Cheat Sheets

Context, namespace & discovery

kubectl get — common flags

Apply, create & imperative shortcuts

# Export running deployment to YAML (strip cluster metadata)
kubectl get deploy web -o yaml | kubectl neat > web.yaml

# Generate YAML without creating (exam pattern)
kubectl create deployment web --image=nginx --dry-run=client -o yaml > deploy.yamloc new-app --name=web nginx:1.25
oc expose dc/web
oc get route web -o jsonpath='{.spec.host}'
oc status
oc logs -f dc/web

Pod lifecycle, phases & conditions

Probes — liveness, readiness, startup

readinessProbe:
  httpGet: { path: /health/ready, port: 8080, scheme: HTTP }
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 2
  failureThreshold: 3
livenessProbe:
  httpGet: { path: /health/live, port: 8080 }
  periodSeconds: 20
  failureThreshold: 3
startupProbe:
  httpGet: { path: /health/ready, port: 8080 }
  periodSeconds: 5
  failureThreshold: 30   # 150s startup budget

Resources, QoS & limits

resources:
  requests: { cpu: 250m, memory: 512Mi }
  limits:   { cpu: "1", memory: 512Mi }   # Guaranteed memory QoS

kubectl top pod web-abc -n prod
kubectl describe pod web-abc | grep -A5 "Limits\|Requests\|QoS"

Logs, exec, debug & copy

# Debug toolbox pod (curl, dig, tcpdump, iperf)
kubectl run netshoot --rm -it --restart=Never \
  --image=nicolaka/netshoot -- bash

# Test service DNS from inside cluster
kubectl run tmp --rm -it --restart=Never --image=busybox -- \
  wget -qO- http://web.dev.svc.cluster.local/healthoc logs -f dc/web
oc rsh pod/web-abc
oc exec pod/web-abc -- curl -s localhost:8080
oc debug pod/web-abc -it --image=registry.redhat.io/ubi9/ubi-minimal

Port-forward, proxy & local access

DNS & service discovery

# Inside pod — check DNS
cat /etc/resolv.conf          # nameserver = CoreDNS (10.96.0.10 typical)
nslookup web
dig +short web.dev.svc.cluster.local

Deployment + Service YAML (production baseline)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  labels: { app: web, app.kubernetes.io/name: web }
spec:
  replicas: 3
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate: { maxUnavailable: 0, maxSurge: 1 }
  selector:
    matchLabels: { app: web }
  template:
    metadata:
      labels: { app: web }
    spec:
      serviceAccountName: web
      securityContext:
        runAsNonRoot: true
        seccompProfile: { type: RuntimeDefault }
      containers:
        - name: app
          image: nginx:1.25-alpine@sha256:…
          ports: [{ name: http, containerPort: 8080 }]
          resources:
            requests: { cpu: 100m, memory: 128Mi }
            limits:   { cpu: 500m, memory: 256Mi }
          readinessProbe:
            httpGet: { path: /health/ready, port: http }
            periodSeconds: 10
          livenessProbe:
            httpGet: { path: /health/live, port: http }
            periodSeconds: 20
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: { drop: [ALL] }
---
apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  type: ClusterIP
  selector: { app: web }
  ports:
    - name: http
      port: 80
      targetPort: http

ConfigMap, Secret & Ingress YAML

# ConfigMap — file + key
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  app.properties: |
    server.port=8080
    feature.flags=beta
  LOG_LEVEL: info
---
# Secret — Opaque (base64 values; enable encryption at rest in prod)
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
type: Opaque
stringData:                    # prefer stringData over data in git templates
  DB_PASSWORD: changeme
---
# Mount in pod
envFrom:
  - configMapRef: { name: app-config }
env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef: { name: app-secrets, key: DB_PASSWORD }
volumeMounts:
  - name: config-vol
    mountPath: /etc/app
    readOnly: true
volumes:
  - name: config-vol
    configMap:
      name: app-config
---
# Ingress (requires ingress controller)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls: [{ hosts: [app.example.com], secretName: app-tls }]
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service: { name: web, port: { number: 80 } }

Job, CronJob & HPA snippets

# Job — run to completion
apiVersion: batch/v1
kind: Job
metadata:
  name: migrate-db
spec:
  backoffLimit: 3
  activeDeadlineSeconds: 600
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: migrate
          image: myapp:migrate-v3
          command: ["./migrate.sh"]
---
# CronJob
apiVersion: batch/v1
kind: CronJob
metadata:
  name: nightly-report
spec:
  schedule: "0 2 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: report
              image: myapp:report
---
# HPA — requires metrics-server + CPU requests set
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 70 }

Rollout commands (developer view)

kubectl rollout status deployment/web
kubectl rollout history deployment/web
kubectl rollout undo deployment/web
kubectl rollout undo deployment/web --to-revision=3
kubectl rollout pause deployment/web    # batch manifest changes
kubectl rollout resume deployment/web
kubectl set image deployment/web app=myreg/web:v2.4.1
kubectl set env deployment/web FEATURE_X=trueoc rollout status dc/web
oc rollout history dc/web
oc set env dc/web FEATURE_X=true
oc tag myapp:v2.4.1 web:latest          # ImageStream trigger

