Cheatsheet

Kubernetes

kubectl commands and the manifest shapes you write most: inspect, change, debug, expose and package workloads.

Look around

kubectl config get-contexts  |  kubectl config use-context NAME

Which cluster am I talking to, and switch

```
kubectl get pods -A -o wide
```
All Pods in every namespace, with node and IP
```
kubectl get deploy,svc,ing -n shop
```
Several kinds at once in a namespace
```
kubectl get pod web-1 -o yaml
```
The full object as the cluster has it
```
kubectl describe pod web-1
```
Details and recent events (the first place to look when something fails)

kubectl get events --sort-by=.lastTimestamp

What happened lately, newest last

kubectl api-resources  |  kubectl explain deployment.spec.strategy

The kinds that exist, and documentation for any field

Create and change

kubectl apply -f deploy.yaml  |  kubectl apply -k overlays/prod

Make the cluster match a file, or a Kustomize folder

```
kubectl diff -f deploy.yaml
```
What would change, before you apply
```
kubectl delete -f deploy.yaml
```
Remove what a file describes
```
kubectl scale deploy/web --replicas=5
```
Change the number of Pods

kubectl set image deploy/web nginx=nginx:1.27.2

Roll out a new image

```
kubectl rollout status deploy/web
```
Wait for a rollout to finish
```
kubectl rollout undo deploy/web
```
Go back to the previous version

kubectl create deployment web --image=nginx:1.27 --dry-run=client -o yaml

Generate a starting manifest instead of writing one

Debug

```
kubectl logs deploy/web -f --tail=100
```
Follow a Deployment's logs
```
kubectl logs web-1 --previous
```
The logs of the container that just crashed
```
kubectl exec -it web-1 -- sh
```
A shell inside a Pod
```
kubectl port-forward svc/web 8080:80
```
Reach a Service from your machine
```
kubectl run tmp --rm -it --image=busybox -- sh
```
A throwaway Pod to test from inside the cluster
```
kubectl top pods  |  kubectl top nodes
```
CPU and memory use (needs metrics-server)
```
CrashLoopBackOff / ImagePullBackOff / Pending
```
The container keeps crashing / the image cannot be pulled / no node has room: describe the Pod

Deployment manifest

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels: { app: web }
  template:
    metadata:
      labels: { app: web }
    spec:
      containers:
        - name: web
          image: nginx:1.27
          ports: [{ containerPort: 80 }]

A Deployment: the selector must match the template labels

strategy:
  type: RollingUpdate
  rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }

Replace Pods one at a time without losing capacity

readinessProbe:
  httpGet: { path: /ready, port: 8080 }
  periodSeconds: 10
livenessProbe:
  httpGet: { path: /healthz, port: 8080 }
  failureThreshold: 3

Send traffic only to ready Pods, and restart stuck ones

resources:
  requests: { cpu: 100m, memory: 128Mi }
  limits:   { cpu: 500m, memory: 256Mi }

What the scheduler reserves, and the most a container may use

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true

Take away privileges the app does not need

Services, config and traffic

apiVersion: v1
kind: Service
metadata: { name: web }
spec:
  selector: { app: web }
  ports: [{ port: 80, targetPort: 8080 }]

A ClusterIP Service for the Pods labelled app: web

envFrom:
  - configMapRef: { name: web-config }
env:
  - name: DB_PASSWORD
    valueFrom: { secretKeyRef: { name: web-secret, key: DB_PASSWORD } }

Settings from a ConfigMap, a password from a Secret

kubectl create secret generic web-secret --from-literal=DB_PASSWORD=change-me

Create a Secret without putting the value in a file

spec:
  ingressClassName: nginx
  rules:
    - host: shop.example.test
      http:
        paths:
          - { path: /, pathType: Prefix, backend: { service: { name: web, port: { number: 80 } } } }

An Ingress: route a host and path to a Service

```
kind: NetworkPolicy
spec:
  podSelector: {}
  policyTypes: [Ingress]
```
Deny all incoming traffic to the namespace, then allow what you need

kubectl autoscale deploy web --min=2 --max=10 --cpu-percent=70

Add or remove Pods with CPU load

Kustomize, Helm and GitOps

kubectl kustomize overlays/prod  |  kubectl apply -k overlays/prod

Render and apply an overlay

namePrefix: prod-
namespace: production
replicas: [{ name: web, count: 5 }]
images: [{ name: nginx, newTag: 1.27.2 }]

What a Kustomize overlay changes without touching the base

helm install web ./chart -n shop --create-namespace -f values-prod.yaml

Install a chart as a release

helm upgrade web ./chart --set image.tag=1.27.2

Upgrade a release

```
helm template web ./chart | less
```
Render the manifests without installing
```
helm rollback web 1  |  helm uninstall web
```
Go back to a revision, or remove the release
```
git revert HEAD && git push
```
GitOps rollback: undo the commit and the controller does the rest

Cheatsheet for the Kubernetes path · Deboistech · All cheatsheets