.nodeName'
kubectl set resources deploy/my-app -n my-namespace -c app --requests=cpu=100m,memory=256Mi --limits=memory=512Mi   # changes the template: rollout
kubectl describe quota -n my-namespace                    # ResourceQuota usage; a full quota rejects new pods at admission
kubectl get limitrange -n my-namespace -o yaml            # defaults injected into containers that set nothing

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata: { name: my-app, namespace: my-namespace }
spec:
  maxUnavailable: 1                          # or "25%"; percentages round up
  unhealthyPodEvictionPolicy: AlwaysAllow    # stable in v1.31: pods that are not Ready may always be evicted
  selector:
    matchLabels: { app: my-app }

kubectl get pdb -A                                                                   # ALLOWED DISRUPTIONS 0 means drain waits
kubectl get pdb my-app -n my-namespace -o jsonpath='{.status.disruptionsAllowed}{"\n"}'
kubectl drain node-1 --ignore-daemonsets --delete-emptydir-data --dry-run=server     # lists the pods it would evict

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata: { name: my-app, namespace: my-namespace }
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: my-app }
  minReplicas: 2
  maxReplicas: 20
  metrics:
    - type: ContainerResource              # one container, not the pod total: ignores the sidecar
      containerResource:
        name: cpu
        container: app
        target: { type: Utilization, averageUtilization: 70 }
    - type: Resource
      resource:
        name: memory
        target: { type: AverageValue, averageValue: 400Mi }
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 0        # act on the latest recommendation immediately
      policies:
        - { type: Percent, value: 100, periodSeconds: 15 }   # the default: double, or add 4 pods, per 15 s
    scaleDown:
      stabilizationWindowSeconds: 300      # the default: use the highest recommendation of the last 5 minutes
      policies:
        - { type: Pods, value: 2, periodSeconds: 60 }
      selectPolicy: Min                    # Max (default), Min, or Disabled to never scale down

kubectl autoscale deploy/my-app -n my-namespace --min=2 --max=10 --cpu=70%   # --cpu and --memory take a percentage or a quantity such as 500m
kubectl get hpa -n my-namespace                                                # TARGETS shows <unknown> until metrics arrive
kubectl describe hpa my-app -n my-namespace | sed -n '/Conditions:/,$p'        # ScalingActive False says why nothing happens

kubectl label nodes node-1 workload=batch                        # for selectors and affinity
kubectl taint nodes node-1 dedicated=batch:NoSchedule            # repel pods without the toleration
kubectl taint nodes node-1 dedicated=batch:NoSchedule-           # trailing dash removes it
kubectl cordon node-1                                            # adds node.kubernetes.io/unschedulable:NoSchedule; running pods stay
kubectl get nodes -o custom-columns='NODE:.metadata.name,TAINTS:.spec.taints[*].key,ZONE:.metadata.labels.topology\.kubernetes\.io/zone'

spec:
  tolerations:
    - { key: dedicated, operator: Equal, value: batch, effect: NoSchedule }
    - key: node.kubernetes.io/unreachable
      operator: Exists
      effect: NoExecute
      tolerationSeconds: 60                 # replace this pod after 1 minute instead of 5
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:                  # terms are ORed; expressions within a term are ANDed
          - matchExpressions:
              - { key: kubernetes.io/arch, operator: In, values: [amd64, arm64] }
              - { key: node.kubernetes.io/instance-type, operator: NotIn, values: [t3.micro] }
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 80
          preference:
            matchExpressions: [{ key: workload, operator: In, values: [batch] }]
  topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: DoNotSchedule      # hard; ScheduleAnyway only affects scoring
      labelSelector: { matchLabels: { app: my-app } }
      minDomains: 3                         # zones with no matching pod count as domains (stable in v1.30)
    - maxSkew: 1
      topologyKey: kubernetes.io/hostname
      whenUnsatisfiable: ScheduleAnyway
      labelSelector: { matchLabels: { app: my-app } }
      matchLabelKeys: [pod-template-hash]   # count only this ReplicaSet, so a rollout ignores old pods (beta since v1.27)

apiVersion: batch/v1
kind: Job
metadata: { name: migrate, namespace: my-namespace }
spec:
  backoffLimit: 3
  activeDeadlineSeconds: 900               # kill everything 15 minutes after the Job starts
  ttlSecondsAfterFinished: 86400           # delete the Job and its pods a day after it finishes
  podFailurePolicy:                        # stable in v1.31
    rules:
      - action: FailJob                    # do not retry a configuration error
        onExitCodes: { containerName: migrate, operator: In, values: [2] }
      - action: Ignore                     # preemption or a drain does not count against backoffLimit
        onPodConditions: [{ type: DisruptionTarget }]
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: migrate
          image: registry.example.com/my-app@sha256:<digest>
          args: [migrate, --to, latest]

apiVersion: batch/v1
kind: CronJob
metadata: { name: report, namespace: my-namespace }
spec:
  schedule: "15 2 * * *"
  timeZone: Australia/Melbourne            # stable in v1.27; unset means the controller-manager's zone
  concurrencyPolicy: Forbid                # skip the run if the previous Job is still active; Replace kills it
  startingDeadlineSeconds: 600             # give up on a run that could not start within 10 minutes
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3                # default 1 hides the failure you are looking for
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: report
              image: registry.example.com/report@sha256:<digest>