RBAC — audit & grant commands

# Minimal Role + RoleBinding
kubectl create role pod-reader --verb=get,list,watch --resource=pods -n dev
kubectl create rolebinding read-pods --role=pod-reader \
  --serviceaccount=dev:ci-runner -n devoc adm policy add-role-to-user edit alice -n dev
oc adm policy add-role-to-group cluster-reader ops-team
oc adm policy who-can get secrets -n prod
oc adm policy add-scc-to-user anyuid -z legacy-sa -n legacy
oc adm policy add-scc-to-group privileged -z operator-sa -n operators

Pod Security Admission (PSA) namespace labels

# Enforce restricted profile on namespace
apiVersion: v1
kind: Namespace
metadata:
  name: prod
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

kubectl label namespace prod \
  pod-security.kubernetes.io/enforce=restricted --overwrite

NetworkPolicy patterns

# Default deny all ingress in namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes: [Ingress]
---
# Allow ingress from same namespace + from ingress-nginx
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-allow
spec:
  podSelector:
    matchLabels: { app: web }
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector: {}
        - namespaceSelector:
            matchLabels: { kubernetes.io/metadata.name: ingress-nginx }
      ports: [{ protocol: TCP, port: 8080 }]
  egress:
    - to:
        - podSelector:
            matchLabels: { app: postgres }
      ports: [{ protocol: TCP, port: 5432 }]
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels: { k8s-app: kube-dns }
      ports: [{ protocol: UDP, port: 53 }]

Helm — install, upgrade, lifecycle

# Production upgrade pattern
helm diff upgrade redis bitnami/redis -f values-prod.yaml -n cache
helm upgrade redis bitnami/redis -f values-prod.yaml -n cache \
  --atomic --cleanup-on-fail --timeout 15m --wait

# OCI registry charts
helm install myapp oci://registry.example.com/charts/myapp --version 1.2.3

Kustomize — base, overlays, patches

# Directory layout
# base/kustomization.yaml  deployment.yaml  service.yaml
# overlays/dev/kustomization.yaml
# overlays/prod/kustomization.yaml

# base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources: [deployment.yaml, service.yaml]
commonLabels: { app.kubernetes.io/managed-by: kustomize }

# overlays/prod/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources: [../../base]
namespace: prod
namePrefix: prod-
replicas: [{ name: web, count: 5 }]
images:
  - name: myapp
    newName: registry.example.com/myapp
    newTag: v2.4.1
patches:
  - path: resources-patch.yaml
  - target: { kind: Deployment, name: web }
    patch: |
      - op: replace
        path: /spec/template/spec/containers/0/resources/limits/memory
        value: 1Gi
configMapGenerator:
  - name: app-config
    literals: [ENV=prod]
secretGenerator:
  - name: app-secrets
    envs: [.env.prod]

kubectl apply -k overlays/prod
kustomize build overlays/prod | kubectl diff -f -

ArgoCD & Flux GitOps

# ArgoCD Application CR (minimal)
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: web
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/org/gitops.git
    path: apps/web/overlays/prod
    targetRevision: main
  destination:
    server: https://kubernetes.default.svc
    namespace: prod
  syncPolicy:
    automated: { prune: true, selfHeal: true }
    syncOptions: [CreateNamespace=true]

Node management — cordon, drain, uncordon

# Safe node maintenance sequence
kubectl cordon node-1                          # no new pods
kubectl drain node-1 \
  --ignore-daemonsets \
  --delete-emptydir-data \
  --grace-period=60 \
  --timeout=15m
kubectl uncordon node-1

# Check node conditions
kubectl describe node node-1 | grep -A5 Conditions
kubectl get nodes -o custom-columns=NAME:.metadata.name,STATUS:.status.conditions[-1].type,TAINTS:.spec.taints

# Taint node for dedicated workload
kubectl taint nodes gpu-1 nvidia.com/gpu=true:NoSchedule
kubectl taint nodes gpu-1 nvidia.com/gpu-:NoSchedule   # removeoc adm cordon node-1
oc adm drain node-1 --ignore-daemonsets --delete-emptydir-data --force
oc adm uncordon node-1
oc get machineconfigpool                          # OCP node update pools

Rollouts, PDB & HPA (platform)

# PodDisruptionBudget — required before drain
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web-pdb
spec:
  minAvailable: 2
  selector:
    matchLabels: { app: web }

kubectl get pdb -A
kubectl rollout status deployment/web -w --timeout=5m

# Force restart all pods (new spec, same image)
kubectl rollout restart deployment/web

Storage — PVC, StorageClass, snapshots

kubectl get sc
kubectl get pvc,pv -A
kubectl describe pvc data-web-0 -n prod

# Expand PVC (StorageClass must allowVolumeExpansion: true)
kubectl patch pvc data-web-0 -n prod \
  -p '{"spec":{"resources":{"requests":{"storage":"20Gi"}}}}'

# VolumeSnapshot
kubectl get volumesnapshot -A
kubectl create -f snapshot.yamloc get storageclass
oc describe pvc data-web-0

