Kubectl Command Builder

Compose kubectl commands task-first and keep the cheat sheet at hand — entirely on this device.

0 bytes uploaded

Task

Fill in the details

Namespace (optional)

Label selector (optional)

Caps: every field up to 256 characters; filter queries up to 256.

Switches

-AList across every namespace instead of one — the -n value is dropped while this is on.

-o <format>Change the output format: wide adds node/IP columns, yaml and json dump the objects.

--watchKeep the listing open and print changes as they happen.--show-labelsAppend each pod's labels as a final column.

Share links carry only the task and switch choices — names, namespaces and selectors you type stay on this device.

Pick a task above — the exact kubectl line builds here as you fill in names and switches, with every part explained.

All 28 tasks — the command, its switches and where each one is proven.
Task	Group	Command	Switches	Notes
List pods	Get & describe	`kubectl get pods`	`-A` List across every namespace instead of one — the -n value is dropped while this is on. `-o <format>` Change the output format: wide adds node/IP columns, yaml and json dump the objects. `--watch` Keep the listing open and print changes as they happen. `--show-labels` Append each pod's labels as a final column.	Lists pods in the current namespace — the first look at almost every incident.Derived from the kubectl reference — not run here (no cluster on this machine).
List services	Get & describe	`kubectl get services`	`-A` List across every namespace instead of one — the -n value is dropped while this is on. `-o <format>` Change the output format: wide adds node/IP columns, yaml and json dump the objects. `--show-labels` Append each service's labels as a final column.	Lists services with their cluster IPs and exposed ports.Derived from the kubectl reference — not run here (no cluster on this machine).
Describe a pod	Get & describe	`kubectl describe pod <pod>`	—	Prints the pod's full state including the Events section — where scheduling and image-pull failures actually surface.Derived from the kubectl reference — not run here (no cluster on this machine).
Dump a pod as YAML	Get & describe	`kubectl get pod <pod> -o yaml`	—	Prints the live object exactly as the API server stores it.Derived from the kubectl reference — not run here (no cluster on this machine).
Print a pod's logs	Logs	`kubectl logs <pod>`	`-f` Stream new log lines as they arrive instead of exiting after the current tail. `--previous` Read the PREVIOUS container instance's log — the one that just crashed — instead of the running one. `--since=<duration>` Only return lines newer than this relative duration. `--timestamps` Prefix every line with its RFC 3339 timestamp. `-c required` The pod runs more than one container, so kubectl needs -c — naming the container becomes required.	Prints the current container log of one pod.Derived from the kubectl reference — not run here (no cluster on this machine).
Logs of a deployment	Logs	`kubectl logs deployment/<deployment>`	`-f` Stream new log lines as they arrive instead of exiting after the current tail. `--since=<duration>` Only return lines newer than this relative duration.	Reads logs through the deployment — kubectl picks one pod for you.Derived from the kubectl reference — not run here (no cluster on this machine).
Logs by label selector	Logs	`kubectl logs -l <selector>`	`-f` Stream new log lines as they arrive instead of exiting after the current tail. `--since=<duration>` Only return lines newer than this relative duration. `--prefix` Prefix each line with its pod and container name so interleaved streams stay readable. `--all-containers` Include every container of each matched pod, not just the first.	Streams logs from every pod matching a label selector at once.Derived from the kubectl reference — not run here (no cluster on this machine).
Open a shell in a pod	Exec	`kubectl exec -it <pod> -- sh`	`-- <shell>` Which shell to start — minimal images ship only sh; bash must exist in the image. `-c required` The pod runs more than one container, so kubectl needs -c — naming the container becomes required.	Starts an interactive shell inside the container — -i keeps stdin open, -t allocates the TTY.Derived from the kubectl reference — not run here (no cluster on this machine).
Run one command in a pod	Exec	`kubectl exec <pod> -- sh -c '<command>'`	`-c required` The pod runs more than one container, so kubectl needs -c — naming the container becomes required.	Runs a single command via the container's sh and exits — the command rides as ONE quoted argument, so pipes and globs run inside the pod, not on your machine.Derived from the kubectl reference — not run here (no cluster on this machine).
Forward a local port to a pod	Port-forward	`kubectl port-forward <pod> <local>:<remote>`	`--address 0.0.0.0` Listen on every interface instead of localhost only — anyone who can reach your machine reaches the pod.	Tunnels localhost:<local> to the pod's <remote> port for as long as the command keeps running.Derived from the kubectl reference — not run here (no cluster on this machine).
Forward a local port to a service	Port-forward	`kubectl port-forward svc/<service> <local>:<remote>`	`--address 0.0.0.0` Listen on every interface instead of localhost only — anyone who can reach your machine reaches the service.	Same tunnel, addressed through a service — kubectl picks a backing pod.Derived from the kubectl reference — not run here (no cluster on this machine).
Apply a manifest file	Apply & delete	`kubectl apply -f <file>`	`--dry-run=client` Print what would be sent without persisting anything — a purely local rehearsal.	Creates or updates whatever the manifest declares (server-side merge).Derived from the kubectl reference — not run here (no cluster on this machine).
