Selma Guedidi

Posted on Apr 29

kubectl Hacks That Changed How I Work With Kubernetes

#kubernetes #devops #automation #containers

Beyond the basics: patching, waiting, explaining, and squeezing the most out of the one tool that never leaves your terminal.

Most kubectl guides stop at get pods and apply -f. That's fine for getting started, but after years of running Kubernetes in production, the commands that make the real difference are the ones nobody writes about. The obscure flags. The output tricks. The commands that turn a 20-minute debugging slog into a 90-second fix.

This article is about the depth of kubectl: commands I reach for when things get weird, scripting patterns that made our CI pipelines solid, and the shorthand vocabulary that turns the tool from a keyboard workout into something that actually feels fast. No fluff, no padding. Just the stuff worth knowing.

01 — The Complete Shorthand Vocabulary

Before anything else: the complete list of resource type abbreviations. These are baked into the Kubernetes API itself, so they work universally across get, describe, delete, patch, edit, and every other verb. Memorise the ones you use daily and your hands will thank you.

Short	Full Resource Name	API Group
`po`	pods	core
`svc`	services	core
`deploy`	deployments	apps
`ds`	daemonsets	apps
`rs`	replicasets	apps
`sts`	statefulsets	apps
`ns`	namespaces	core
`cm`	configmaps	core
`ing`	ingresses	networking.k8s.io
`pv`	persistentvolumes	core
`pvc`	persistentvolumeclaims	core
`sa`	serviceaccounts	core
`ep`	endpoints	core
`no`	nodes	core
`ev`	events	core
`hpa`	horizontalpodautoscalers	autoscaling
`pdb`	poddisruptionbudgets	policy
`crd`	customresourcedefinitions	apiextensions.k8s.io
`crb`	clusterrolebindings	rbac.authorization.k8s.io
`rb`	rolebindings	rbac.authorization.k8s.io
`netpol`	networkpolicies	networking.k8s.io
`sc`	storageclasses	storage.k8s.io
`job`	jobs	batch
`cj`	cronjobs	batch
`quota`	resourcequotas	core
`sec`	secrets	core

💡 Pro tip: Run kubectl api-resources in your cluster to see every available shorthand, including those from installed CRDs. It shows the short name, API group, whether the resource is namespaced, and the kind.

02 — kubectl patch: The Surgeon's Tool

kubectl apply is great when you own the full manifest. But what about changing a single field on a resource managed by a Helm chart, an operator, or another team? You don't want to touch the whole file. You want a scalpel. That's kubectl patch.

There are three patch types, and picking the wrong one will lose you data or produce confusing merges.

Type	Behaviour	When to use
`strategic-merge`	Kubernetes-aware merge. Containers are merged by name, not replaced.	Default. Use most of the time.
`merge`	RFC 7396 JSON Merge. Arrays are replaced entirely, not merged.	CRDs and non-core resources.
`json`	RFC 6902. Precise add / remove / replace / move operations.	When you need surgical precision.

# Add an annotation without touching the rest of the manifest
kubectl patch deploy api-gateway -p '{"metadata":{"annotations":{"deploy-time":"2026-04-27"}}}' -n production

# Change replica count on the fly (useful in incidents)
kubectl patch deploy api-gateway -p '{"spec":{"replicas":6}}' -n production

# Remove a field entirely with JSON patch
kubectl patch deploy api-gateway --type=json \
  -p='[{"op":"remove","path":"/spec/template/spec/containers/0/resources/limits/cpu"}]' -n production

# Replace a specific env var value by index
kubectl patch deploy api-gateway --type=json \
  -p='[{"op":"replace","path":"/spec/template/spec/containers/0/env/0/value","value":"https://new-db-host"}]'

# Cordon a node : what kubectl cordon does under the hood
kubectl patch node ip-10-0-1-47 -p '{"spec":{"unschedulable":true}}'

# Add a label to a node using json patch
kubectl patch node ip-10-0-1-47 --type=json \
  -p='[{"op":"add","path":"/metadata/labels/topology.kubernetes.io~1zone","value":"us-east-1a"}]'

⚠️ Watch out: The / character in JSON Patch paths refers to object keys. If your key contains a forward slash (like kubernetes.io/role), escape it as ~1. The tilde ~ itself escapes as ~0. Easy to forget, expensive when wrong.

03 — kubectl wait: The CI/CD Game Changer

If you write shell scripts or CI pipelines that deploy to Kubernetes, you've probably written something like: deploy → sleep 30 → check status → sleep more → give up. It's flaky and slow. kubectl wait replaces all of that with a proper event-driven block.