Event debugging & cluster triage

Tekton & OpenShift builds

# Tekton (generic K8s)
kubectl get task,pipeline,pipelinerun -n ci
tkn pipeline start build-deploy -p git-url=https://github.com/org/app -w name=shared-workspace,claimName=build-ws
tkn pipelinerun logs -f -n cioc start-build web --from-dir=. --follow
oc logs -f bc/web
oc get builds
oc new-build nodejs~https://github.com/org/app.git
oc import-image nodejs:18 --confirm

cert-manager & External Secrets

# cert-manager Certificate
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: app-tls
spec:
  secretName: app-tls
  issuerRef: { name: letsencrypt-prod, kind: ClusterIssuer }
  dnsNames: [app.example.com]

kubectl get certificate,certificaterequest,clusterissuer -A
kubectl describe certificate app-tls -n prod

# External Secrets Operator
kubectl get externalsecret,secretstore -A

etcd — health, backup & restore

# Snapshot (on control plane node)
ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-$(date +%F-%H%M).db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Restore procedure (disaster — simplified)
# 1. Stop kube-apiserver on all control plane nodes
# 2. ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd.db \
#      --data-dir=/var/lib/etcd-restored --name=etcd-0 \
#      --initial-cluster=etcd-0=https://10.0.0.1:2380 \
#      --initial-advertise-peer-urls=https://10.0.0.1:2380
# 3. Update etcd manifest data-dir; restart etcd → apiserver

# OpenShift
oc adm etcd-backup --backup-dir=/backup
oc adm etcd-snapshot-backup --name=pre-upgrade-$(date +%F)

Scheduling decision matrix

# Taint GPU node
kubectl taint nodes gpu-1 nvidia.com/gpu=present:NoSchedule

# Toleration in pod spec
tolerations:
  - key: nvidia.com/gpu
    operator: Equal
    value: present
    effect: NoSchedule

# Topology spread across zones
topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: topology.kubernetes.io/zone
    whenUnsatisfiable: DoNotSchedule
    labelSelector:
      matchLabels: { app: web }

Taints, effects & use cases

Built-in taints: node.kubernetes.io/not-ready:NoExecute (5min), node.kubernetes.io/unreachable:NoExecute, node.kubernetes.io/disk-pressure:NoSchedule.

Storage — access modes & class comparison

OpenShift SCC reference

# Diagnose SCC failure
oc describe pod failing-pod | tail -20
oc get scc
oc adm policy who-can use scc privileged

# Grant SCC to ServiceAccount (minimal privilege)
oc adm policy add-scc-to-user nonroot-v2 -z myapp-sa -n prod
oc adm policy add-scc-to-user anyuid -z legacy-sa -n legacy

Cluster upgrade checklist

# OpenShift upgrade
oc adm upgrade
oc adm upgrade --to=4.16.8
oc adm upgrade --to-latest=true
oc get clusterversion
oc get mcp -w                         # MachineConfigPool progress
oc get co -w                          # ClusterOperators

# K8s version policy: stay within N-2 of latest minor

Velero — install, backup, restore, schedule

# Install (AWS example)
velero install \
  --provider aws \
  --plugins velero/velero-plugin-for-aws:v1.9.0 \
  --bucket k8s-backups-prod \
  --secret-file ./credentials-velero \
  --backup-location-config region=us-east-1 \
  --snapshot-location-config region=us-east-1 \
  --use-volume-snapshots=true \
  --use-node-agent=false

# Backup
velero backup create daily-$(date +%F) \
  --include-namespaces prod,staging \
  --exclude-resources events,events.events.k8s.io \
  --ttl 720h0m0s

velero backup describe daily-2026-06-05 --details
velero backup logs daily-2026-06-05

# Schedule
velero schedule create nightly \
  --schedule="0 2 * * *" \
  --include-namespaces prod \
  --ttl 168h

# Restore
velero restore create restore-$(date +%F) \
  --from-backup daily-2026-06-05 \
  --include-namespaces prod

velero restore describe restore-2026-06-05
kubectl get restores.velero.io -n velero

Capacity planning & control plane sizing

Production failure matrix

Multi-cluster & service mesh decisions

Disaster recovery — RTO/RPO targets

oc adm — platform administration

oc adm top nodes
oc adm top pods -A
oc adm groups sync --sync-config=ldap-sync.yaml --confirm
oc adm node-logs --role=master --path=openshift-apiserver/
oc adm must-gather                                    # support bundle
oc adm release info 4.16.8                          # release metadata
oc adm upgrade --allow-explicit-upgrade --to=4.16.8
oc adm pod-network join-projects --selector env=prod  # join network
oc adm policy scc-subject review -z myapp-sa -n prod  # which SCC applies
oc get clusteroperators                             # platform health
oc get co -o custom-columns=NAME:.metadata.name,AVAILABLE:.status.conditions[?(@.type=="Available")].status
oc get nodes -o wide
oc debug node/worker-1 -- chroot /host bash         # node shell (OCP 4)

GitOps & platform architecture checklist