kubectl create job report-now --from=cronjob/report -n my-namespace         # run the template immediately
kubectl get jobs -n my-namespace -o wide                                   # COMPLETIONS and DURATION per run
kubectl logs job/report-now -n my-namespace --all-containers                # logs of the Job's pod
kubectl patch cronjob report -n my-namespace -p '{"spec":{"suspend":true}}' # pause; a running Job continues
kubectl delete jobs -n my-namespace --field-selector status.successful=1    # remove finished Jobs and their pods

kubectl get svc,endpointslice -n my-namespace
kubectl get endpointslice -l kubernetes.io/service-name=my-app -n my-namespace -o yaml | grep -A3 addresses
kubectl run tmp --rm -it --image=nicolaka/netshoot -n my-namespace -- sh   # curl, dig, tcpdump in-cluster; pod deleted on exit
kubectl port-forward svc/my-app 8080:80 -n my-namespace

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: my-app-allow }
spec:
  podSelector: { matchLabels: { app: my-app } }
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector: { matchLabels: { app: web } }
      ports: [{ protocol: TCP, port: 8080 }]
  egress:
    - to: [{ namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: kube-system } } }]
      ports:
        - { protocol: UDP, port: 53 }   # without DNS egress, every name lookup fails
        - { protocol: TCP, port: 53 }

kubectl get pvc,pv -n my-namespace
kubectl get sc
kubectl describe pvc data-my-app-0 -n my-namespace   # provisioning errors appear as events

apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: data }
spec:
  accessModes: [ReadWriteOnce]              # one node, not one pod
  storageClassName: gp3
  resources: { requests: { storage: 20Gi } }

kubectl create configmap app-config --from-file=config.yaml --dry-run=client -o yaml > cm.yaml
kubectl create secret generic db --from-literal=password="$DB_PASSWORD" --dry-run=client -o yaml > secret.yaml   # file holds the value; do not commit it
kubectl get secret db -o jsonpath='{.data.password}' | base64 -d   # prints the secret to the terminal

    envFrom:
      - configMapRef: { name: app-config }
    env:
      - name: DB_PASSWORD
        valueFrom:
          secretKeyRef: { name: db, key: password }
    volumeMounts:
      - { name: config, mountPath: /etc/app, readOnly: true }
  volumes:
    - name: config
      configMap: { name: app-config }

kubectl auth can-i --list -n my-namespace                                          # my permissions here
kubectl auth can-i get secrets -n my-namespace --as system:serviceaccount:my-namespace:my-app
kubectl auth whoami                                                                 # identity the API server sees
kubectl get rolebinding,clusterrolebinding -A -o wide | grep my-namespace

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: pod-reader, namespace: my-namespace }
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]

kubectl get events -A --sort-by=.lastTimestamp | tail -30
kubectl describe node node-1 | sed -n '/Conditions:/,/Events:/p'
kubectl top node; kubectl top pod -A --sort-by=cpu
kubectl get pod my-pod -o jsonpath='{.status.containerStatuses[*].lastState.terminated.reason}'
kubectl debug node/node-1 -it --image=busybox     # pod in host namespaces; host filesystem at /host; delete the pod afterwards
kubectl get --raw='/readyz?verbose'               # API server health checks, one line each

# Pods not Running or Succeeded, cluster-wide
kubectl get pods -A --field-selector 'status.phase!=Running,status.phase!=Succeeded'

# Top restart counts (first container of each pod)
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.status.containerStatuses[0].restartCount}{"\n"}{end}' | sort -k3 -nr | head

# Every image running in the cluster, deduplicated
kubectl get pods -A -o jsonpath='{range .items[*]}{range .spec.containers[*]}{.image}{"\n"}{end}{end}' | sort -u

# Requests per pod
kubectl get pods -A -o custom-columns='NS:.metadata.namespace,POD:.metadata.name,CPU:.spec.containers[*].resources.requests.cpu,MEM:.spec.containers[*].resources.requests.memory'

# Requested versus allocatable on a node
kubectl describe node node-1 | awk '/Allocated resources/,/Events/'

# Pods on one node
kubectl get pods -A -o wide --field-selector spec.nodeName=node-1

# Which pods mount a given Secret as a volume
kubectl get pods -A -o json | jq -r '.items[] | select(.spec.volumes[]?.secret.secretName=="db") | "\(.metadata.namespace)/\(.metadata.name)"'

# Drain a node for maintenance (evicts pods, respects PodDisruptionBudgets), then allow scheduling again
kubectl drain node-1 --ignore-daemonsets --delete-emptydir-data --timeout=5m && kubectl uncordon node-1

# Watch rollouts of every Deployment in a namespace in parallel
kubectl get deploy -n my-namespace -o name | xargs -n1 -P0 kubectl rollout status -n my-namespace

# Object counts by resource, to find what is filling etcd (metric renamed in v1.34)
kubectl get --raw=/metrics | grep -E '^apiserver_(storage|resource)_objects' | sort -t' ' -k2 -nr | head

# Copy a file out of a pod without tar in the image
kubectl exec my-pod -n my-namespace -- cat /app/report.csv > report.csv

# Print every key of a Secret in plain text. Output contains credentials.
kubectl get secret db -o go-template='{{range $k,$v := .data}}{{$k}}={{$v|base64decode}}{{"\n"}}{{end}}'