โธ๏ธDevOps & Kubernetesโฑ๏ธ 16 min read•Updated October 2026
Kubernetes (K8s) Master Cheat Sheet: kubectl Commands, Pod Debugging & Manifest Architecture
The battle-tested Kubernetes operator reference: essential kubectl commands, decoding CrashLoopBackOff and OOMKilled states, zero-downtime rolling updates, and hardened pod security contexts.
#Kubernetes#K8s#kubectl#DevOps#Containers#Cloud#Microservices#Sysadmin
1. kubectl Everyday Essentials & Fast Manifest Scaffolding
Master fast context switching and use imperative commands with `--dry-run=client -o yaml` to generate boilerplate YAML manifests instantly without copying templates from the internet:
Scaffold Deployment YAML Without Applying
kubectl create deployment web-api --image=nginx:alpine --replicas=3 --dry-run=client -o yaml > deployment.yamlGenerates clean declarative Kubernetes Deployment YAML to disk.
Scaffold Service YAML Exposing Port
kubectl expose deployment web-api --port=80 --target-port=8080 --type=ClusterIP --dry-run=client -o yaml > service.yamlGenerates ClusterIP Service manifest targeting existing deployment.
Switch Cluster Context and Default Namespace
kubectl config use-context production-cluster
kubectl config set-context --current --namespace=frontendPoints kubectl to the target cluster and locks commands to the active namespace.
2. Pod Emergency Debugging: CrashLoopBackOff & OOMKilled
When a Kubernetes pod enters an error state, execute this diagnostic sequence:
```bash
# 1. Inspect recent cluster events and exit codes:
kubectl describe pod -n
# 2. View logs from previous crashed container instance:
kubectl logs --previous
# 3. Stream real-time logs across all pods in deployment:
kubectl logs -f -l app=web-api --max-log-requests=10
# 4. Port forward internal service directly to localhost:
kubectl port-forward svc/web-api 8080:80
```
**Deciphering Container Exit Codes:**
- **Exit Code 137 (OOMKilled)**: The container exceeded its memory limit. The Linux kernel OOM (Out Of Memory) killer abruptly terminated the process with `SIGKILL`. Remedy: Increase `resources.limits.memory`.
- **Exit Code 139 (Segmentation Fault)**: Memory corruption or binary incompatibility inside container image.
- **Exit Code 1 / 2**: Application runtime crash (unhandled exception, missing environment variable, database connection refusal).
Launch Ephemeral Debug Container in Running Pod
kubectl debug -it <pod-name> --image=busybox --target=app-containerAttaches an interactive troubleshooting container into the podโs network and process namespace.
3. Hardened Production Pod Architecture
Production workloads must define explicit resource limits, non-root security contexts, and health check probes:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: hardened-api
namespace: production
spec:
replicas: 3
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 25%
maxUnavailable: 0
template:
metadata:
labels:
app: hardened-api
spec:
securityContext:
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
fsGroup: 10001
containers:
- name: api
image: ghcr.io/org/api:v1.4.2
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: ["ALL"]
resources:
requests:
cpu: "250m"
memory: "256Mi"
limits:
cpu: "1000m"
memory: "512Mi"
livenessProbe:
httpGet:
path: /healthz
port: 8080
initialDelaySeconds: 15
periodSeconds: 10
readinessProbe:
httpGet:
path: /ready
port: 8080
initialDelaySeconds: 5
periodSeconds: 5
```
4. Kubernetes Networking & Ingress Controllers
Kubernetes abstracts internal and external network routing through virtual Services and Ingress controllers:
| Service Type | Scope | Description & Best Use Case | Copy |
|---|---|---|---|
| ClusterIP | Internal Only | Default virtual IP reachable only inside the cluster; use for microservices and databases | |
| NodePort | External via Node IP | Exposes static port (30000-32767) on every node; useful for dev clusters or legacy load balancers | |
| LoadBalancer | Public Cloud LB | Provisions native cloud provider load balancer (AWS NLB, GCP LB, Azure LB) | |
| Ingress / Gateway API | HTTP / Layer 7 Router | Routes HTTP/HTTPS hostnames and URI paths to multiple services using a single public IP address |
5. Configuration & Secret Management
Inject configuration and credentials into container pods without baking secrets into Docker image layers:
Create Secret from Literal Values via CLI
kubectl create secret generic db-credentials \
--from-literal=username=postgres \
--from-literal=password="StrongP@ssw0rd2026!" \
--dry-run=client -o yaml > secret.yamlGenerates base64 encoded Kubernetes secret manifest securely.
Trigger Rolling Deployment Restart after Config Update
kubectl rollout restart deployment/hardened-apiGracefully rotates all pods to pick up new ConfigMap or Secret changes with zero downtime.
Check Status of Rolling Update in Real Time
kubectl rollout status deployment/hardened-apiBlocks until all replacement pods pass readiness probes and old pods terminate.
6. Rapid kubectl Cheat Sheet Table
Essential command shortcuts for high-velocity cluster inspection:
| Task | Command | Notes | Copy |
|---|---|---|---|
| List pods with Node & IP info | kubectl get pods -o wide | Pods | |
| Sort pods by memory usage | kubectl top pods --sort-by=memory | Monitoring | |
| Sort nodes by CPU utilization | kubectl top nodes --sort-by=cpu | Monitoring | |
| Delete pod forcefully (emergency only) | kubectl delete pod <name> --grace-period=0 --force | Pods | |
| Drain node for maintenance | kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data | Nodes | |
| Uncordon node after reboot | kubectl uncordon <node-name> | Nodes |
๐งฐ
Related Free Online Tools
Put these techniques into practice immediately with our privacy-first browser utilities:
โฐ
Cron Expression Explainer & Generator
Generate accurate 5-token cron expressions for Kubernetes CronJob manifests.
Open Tool→
๐
Base64 Encoder & Decoder
Encode and decode base64 strings for Kubernetes Secret manifests.
Open Tool→
๐
YAML to JSON Converter
Convert Kubernetes YAML configuration files into JSON for Helm or API validation.
Open Tool→
