☸️ Kubernetes & EKS Ops Cheat Sheet

kubectl cluster-info
kubectl version
kubectl get nodes -o wide
kubectl describe node <node-name>
kubectl top nodes

kubectl get pods -o wide
kubectl get pods -A
kubectl get pods --field-selector=status.phase=Pending
kubectl describe pod <pod>
kubectl delete pod <pod>
 
kubectl logs <pod>
kubectl logs -f <pod>
kubectl logs <pod> -c <container>          # multi-container pod
kubectl logs <pod> --previous              # crashed container's last logs
 
kubectl exec -it <pod> -- /bin/bash
kubectl exec -it <pod> -c <container> -- /bin/sh
 
# debug a pod without a shell (distroless images etc.)
kubectl debug -it <pod> --image=busybox --target=<container>
kubectl debug node/<node-name> -it --image=busybox   # debug a node

kubectl get deploy
kubectl describe deployment <deployment>
kubectl scale deployment <deployment> --replicas=3
 
kubectl rollout status deployment <deployment>
kubectl rollout history deployment <deployment>
kubectl rollout undo deployment <deployment>
kubectl rollout restart deployment <deployment>   # prefer this over deleting pods
 
kubectl get rs
kubectl get ds -A
kubectl get statefulset
kubectl rollout status statefulset <name>

kubectl get jobs
kubectl get cronjobs
kubectl create job manual-run --from=cronjob/<cronjob-name>   # trigger a CronJob manually
kubectl delete job <job-name>

kubectl get hpa
kubectl describe hpa <name>
kubectl autoscale deployment <deployment> --cpu-percent=70 --min=2 --max=10
 
kubectl get vpa                      # if VPA CRDs installed
kubectl describe vpa <name>
 
kubectl get pdb                      # PodDisruptionBudgets

kubectl get svc
kubectl describe svc <service>
kubectl expose deployment nginx --type=NodePort --port=80
 
kubectl get ingress
kubectl describe ingress <name>
kubectl get ingressclass
kubectl get ingressroutes -A     # Traefik CRD
kubectl get gateway,httproute -A # Gateway API, if in use
 
kubectl get endpoints <service>
kubectl get networkpolicy -A
kubectl describe networkpolicy <name>

kubectl get configmaps
kubectl describe configmap <configmap>
kubectl delete configmap <configmap>
 
kubectl get secrets
kubectl describe secret <secret>
kubectl delete secret <secret>
kubectl get secret <secret> -o jsonpath='{.data.<key>}' | base64 -d   # decode a value

kubectl get pv
kubectl get pvc -A
kubectl describe pvc <pvc>
kubectl get storageclass
kubectl get volumesnapshot -A

kubectl get sa
kubectl describe sa <serviceaccount>
 
kubectl get role,rolebinding -n <namespace>
kubectl get clusterrole,clusterrolebinding
 
kubectl auth can-i <verb> <resource>                      # e.g. can-i delete pods
kubectl auth can-i <verb> <resource> --as=system:serviceaccount:<ns>:<sa>

kubectl get resourcequota -n <namespace>
kubectl describe resourcequota <name> -n <namespace>
kubectl get limitrange -n <namespace>
kubectl get priorityclass

kubectl get ns
kubectl create namespace dev
kubectl delete namespace dev
kubectl config set-context --current --namespace=dev

kubectl port-forward pod/<pod> 8080:80
kubectl port-forward svc/<service> 8080:80

kubectl apply -f deployment.yaml
kubectl create -f deployment.yaml
kubectl delete -f deployment.yaml
kubectl replace -f deployment.yaml
kubectl diff -f deployment.yaml       # preview changes before apply
kubectl explain <resource>            # e.g. `kubectl explain deployment.spec` — inline API docs

kubectl get clusterissuer
kubectl get certificaterequests
kubectl get certificates
kubectl describe certificate <name>   # check Ready condition and renewal time

kubectl get crd
kubectl explain <crd-kind>            # inline docs for a CRD, same as built-ins
kubectl api-resources                 # list every resource type the cluster knows, with short names
kubectl api-versions

kubectl get events --sort-by=.lastTimestamp
kubectl get events -A --sort-by=.lastTimestamp | tail -30
kubectl top pods
kubectl top pods -n <namespace>
kubectl get pods --field-selector=status.phase=Pending
kubectl describe pod <pod>            # check before logs — Events section shows scheduling/pull failures
kubectl logs -f <pod>
 