# Block until a deployment finishes rolling out (timeout after 3 minutes)
kubectl wait deploy/api-gateway --for=condition=Available --timeout=3m -n production

# Wait for all pods with a label to be Ready
kubectl wait pods -l app=api-gateway --for=condition=Ready --timeout=2m -n production

# Wait for a Job to complete
kubectl wait job/db-migration --for=condition=Complete --timeout=10m -n production

# Wait for a Job to fail (useful for catching broken migrations early)
kubectl wait job/db-migration --for=condition=Failed --timeout=10m -n production

# Wait for a node to be Ready after a restart
kubectl wait node/ip-10-0-1-47 --for=condition=Ready --timeout=5m

# Wait for a CRD to be established (important in Helm chart init containers)
kubectl wait crd/certificates.cert-manager.io --for=condition=Established --timeout=60s

# Wait for a pod to be deleted
kubectl wait pod/old-pod-abc123 --for=delete --timeout=60s -n production

The --for=delete form is especially valuable. Whenever you need to drain a node or delete a pod and then take some action only after it's truly gone, this is your signal. No polling loops, no racy sleep calls.

💡 CI pattern: Chain kubectl apply and kubectl wait in your pipeline. If the wait times out, the pipeline fails with a non-zero exit code, no extra health-check scripts needed. You get free deploy verification.

04 — kubectl explain: The Docs Are Already in Your Terminal

Every time I see someone switching to a browser to look up what a field does in a Kubernetes spec, I cringe. The full API reference is built right into kubectl explain. It supports dot-notation for nested fields and --recursive to print the entire schema tree.

# What is a PodSpec?
kubectl explain pod.spec

# What fields does a container accept?
kubectl explain pod.spec.containers

# Go deep on a specific field
kubectl explain pod.spec.containers.resources.requests

# Print the entire schema tree for a resource
kubectl explain deployment --recursive

# Works on CRDs too
kubectl explain certificate.spec.renewBefore

# Check what API version a resource uses
kubectl explain horizontalpodautoscaler --api-version=autoscaling/v2

The --recursive output looks dense at first but becomes invaluable when you're unfamiliar with a CRD's schema. Pipe it through grep to find the field you care about rather than reading a thousand-line GitHub README.

05 — kubectl cp: Moving Files In and Out of Containers

This one saves you in two specific scenarios: extracting a generated file from a container (a rendered config, a certificate, a data dump), and pushing a temporary script into a running pod when you can't rebuild the image. It behaves like scp with a slightly different path syntax.

# Copy a file OUT of a container
kubectl cp production/api-pod-7d4f8b:/app/logs/error.log ./error.log

# Copy a file INTO a container
kubectl cp ./debug-script.sh production/api-pod-7d4f8b:/tmp/debug-script.sh

# Copy a whole directory out
kubectl cp production/api-pod-7d4f8b:/app/data ./data-backup

# Specify a container in a multi-container pod
kubectl cp production/api-pod-7d4f8b:/var/log/app.log ./app.log -c sidecar-logger

# Format: [namespace/]pod-name:path

⚠️ Heads up: kubectl cp requires tar to be present inside the container. Distroless images don't have it. If you hit that wall, use kubectl debug to attach a debug sidecar first, then copy from there.

06 — Generating YAML Without Writing YAML

The --dry-run=client -o yaml pattern lets kubectl write your manifests for you. Here's a full set of imperative-to-declarative shortcuts that produce valid, committable YAML.

# Deployment manifest
kubectl create deploy api-gateway --image=ghcr.io/myorg/api:v2.3 --replicas=3 \
  --dry-run=client -o yaml > deployment.yaml

# Service (ClusterIP)
kubectl create svc clusterip api-gateway --tcp=80:8080 --dry-run=client -o yaml

# Service (LoadBalancer)
kubectl create svc loadbalancer api-lb --tcp=443:8443 --dry-run=client -o yaml

# ConfigMap from file and literals
kubectl create cm app-config \
  --from-file=config.yaml \
  --from-literal=LOG_LEVEL=info \
  --from-literal=REGION=eu-west-1 \
  --dry-run=client -o yaml

# Secret (generic)
kubectl create secret generic db-creds \
  --from-literal=username=admin \
  --from-literal=password=hunter2 \
  --dry-run=client -o yaml

# Secret (TLS)
kubectl create secret tls api-tls --cert=tls.crt --key=tls.key --dry-run=client -o yaml

# Job
kubectl create job db-migration --image=ghcr.io/myorg/migrator:v1 --dry-run=client -o yaml

# CronJob
kubectl create cronjob nightly-report --image=ghcr.io/myorg/reporter:v1 \
  --schedule="0 2 * * *" --dry-run=client -o yaml

# ServiceAccount
kubectl create sa api-worker --dry-run=client -o yaml

# Role
kubectl create role pod-reader --verb=get,list,watch --resource=pods --dry-run=client -o yaml

# RoleBinding
kubectl create rolebinding api-pod-reader \
  --role=pod-reader --serviceaccount=production:api-worker \
  --dry-run=client -o yaml

07 — kubectl set: In-Place Updates Without Editing YAML

When you need to change a single well-defined property on a running resource, kubectl set is cleaner than patching raw JSON.