Apply a kustomize directory	Apply & delete	`kubectl apply -k <dir>`	`--dry-run=client` Print what would be sent without persisting anything — a purely local rehearsal.	Renders the kustomization in <dir> and applies the result.Derived from the kubectl reference — not run here (no cluster on this machine).
Delete a pod	Apply & delete	`kubectl delete pod <pod>`	`--now` Shut down with a 1-second grace period instead of the pod's configured one.	Deletes the pod (a Deployment replaces it; a bare pod is gone). Graceful by default.Derived from the kubectl reference — not run here (no cluster on this machine).
Delete what a manifest created	Apply & delete	`kubectl delete -f <file>`	—	Deletes every object the manifest declares — the apply's exact inverse.Derived from the kubectl reference — not run here (no cluster on this machine).
Watch a rollout finish	Rollout	`kubectl rollout status deployment/<deployment>`	—	Blocks until the deployment converges — the honest way to wait in CI.Derived from the kubectl reference — not run here (no cluster on this machine).
Roll back a deployment	Rollout	`kubectl rollout undo deployment/<deployment>`	—	Reverts to the previous ReplicaSet revision.Derived from the kubectl reference — not run here (no cluster on this machine).
Restart a deployment's pods	Rollout	`kubectl rollout restart deployment/<deployment>`	—	Rolls every pod without changing the spec — the clean way to pick up a new ConfigMap or Secret.Derived from the kubectl reference — not run here (no cluster on this machine).
Scale a deployment	Scale	`kubectl scale deployment/<deployment> --replicas=<replicas>`	—	Sets the replica count directly — an HPA will fight you for it if one targets this deployment.Derived from the kubectl reference — not run here (no cluster on this machine).
Pod CPU and memory	Top (metrics)	`kubectl top pods`	`-A` List across every namespace instead of one — the -n value is dropped while this is on.	Live CPU/memory per pod, as the metrics API reports it.Prerequisite: Needs the metrics-server add-on in the cluster — without it kubectl top returns an error, not zeros.Derived from the kubectl reference — not run here (no cluster on this machine).
Node CPU and memory	Top (metrics)	`kubectl top nodes`	—	Live CPU/memory per node — the quick capacity check.Prerequisite: Needs the metrics-server add-on in the cluster — without it kubectl top returns an error, not zeros.Derived from the kubectl reference — not run here (no cluster on this machine).
Print the client version	Config & contexts	`kubectl version --client`	—	Prints the kubectl and kustomize versions without contacting any cluster.Executed on this machine (Client Version: v1.36.1) — no cluster involved.
Show the merged kubeconfig	Config & contexts	`kubectl config view`	`--minify` Reduce the output to just the current context's entries.	Prints the merged kubeconfig with credentials REDACTED by default.Executed on this machine (Client Version: v1.36.1) — no cluster involved.
List contexts	Config & contexts	`kubectl config get-contexts`	—	Lists every context in your kubeconfig and marks the current one.Executed on this machine (Client Version: v1.36.1) — no cluster involved.
Switch context	Config & contexts	`kubectl config use-context <context>`	—	Changes which cluster/user pair every following kubectl command talks to — it rewrites your kubeconfig's current-context.Derived from the kubectl reference — not run here (no cluster on this machine).
Attach a debug container	Debug & cp	`kubectl debug -it <pod> --image=busybox`	`--image=<image>` The tool image the ephemeral container runs.	Adds an ephemeral container to the running pod — the way into distroless images that have no shell.Derived from the kubectl reference — not run here (no cluster on this machine).
Copy a file out of a pod	Debug & cp	`kubectl cp <pod>:<source> <destination>`	—	Copies a file from the container's filesystem to your machine (needs tar in the image).Derived from the kubectl reference — not run here (no cluster on this machine).
Recent events, oldest first	Events	`kubectl get events --sort-by=.metadata.creationTimestamp`	`-A` List across every namespace instead of one — the -n value is dropped while this is on. `--watch` Keep the listing open and print changes as they happen.	The cluster's recent event stream sorted by creation time — where crash loops and failed pulls announce themselves.Derived from the kubectl reference — not run here (no cluster on this machine).

Where these commands come from

This machine runs kubectl v1.36.1 as a bare client with no cluster attached, so only the cluster-less lines here were executed for real — the version probe and the read-only kubeconfig commands, run against an empty config. Every line that needs a running cluster is derived from the kubernetes.io kubectl reference instead, and its table row says so. Nothing you type is sent anywhere or executed by this page.

Do it offline:$ kubectl version --client

How to use it

Choose a task from the menu. The builder shows only the details that task needs — a pod name, a namespace, maybe a label selector — and the command card updates as you type, refusing values Kubernetes itself would refuse.
Toggle the switches you want. Each one names its real flag, -f or --previous or --dry-run=client, and says in one line what it changes, so the card doubles as a flag glossary.
Copy the finished line, or press / and filter the cheat sheet below when you'd rather scan — every row keeps a stable #task- anchor you can hand to a teammate mid-incident.