# useful output formats
kubectl get pods -o yaml
kubectl get pods -o jsonpath='{.items[*].metadata.name}'
kubectl get pods -o custom-columns=NAME:.metadata.name,STATUS:.status.phase
kubectl get pods --watch

kubectl config get-contexts

CURRENT   NAME                                          CLUSTER              NAMESPACE
*         arn:aws:eks:ap-south-1:xxxx:cluster/prod-eks  ...                  esb-custom-oms
          arn:aws:eks:ap-south-1:xxxx:cluster/stg-eks   ...                  esb-custom-oms
          default                                       ...                  default

kubectl config use-context default
kubectl config use-context arn:aws:eks:ap-south-1:xxxx:cluster/prod-eks

kubectl --context=stg-eks get pods

kubectl config current-context

kubectl config rename-context arn:aws:eks:ap-south-1:xxxx:cluster/prod-eks eks-prod
kubectl config rename-context arn:aws:eks:ap-south-1:xxxx:cluster/stg-eks  eks-stg

export KUBECONFIG=~/.kube/eks-prod-config
aws eks update-kubeconfig --name production --region ap-south-1 --kubeconfig ~/.kube/eks-prod-config

KUBECONFIG=~/.kube/config:~/.kube/eks-prod-config kubectl config view --flatten > ~/.kube/merged-config

brew install kubectx        # macOS
sudo snap install kubectx   # Linux
 
kubectx                 # list contexts
kubectx eks-prod         # switch
kubens <namespace>       # switch namespace without editing context

# ~/.bashrc or ~/.zshrc
alias k8s-local='kubectl config use-context default'
alias k8s-prod='kubectl config use-context eks-prod'
alias k8s-stg='kubectl config use-context eks-stg'

kubectl config delete-context <context-name>

cat ~/.kube/config                      # inspect for corruption/merge issues
ls -la ~/.kube/config                   # check permissions
aws eks update-kubeconfig --name <cluster> --region <region>   # re-fetch a context
kubectl config view --minify --flatten  # show only the active context's full config

aws eks update-kubeconfig --region ap-south-1 --name production
 
kubectl config get-contexts
kubectl config use-context eks-production

kubectl get nodepools
kubectl describe nodepool <nodepool>
kubectl get nodeclaims
kubectl describe nodeclaim <nodeclaim>
kubectl get nodeclaims -o wide
 
kubectl logs -n karpenter -l app.kubernetes.io/name=karpenter -f
 
# prevent Karpenter from disrupting a specific node
kubectl annotate node <node-name> karpenter.sh/do-not-disrupt-

helm list -A
helm status <release> -n <namespace>
helm get values <release> -n <namespace>
helm get manifest <release> -n <namespace>
helm upgrade <release> <chart-path> -n <namespace> -f values.yaml
helm upgrade <release> <chart-path> -n <namespace> --dry-run --debug
helm rollback <release> <revision> -n <namespace>
helm history <release> -n <namespace>
helm template <chart-path> -f values.yaml   # render locally before applying
helm lint <chart-path>                      # validate chart before packaging

kubectl argo rollouts get rollout <name> -n <namespace> --watch
kubectl argo rollouts promote <name> -n <namespace>
kubectl argo rollouts abort <name> -n <namespace>
kubectl argo rollouts undo <name> -n <namespace>
kubectl argo rollouts status <name> -n <namespace>
kubectl argo rollouts list rollouts -n <namespace>

# check alerting rules are loaded
kubectl exec -n monitoring <prometheus-pod> -- promtool check rules /path/to/rules.yaml
 
# port-forward to Prometheus / Alertmanager / Grafana UI
kubectl port-forward svc/alertmanager-prometheus-kube-prometheus-alertmanager 9093:9093 -n monitoring
kubectl port-forward svc/kube-prometheus-stack-prometheus 9090:9090 -n monitoring
kubectl port-forward svc/kube-prometheus-stack-grafana 3000:80 -n monitoring
 
# reload config without restart (if --web.enable-lifecycle is set)
kubectl exec -n monitoring <prometheus-pod> -- kill -HUP 1
 
# check what a ServiceMonitor/PodMonitor/PrometheusRule looks like
kubectl get servicemonitor,podmonitor,prometheusrule -A