# Update the image of a single container
kubectl set image deploy/api-gateway api=ghcr.io/myorg/api:v2.4 -n production

# Update multiple containers at once
kubectl set image deploy/api-gateway api=ghcr.io/myorg/api:v2.4 sidecar=ghcr.io/myorg/proxy:v1.1

# Set resource requests and limits
kubectl set resources deploy/api-gateway \
  -c api \
  --requests=cpu=250m,memory=512Mi \
  --limits=cpu=1000m,memory=1Gi -n production

# Assign a service account
kubectl set serviceaccount deploy/api-gateway api-worker -n production

# Add or update an environment variable
kubectl set env deploy/api-gateway LOG_LEVEL=debug -n production

# Set env from a ConfigMap
kubectl set env deploy/api-gateway --from=configmap/app-config -n production

# Set env from a Secret
kubectl set env deploy/api-gateway --from=secret/db-creds -n production

# Remove an env var (suffix with a minus)
kubectl set env deploy/api-gateway LOG_LEVEL- -n production

ℹ️ Note: kubectl set image records the change in the deployment's rollout history, which means you can kubectl rollout undo it just like a kubectl apply. It's not a dirty in-place hack, it's a first-class operation.

08 — Labels, Annotations, and Taints: The Metadata Commands

Labels and annotations are the connective tissue of Kubernetes. Services find their pods through labels. Operators read annotations for config. Knowing how to manipulate this metadata live, without opening a YAML file, is surprisingly powerful.

# Add a label to a pod
kubectl label pod api-pod-7d4f8b version=v2.4 -n production

# Overwrite an existing label
kubectl label pod api-pod-7d4f8b version=v2.5 -n production --overwrite

# Remove a label (suffix with a minus)
kubectl label pod api-pod-7d4f8b version- -n production

# Label all pods matching a selector
kubectl label pods -l app=api-gateway canary=true -n production

# Label a node for topology-aware scheduling
kubectl label node ip-10-0-1-47 disk=ssd zone=us-east-1a

# Add an annotation
kubectl annotate deploy/api-gateway \
  deployment.kubernetes.io/revision-message="hotfix: null pointer on /checkout" -n production

# Taint a node so only tolerating pods schedule on it
kubectl taint node ip-10-0-1-47 dedicated=gpu-workloads:NoSchedule

# Remove a taint (suffix the effect with a minus)
kubectl taint node ip-10-0-1-47 dedicated:NoSchedule-

# Cordon and drain before maintenance
kubectl cordon ip-10-0-1-47
kubectl drain ip-10-0-1-47 --ignore-daemonsets --delete-emptydir-data --force
kubectl uncordon ip-10-0-1-47  # after maintenance

09 — Output Tricks: Beyond the Default Table

The default tabular output is readable, but when you're scripting or building dashboards, you need exact fields. Here are the output modes worth knowing:

Flag	What it does
`-o yaml`	Full resource as YAML. Great for inspection and editing.
`-o json`	Full resource as JSON. Pipe to `jq` for advanced queries.
`-o name`	`resource/name` format. Ideal for piping into delete or apply.
`-o jsonpath`	Extract specific fields. Best for scripts and alerts.
`-o wide`	Extra columns: node, IP, nominated node, readiness gates.
`-o custom-columns`	Define your own table headers and field paths.

# Pull a single field cleanly for scripting
kubectl get deploy api-gateway -o jsonpath='{.spec.replicas}' -n production

# Get all image names running across a namespace
kubectl get pods -n production \
  -o jsonpath='{range .items[*]}{.metadata.name}{"  "}{range .spec.containers[*]}{.image}{"\n"}{end}{end}'

# Get the cluster API server URL
kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}'

# Custom table: pod name, QoS class, and CPU limit
kubectl get pods -n production -o custom-columns=\
'NAME:.metadata.name,QOS:.status.qosClass,CPU-LIMIT:.spec.containers[0].resources.limits.cpu'

# Pipe to jq for complex queries
kubectl get pods -n production -o json | \
  jq '.items[] | select(.status.phase=="Running") | .metadata.name'

# Find all images across all namespaces (deduplicated)
kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | \
  tr ' ' '\n' | sort -u

# Use -o name to feed into another command
kubectl get pods -l app=api-gateway -n production -o name | \
  xargs -I{} kubectl annotate {} debug-session=2026-04-27 -n production

10 — kubectl proxy: Accessing the API Directly

kubectl proxy starts a local HTTP server that proxies authenticated requests to the Kubernetes API server. It's different from port-forward: proxy gives you access to the Kubernetes REST API itself, not to a specific service inside the cluster.

