kubectl Fundamentals

Imperative Verbs

kubectl is a REST client: each command maps to an HTTP verb on an API path. The core set:

kubectl get pods -n prod -o wide          # list with node and pod IP
kubectl describe pod web-7d9f-x2n9l       # object plus recent events
kubectl logs -f deploy/web --all-containers
kubectl exec -it web-7d9f-x2n9l -- sh     # shell into a running container
kubectl delete pod web-7d9f-x2n9l
kubectl top pods                          # needs metrics-server

Output formats change what you can see: -o yaml returns the full server object, -o jsonpath='{.status.phase}' extracts one field, and -o wide adds node and IP. describe is the debugging entry point because it appends scheduler and kubelet events beneath the spec.

Contexts, Namespaces, and Edits

A kubeconfig holds clusters, users, and contexts; the current context selects both endpoint and credentials:

kubectl config get-contexts
kubectl config use-context staging-admin
kubectl config set-context --current --namespace=payments

Guard destructive work with explicit scope and a rehearsal:

kubectl -n staging delete pod -l app=web --dry-run=server
kubectl diff -f web.yaml

Prefer kubectl apply -f on files tracked in Git. kubectl edit opens the object in your editor and PATCHes only the diff — fine for a hotfix, invisible to code review afterward. Use kubectl apply --dry-run=client to validate syntax before any cluster write.

Common kubectl Traps

Pitfall 1 — default namespace drift. Commands without -n act on default, and a mistyped resource type can delete something unintended. Pin your context namespace (see above) and use kubectl api-resources to confirm short names like deploy or rs.

Pitfall 2 — logs after a restart. kubectl logs shows the current container only; for the crashed one use --previous (-p), which requires the container to have terminated.

Interview-ready: state your debugging order — get for state, describe for events, logs for output, exec to inspect — plus the request path kubectl → apiserver (auth and RBAC) → object, and --dry-run=server as the final safety net.