Kubernetes

kubectl config current-context
kubectl get pods -n myns -o wide
kubectl describe pod mypod -n myns | sed -n '/Events:/,$p'
kubectl logs mypod -n myns -c app --previous --tail 100

kubectl config get-contexts
kubectl config use-context prod
kubectl config set-context --current --namespace=myns   # stop typing -n

kubectl get deploy,sts,ds,job -A                         # workloads everywhere
kubectl get pods -A -o wide --field-selector status.phase!=Running
kubectl get pod mypod -o jsonpath='{.spec.containers[*].image}{"\n"}'
kubectl explain deployment.spec.strategy --recursive      # schema, straight from the server
kubectl api-resources --namespaced=true                   # what kinds exist here
kubectl diff -f manifest.yaml                             # what applying would change
kubectl apply -f manifest.yaml --server-side              # field ownership tracked by the server

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  replicas: 3
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }
  selector:
    matchLabels: { app: api }              # immutable after creation
  template:
    metadata:
      labels: { app: api }
    spec:
      terminationGracePeriodSeconds: 45
      securityContext:
        runAsNonRoot: true
        seccompProfile: { type: RuntimeDefault }
      containers:
        - name: app
          image: registry.example.com/api@sha256:abc...   # digest, not a moving tag
          ports: [{ containerPort: 8080 }]
          resources:
            requests: { cpu: 100m, memory: 256Mi }        # what the scheduler reserves
            limits: { memory: 512Mi }                     # what the kernel enforces
          readinessProbe:
            httpGet: { path: /readyz, port: 8080 }
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /healthz, port: 8080 }
            initialDelaySeconds: 20
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }

kubectl rollout status deploy/api -n myns --timeout=5m
kubectl rollout history deploy/api -n myns
kubectl rollout undo deploy/api --to-revision=3 -n myns
kubectl rollout restart deploy/api -n myns       # new pods, same spec: picks up rotated secrets
kubectl scale deploy/api --replicas=0 -n myns

kubectl get svc,endpointslice -n myns
kubectl get endpointslice -l kubernetes.io/service-name=api -n myns -o yaml | grep -A3 addresses
kubectl run tmp --rm -it --image=nicolaka/netshoot -- sh   # curl, dig, tcpdump in-cluster
kubectl port-forward svc/api 8080:80 -n myns

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: api-allow }
spec:
  podSelector: { matchLabels: { app: api } }
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector: { matchLabels: { app: web } }
      ports: [{ protocol: TCP, port: 8080 }]
  egress:
    - to: [{ namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: kube-system } } }]
      ports: [{ protocol: UDP, port: 53 }]   # forgetting DNS breaks everything else

kubectl get pvc,pv -n myns
kubectl get sc
kubectl describe pvc data-api-0 -n myns      # provisioning errors appear as events

apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: data }
spec:
  accessModes: [ReadWriteOnce]               # one node, not one pod
  storageClassName: gp3
  resources: { requests: { storage: 20Gi } }

kubectl create configmap app-config --from-file=config.yaml --dry-run=client -o yaml > cm.yaml
kubectl create secret generic db --from-literal=password=... --dry-run=client -o yaml > secret.yaml
kubectl get secret db -o jsonpath='{.data.password}' | base64 -d

    envFrom:
      - configMapRef: { name: app-config }
    env:
      - name: DB_PASSWORD
        valueFrom:
          secretKeyRef: { name: db, key: password }
    volumeMounts:
      - { name: config, mountPath: /etc/app, readOnly: true }
  volumes:
    - name: config
      configMap: { name: app-config }

kubectl auth can-i --list -n myns                                   # my permissions here
kubectl auth can-i get secrets -n myns --as system:serviceaccount:myns:api
kubectl get rolebinding,clusterrolebinding -A -o wide | grep myns

kind: Role
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]

kubectl get events -A --sort-by=.lastTimestamp | tail -30
kubectl describe node node-1 | sed -n '/Conditions:/,/Events:/p'
kubectl top node; kubectl top pod -A --sort-by=cpu
kubectl get pod mypod -o jsonpath='{.status.containerStatuses[*].lastState.terminated.reason}'
kubectl debug node/node-1 -it --image=busybox     # host namespaces, for node-level checks
kubectl get --raw='/readyz?verbose'               # API server health detail

# Pods not Running or Succeeded, cluster-wide
kubectl get pods -A --field-selector 'status.phase!=Running,status.phase!=Succeeded'

# Top restart counts
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.status.containerStatuses[0].restartCount}{"\n"}{end}' | sort -k3 -nr | head

# Every image running in the cluster, deduplicated
kubectl get pods -A -o jsonpath='{range .items[*]}{range .spec.containers[*]}{.image}{"\n"}{end}{end}' | sort -u

# Requests and limits per pod
kubectl get pods -A -o custom-columns='NS:.metadata.namespace,POD:.metadata.name,CPU:.spec.containers[*].resources.requests.cpu,MEM:.spec.containers[*].resources.requests.memory'

# Sum of CPU requests on a node
kubectl describe node node-1 | awk '/Allocated resources/,/Events/'

# Pods on one node
kubectl get pods -A -o wide --field-selector spec.nodeName=node-1

# Which pods mount a given secret
kubectl get pods -A -o json | jq -r '.items[] | select(.spec.volumes[]?.secret.secretName=="db") | "\(.metadata.namespace)/\(.metadata.name)"'

# Delete pods stuck Terminating (finalizer already cleared upstream)
kubectl delete pod mypod --grace-period=0 --force

# Drain a node for maintenance
kubectl drain node-1 --ignore-daemonsets --delete-emptydir-data --timeout=5m && kubectl uncordon node-1

# Watch rollout across every Deployment in a namespace
kubectl get deploy -n myns -o name | xargs -n1 -P0 kubectl rollout status -n myns

# API objects by count, to find what is filling etcd
kubectl get --raw=/metrics | grep '^apiserver_storage_objects' | sort -t' ' -k2 -nr | head

# Decode every key in a secret
kubectl get secret db -o go-template='{{range $k,$v := .data}}{{$k}}={{$v|base64decode}}{{"\n"}}{{end}}'

# Copy a file out of a pod without tar in the image
kubectl exec mypod -- cat /app/report.csv > report.csv