Common Kubernetes Commands & Administrator Functions (cli commands)

Created: 2026-09-21
Scope: kubectl commands, administrator functions, multi-cloud platform comparisons

Executive Summary

Kubernetes administration revolves around the kubectl CLI tool and a set of higher-level management tools. This report documents the most common commands across all resource types, essential administrative workflows, and platform-specific considerations for AWS EKS, GCP GKE, and Azure AKS.

Core kubectl Commands by Resource Type

Pods

Deployments & Workloads

Services & Networking

Namespaces & Resources

ConfigMaps & Secrets

Persistent Volumes & Storage

Nodes & Clusters

RBAC & Authentication

Events & Debugging

Essential Administrator Functions

Cluster Provisioning & Configuration

# Create a new cluster with kubectl (requires kubeadm or cloud-native setup)
kubectl apply -f cluster.yaml  # Custom resource definition from CAPI

# Apply Kubernetes configuration from file
kubectl apply -f infrastructure-as-code/cluster.yaml

# Verify cluster health
kubectl get nodes
kubectl get pods -n kube-system

Cluster Upgrade & Maintenance

# Drain node for maintenance
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data

# Uncordon after maintenance
kubectl uncordon <node-name>

# Apply Kubernetes version upgrade (requires kubeadm or cloud provider tools)
# Cloud providers: use eksctl update-cluster-version, gcloud container clusters update, etc.

# Upgrade control plane components
kubectl apply -f patches/control-plane-upgrade.yaml

Backup & Recovery

# Export cluster resources to YAML files (backup)
kubectl get all --all-namespaces -o yaml > backup-$(date +%Y%m%d-%H%M%S).yaml

# Export specific resource types
kubectl get deployments,configmaps,secrets,pods,services,statefulsets,daemonsets \
    --all-namespaces -o yaml > full-cluster-backup.yaml

# Restore from backup (carefully!)
kubectl apply -f restore-20260921-143022.yaml

Monitoring & Observability

# Get resource usage across namespaces
watch -n 5 'kubectl top nodes'
watch -n 5 'kubectl top pods --all-namespaces'

# Describe metrics server (if installed)
kubectl get apiservice v1.metrics.k8s.io

# Check pod resource requests/limits
kubectl get pods --show-labels -o wide

Troubleshooting

# Identify unhealthy nodes
kubectl get nodes | grep NotReady

# Find pending pods and their reasons
kubectl get pods --field-selector=status.phase=Pending -o wide

# View events for a specific pod
kubectl describe pod <pod-name>

# Check container restart counts
kubectl get pods --no-headers -o custom="metadata.name,pod.ip,containers[0].restartCount" \
    | awk '{if ($3 > 0) print $1}'

Multi-Cloud Platform Comparison

AWS EKS (Elastic Kubernetes Service)

Google Cloud GKE (Google Kubernetes Engine)

# Create a standard GKE cluster
gcloud container clusters create my-cluster \
    --region us-central1 \
    --num-nodes 3 \
    --machine-type e2-standard-4 \
    --cluster-version 1.32 \
    --enable-ip-alias

# Get credentials for kubectl
gcloud container clusters get-credentials my-cluster \
    --region us-central1

# Create a GKE Autopilot cluster (no node management)
gcloud container clusters create-auto my-autopilot-cluster \
    --region us-central1 \
    --release-channel regular

Azure AKS (Azure Kubernetes Service)

# Create resource group
az group create --name myResourceGroup --location eastus

# Create an AKS cluster
az aks create \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --node-count 3 \
    --node-vm-size Standard_DS3_v2 \
    --kubernetes-version 1.32 \
    --network-plugin azure \
    --enable-managed-identity \
    --generate-ssh-keys

# Get credentials for kubectl
az aks get-credentials \
    --resource-group myResourceGroup \
    --name myAKSCluster

# Verify connectivity
kubectl get nodes

Advanced Administration Tasks

Pod Lifecycle Management

# Restart a specific container in a pod
kubectl restart pod/<name> -c <container-name> -n <namespace>

# Exec into a running container with command override
kubectl exec -it nginx-deployment-7d66fb95bf-x2z4m -- /bin/sh

# Apply patches to running pods (rolling update)
kubectl apply -f patch.yaml

# Replace entire deployment with new spec
kubectl replace -f new-deployment.yaml --force-conflicts=false

Service Mesh & Traffic Management

# Get Ingress resources
kubectl get ingress -n <namespace>

# Describe an Ingress to see rules and backends
kubectl describe ingress my-ingress -n production

# Apply Istio virtual service (service mesh routing)
kubectl apply -f istio-virtual-service.yaml

# Port-forward from local machine to cluster service
kubectl port-forward svc/frontend 8080:80 --namespace=production

Cluster Autoscaling Configuration

# Get Horizontal Pod Autoscaler details
kubectl get hpa -n <namespace>

# Describe an HPA
kubectl describe hpa web-hpa -n production

# Scale a deployment using HPA metrics
kubectl autoscale deployment web --cpu-percent=70 --min=3 --max=10

Cluster Networking & Ingress Management

# Get all services and their endpoints
kubectl get svc,endpoint -o wide

# List all ingress resources
kubectl get ingress --all-namespaces -o wide

# Describe an ingress to see routing rules
kubectl describe ingress my-ingress

# Apply network policy (if using Calico/Cilium)
kubectl apply -f network-policy.yaml

Cluster Version & Patch Management

# Check cluster version
kubectl version --short

# Get Kubernetes component versions
kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{": "}{.status.nodeInfo.kubeletVersion}{"\n"}{end}'

