Skip to content
Search

Kubectl

lastmod 2026-03-13created 2022-10-0120 edits

Kubectl is a CLI (Command Line Interface) for issuing commands to a Kubernetes cluster.

Command examples

Check nodes 

kubectl get node

Check namespaces: 

kubectl get namespace

Check pods (POD): 

kubectl get po -n monitoring

Print everything: 

kubectl get all -A

Installation

Simply install it from snap: 

snap install kubectl --classic
kubectl version --client

Cluster access

Use the KUBECONFIG environment variable: 

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
kubectl get pods --all-namespaces
helm ls --all-namespaces

Or specify the location of the kubeconfig file in the command: 

kubectl --kubeconfig /etc/rancher/k3s/k3s.yaml get pods --all-namespaces
helm --kubeconfig /etc/rancher/k3s/k3s.yaml ls --all-namespaces

Running per file

To apply: 

kubectl apply -f my-resources.yaml

To remove it as is: 

kubectl delete -f my-resources.yaml

How to remove

Remove a Deployment: 

kubectl delete deployment <deployment-name>

To delete all resources in a specific namespace: 

kubectl delete namespace <namespace-name>

Accessing the cluster from outside with kubectl

Set the KUBECONFIG environment variable to the path of the kube config yaml file and run kubectl, or copy it to ~/.kube/config.

If you use k3s, see k3s#Accessing the cluster from outside with kubectl.

Commands

Basic commands (beginner)

  • Kubectl:create - Create a resource from a file or stdin
  • Kubectl:expose - Take a replication controller, service, deployment, or pod (Pod) and expose it as a new Kubernetes service
  • Kubectl:run - Run a particular image on the cluster
  • Kubectl:set - Set specific features on objects

Basic commands (intermediate)

  • Kubectl:explain - Get documentation for a resource
  • Kubectl:get - Display one or many resources
  • Kubectl:edit - Edit a resource on the server
  • Kubectl:delete - Delete resources by file names, stdin, resources and names, or by resources and label selector.

Deploy Commands

  • Kubectl:rollout - Manage the rollout of a resource
  • Kubectl:scale - Set a new size for a deployment, replica set, or replication controller
  • Kubectl:autoscale - Auto-scale a deployment, replica set, stateful set, or replication controller

Cluster management commands

  • Kubectl:certificate - Modify certificate resources.
  • Kubectl:cluster-info - Display cluster information
  • Kubectl:top - Display resource (CPU/memory) usage
  • Kubectl:cordon - Mark node as unschedulable
  • Kubectl:uncordon - Mark node as schedulable
  • Kubectl:drain - Drain node in preparation for maintenance
  • Kubectl:taint - Update the taints on one or more nodes.

Troubleshooting and debugging commands

  • Kubectl:describe - Show details of a specific resource or group of resources
  • Kubectl:logs - Print the logs for a container in a pod.
  • Kubectl:attach - Attach to a running container
  • Kubectl:exec - Execute a command in a container
  • Kubectl:port-forward - Forward one or more local ports to a pod
  • Kubectl:proxy - Run a proxy to the Kubernetes API server
  • Kubectl:cp - Copy files and directories to and from containers
  • Kubectl:auth - Inspect authorization
  • Kubectl:debug - Create debugging sessions for troubleshooting workloads and nodes

Advanced commands

  • Kubectl:diff - Diff the live version against the would-be applied version.
  • Kubectl:apply - Apply a configuration to a resource by file name or stdin.
  • Kubectl:patch - Update fields of a resource
  • Kubectl:replace - Replace a resource by file name or stdin.
  • Kubectl:wait - Experimental: Wait for a specific condition on one or many resources.
  • Kubectl:kustomize - Build a kustomization target from a directory or URL.

Settings commands

  • Kubectl:label - Update the labels on a resource.
  • Kubectl:annotate - Update the annotations on a resource.
  • Kubectl:completion - Output shell completion code for the specified shell (bash, zsh, or fish)

Other commands

  • Kubectl:alpha - Commands for features in alpha
  • Kubectl:api-resources - Print the supported API resources on the server.
  • Kubectl:api-versions - Print the supported API versions on the server, in the form of "group/version".
  • Kubectl:config - Modify kubeconfig files
  • Kubectl:plugin - Provides utilities for interacting with plugins.
  • Kubectl:version - Print the client and server version information.

How to check labels

There are several ways: 

kubectl describe namespace {네임스페이스명}
kubectl get namespace {네임스페이스명} --show-labels
kubectl get namespace {네임스페이스명} -o yaml
kubectl get namespace {네임스페이스명} -o jsonpath='{.metadata.labels}' | jq

Troubleshooting

tls: failed to verify certificate

Running a kubectl command produces the following error: 

E0523 10:59:59.467327 2585371 memcache.go:265] couldn't get current server API group list: Get "https://api.yourid.run:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate is valid for api-yourid-run, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, localhost, not api.yourid.run
E0523 10:59:59.537153 2585371 memcache.go:265] couldn't get current server API group list: Get "https://api.yourid.run:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate is valid for api-yourid-run, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, localhost, not api.yourid.run
E0523 10:59:59.567092 2585371 memcache.go:265] couldn't get current server API group list: Get "https://api.yourid.run:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate is valid for api-yourid-run, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, localhost, not api.yourid.run
E0523 10:59:59.596498 2585371 memcache.go:265] couldn't get current server API group list: Get "https://api.yourid.run:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate is valid for api-yourid-run, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, localhost, not api.yourid.run
E0523 10:59:59.636441 2585371 memcache.go:265] couldn't get current server API group list: Get "https://api.yourid.run:6443/api?timeout=32s": tls: failed to verify certificate: x509: certificate is valid for api-yourid-run, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, localhost, not api.yourid.run
Unable to connect to the server: tls: failed to verify certificate: x509: certificate is valid for api-yourid-run, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, localhost, not api.yourid.run

If you use k3s, add the domain to ExeStart in the server's service file (/etc/systemd/system/k3s.service), like --tls-san api.yourid.run: 

ExecStart=/usr/local/bin/k3s \
    server \
    --tls-san api.yourid.run \
    --write-kubeconfig-mode 644

Or add the insecure-skip-tls-verify: true option to the yaml file: 

apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: https://api.yourid.run:6443
  name: default
...

See also

Favorite site

author Zer0 sitemap