# Start a proxy on localhost:8001 (default)
kubectl proxy

# Now you can curl the API without any auth headers
curl http://localhost:8001/api/v1/namespaces/production/pods

# Access cluster metrics via the metrics API
curl http://localhost:8001/apis/metrics.k8s.io/v1beta1/nodes

# Access a service through the API proxy
# Format: /api/v1/namespaces/{ns}/services/{scheme:name:port}/proxy/
curl http://localhost:8001/api/v1/namespaces/monitoring/services/http:grafana:3000/proxy/

# Proxy on a specific port
kubectl proxy --port=9090

# Accept connections from all interfaces (remote dev environments)
kubectl proxy --address=0.0.0.0 --accept-hosts='.*'

The service proxy URL pattern is especially useful for accessing cluster-internal dashboards (Grafana, Prometheus, Argo CD) without setting up ingress or port-forward sessions. Keep the proxy running in a background terminal and bookmark the URLs.

11 — The Plugin Ecosystem: What krew Unlocks

kubectl's plugin system lets you drop any executable named kubectl-something onto your PATH and run it as kubectl something. krew is the community package manager for these plugins. Here are the ones that actually earn their place:

Debugging

kubectl neat — Strip managed fields from get -o yaml output so it's actually readable
kubectl images — List container images in a tree view
kubectl resource-capacity — Node capacity vs requests vs limits at a glance

Networking

kubectl ns — Switch namespace quickly (kubens alternative)
kubectl sniff — Capture pod traffic with tcpdump/Wireshark
kubectl mtail — Multi-pod log tail with regex

Security

kubectl who-can — Who has permission to do X?
kubectl access-matrix — Full RBAC matrix for a namespace
kubectl popeye — Cluster configuration linter

Productivity

kubectl ctx — Switch cluster context (kubectx alternative)
kubectl tree — Show owner references as a tree
kubectl view-secret — Decode secrets without base64 manually

# Install krew (macOS/Linux)
(
  set -x; cd "$(mktemp -d)" &&
  OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
  ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
  KREW="krew-${OS}_${ARCH}" &&
  curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz" &&
  tar zxvf "${KREW}.tar.gz" &&
  ./"${KREW}" install krew
)

# Install the ones worth having
kubectl krew install neat who-can access-matrix resource-capacity view-secret tree images popeye sniff

# neat: removes clutter from -o yaml output (managedFields, creationTimestamp, etc.)
kubectl get deploy api-gateway -o yaml | kubectl neat

# who-can: find out which subjects can perform an action
kubectl who-can delete pods -n production

# view-secret: decode and display a secret's values
kubectl view-secret db-creds -n production

# tree: visualise the ownership hierarchy
kubectl tree deploy api-gateway -n production

# resource-capacity: see requests/limits vs actual usage per node
kubectl resource-capacity --sort cpu.limit --pods

12 — Watching Resources: Smarter Than You Think

The -w flag on kubectl get opens a watch stream against the API server. Most people use it for pods, but it works on any resource. Combined with field selectors and output formatting, it becomes a real-time monitoring tool without needing a dashboard.

# Watch pods but only show ones that are NOT Running
kubectl get pods -w -n production | grep -v Running

# Watch events filtered to a specific pod
kubectl get events -w --field-selector involvedObject.name=api-pod-7d4f8b -n production

# Watch a HPA during a load test
kubectl get hpa api-gateway -w -n production

# Watch all deployments for rollout changes
kubectl get deployments -w -n production

# Watch nodes during a cluster upgrade
kubectl get nodes -w

# Watch with a custom column showing only name and ready status
kubectl get pods -w -n production \
  -o custom-columns='NAME:.metadata.name,READY:.status.conditions[?(@.type=="Ready")].status'

# Watch PVCs for bound state during StatefulSet provisioning
kubectl get pvc -w -n production

Conclusion

kubectl is one of those tools where the ceiling keeps rising the longer you use it. The gap between someone who knows get and apply and someone who reaches for kubectl wait in a CI script, or kubectl patch --type=json when they need precision surgery on a live resource, is real and measurable in minutes saved per incident.

The pattern worth internalising: kubectl is just an HTTP client with great defaults and a thoughtful DSL. Once that clicks, every command stops being a magic incantation and starts being a readable REST call. You start predicting flags you've never tried before. You stop reaching for the browser. And when something breaks at 2am, you move faster.

Start with the shorthands. Add kubectl explain to your muscle memory. Reach for kubectl wait the next time you write a deploy script. The rest will follow naturally.

DEV Community