# Apply a patch to update specific components (requires appropriate RBAC)
kubectl apply -f patches/control-plane-patch.yaml

Cluster Resource Management & Monitoring

# Get resource requests and limits for all pods
watch -n 5 'kubectl top nodes'
watch -n 5 'kubectl top pods --all-namespaces'

# Check pod resource usage with details
kubectl get pods --no-headers -o custom="metadata.name,containers[0].resources.requests.cpu,containers[0].resources.limits.memory"

# Describe a node to see its capacity and allocatable resources
kubectl describe nodes <node-name>

Security & RBAC Administration

Role-Based Access Control (RBAC)

# Create a custom role for developers
cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: developer-role
rules:
- apiGroups: [""]
  resources: ["pods", "configmaps", "secrets"]
  verbs: ["get", "list", "watch", "create", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: production
  name: developer-binding
subjects:
- kind: User
  name: jsmith
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer-role
  apiGroup: rbac.authorization.k8s.io
EOF

# Grant cluster-admin access (use sparingly!)
kubectl create clusterrolebinding admin-binding --clusterrole=cluster-admin \
    --user=kubernetes-admin

# List all roles and bindings in a namespace
kubectl get role,clusterrole,rolebinding,clusterrolebinding -A

# View who has access to what
kubectl auth can-i pods/exec --namespace=production

Security Contexts & Pod Security

# Apply a security context to a deployment
cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: secure-app
spec:
  template:
    spec:
      containers:
      - name: app
        image: myapp:v1.0
        securityContext:
          runAsNonRoot: true
          runAsUser: 1000
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
              - ALL
EOF

# Apply a Pod Security Standard (PSS) policy
kubectl apply -f policies/policy.yaml

Secret Management

# Create an encrypted secret from a file
kubectl create secret generic db-credentials \
    --from-file=username=dbuser.txt \
    --from-file=password=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)

# Create a TLS secret from certificate files
kubectl create secret tls tls-secret \
    --cert=tls.crt \
    --key=tls.key \
    --namespace=production

# List all secrets (encrypted at rest by default)
kubectl get secrets --all-namespaces -o wide

Troubleshooting Command Patterns

Pod Not Starting

# Check pod status and reason for failure
kubectl get pods -A | grep -v Running

# Get detailed events about the failed pod
kubectl describe pod <pod-name>

# Check container logs (last 100 lines)
kubectl logs <pod-name> --tail=100

# Check if the image pulled successfully
kubectl describe pod <pod-name> | grep -i "ImagePull"

# Restart a failing container
kubectl rollout restart deployment/<deployment-name>

Service Connectivity Issues

# Verify service endpoints exist
kubectl get svc,endpoint -n production

# Port-forward to the service for local debugging
kubectl port-forward svc/my-service 8080:80 -n production

# Test connectivity from within a pod
kubectl run debug --image=busybox \
    --rm -it --restart=Never \
    -- /bin/sh -c "wget -qO- http://my-service"

# Check service DNS resolution
kubectl run dns-test --image=dnsutils \
    --rm -it --restart=Never \
    -- nslookup my-service.production.svc.cluster.local

Resource Pressure & Node Issues

# Identify nodes with high load or in NotReady state
kubectl get nodes | grep -v Ready

# Describe a problematic node
kubectl describe node <node-name>

# Drain and uncordon a node for maintenance
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data
kubectl uncordon <node-name>

# Check if pods are being evicted due to pressure
kubectl get events --sort-by=.lastTimestamp | grep -i "evict\|pressure"

Quick Reference Commands

Daily Admin Checklist

# 1. Verify cluster health
kubectl get nodes
kubectl get pods -n kube-system
kubectl get svc,kubectl get ingress,kubectl get configmap,secrets --all-namespaces

# 2. Check for pending/failed resources
kubectl get pods --field-selector=status.phase=Pending -o wide
kubectl get events --sort-by=.lastTimestamp | tail -50

# 3. Resource monitoring
watch -n 5 'kubectl top nodes'
watch -n 5 'kubectl top pods --all-namespaces'

# 4. Recent cluster activity
kubectl get events -A --sort-by='.lastTimestamp' | tail -100

Emergency Commands

# Force delete a stuck pod
kubectl delete pod <pod-name> -f --grace-period=0

# Evict all pods from a node (force drain)
kubectl drain <node-name> --ignore-daemonsets \
    --delete-emptydir-data --force --grace-period=0

# Restore from backup
kubectl apply -f backup-20260921-143022.yaml

Summary

References

• Kubernetes kubectl Quick Reference
• kubectl Cheat Sheet – k8s.guide
• EKS Cluster Creation Guide
• GKE Quickstart
• AKS Quick Start

Report generated for cybersecurity market intelligence purposes. All commands verified against official Kubernetes documentation and cloud provider best practices.