Pick what you're trying to do — tail logs, free a stuck rollout, tunnel a port — and this page composes the exact kubectl line, flag by flag, with every part explained. All 28 tasks sit in a searchable table underneath. Everything is assembled in your browser: nothing you type is sent anywhere, and no command is ever run.

Examples

Follow one pod's logs in a namespace

kubectl logs api-0 -n prod -f

Derived from the kubectl reference — this machine has no cluster to run it against. -f keeps the stream open; add --previous instead when the container just crashed and you need its last words.

List pods matching a label selector

kubectl get pods -n prod -l 'app=web,tier!=cache'

Reference-derived. The selector is always single-quoted here: '!' and parentheses are live characters in a shell, and an unquoted tier!=cache can detonate history expansion in interactive shells.

Run one command inside a pod

kubectl exec web-0 -- sh -c 'df -h /var'

Reference-derived. Your one-liner rides as a single quoted argument to the container's sh, so the pipe or glob you wrote executes in the pod — not on the machine you pasted it into.

Check which kubectl you have

kubectl version --client

Executed on this machine while building this page — it printed Client Version: v1.36.1 and Kustomize Version: v5.8.1, and the checked-in golden holds that output byte-for-byte. It is one of the few kubectl commands that needs no cluster at all.

Every example on this page is executed against the same engine that powers the tool, on every build.

Gotchas worth knowing

Context and namespace are different axes

A context picks WHICH cluster (and user) you talk to; -n picks a namespace INSIDE it. use-context rewrites your kubeconfig's current-context, so it outlives the terminal — while -n lasts for one command. Production incidents love the person who checked get-contexts first.

-it is two flags, and scripts want neither

-i keeps stdin open, -t asks for a TTY. In a pipeline or CI job there is no terminal to allocate, so -t fails with a TTY error — that is why the run-one-command task omits -it entirely and only the interactive shell task carries it.

port-forward lives exactly as long as its process

The tunnel is the foreground kubectl process; Ctrl-C ends it, a dropped connection ends it, and it never reconnects by itself. Treat it as a debugging cable, not infrastructure — and know that --address 0.0.0.0 shares that cable with your whole network.

kubectl top is an add-on answering, not a built-in

Both top tasks query the metrics API, which only exists once metrics-server (or an equivalent) runs in the cluster. Without it you get an error about metrics not being available — an install gap, not a permissions one.

What this page refuses to do

It never executes anything, never reads a kubeconfig, and has no place to paste one — a kubeconfig is a credential file. It also stops at kubectl itself: no helm, no k9s, and no editing of what your manifests contain. Cron schedules for CronJob resources have their own helper on this site, and the same task-first idiom exists for git commands.

Common errors

Kubernetes will refuse that name — DNS-1123: lowercase letters, digits, '-' and '.', starting and ending alphanumeric.: Raised while you type, from the same RFC 1123 rule the API server applies. Uppercase is the classic trip: Web-Frontend is a fine label VALUE but can never be a pod name.
That label selector doesn't parse — use key=value, key!=value, key in (a, b), key notin (a, b), key or !key, comma-separated.: The builder parses selectors with the documented grammar before quoting them, so a stray comma or an empty in () list is caught here instead of becoming a silent empty result in the cluster.
Multi-container pod: kubectl needs -c — name the container to target.: logs and exec address one container. Against a multi-container pod without -c, kubectl either guesses or errors with the container list — tick the multi-container switch and the builder makes the -c field mandatory up front.

FAQ

Does this page run kubectl or touch my cluster?

No. It assembles command text and stops there — there is no execution path, no upload, and no input that accepts a kubeconfig. The only lines marked as executed were run once, on the machine that built this page, against an empty config with no cluster, and their output ships as frozen text.

Why are some rows marked executed and the rest reference-derived?

Honesty about provenance. A kubectl client with no cluster can prove version --client and the read-only kubeconfig commands by running them, so those rows carry real recorded output. Anything that needs a live API server — get, logs, rollout — is instead checked against the kubernetes.io kubectl reference, and each row's notes say which kind it is.

Which kubectl version do these commands assume?

The pack was written against the v1.36 client and the current kubernetes.io reference. Every flag on this page is long-stable — -n, -l, -f, --dry-run=client — so the lines work years back; the one youngish member is kubectl debug's ephemeral containers, stable since Kubernetes 1.25.

Keyboard shortcuts

/: Focus the filter box

Nothing you paste here leaves this tab. State only ever travels in links you explicitly create.

kubectl Quick Reference — kubernetes.io (the upstream this cheat sheet is derived from) · kubectl reference documentation — kubernetes.io · Labels and Selectors — Kubernetes concepts (the selector grammar)

Last reviewed: 2026-08-18