Kubernetes snippets

kubectl commands that each do one job. Copy one straight from this page — the note under each says what it changes before you point it at a cluster.

Config

Decode one key in a secret

kubectl get secret <name> -o jsonpath='{.data.<key>}' | base64 -d

The value lands in your terminal and its scrollback — not while screen sharing. macOS before Ventura spells it -D.

Decode every key in a secret

kubectl get secret <name> -o go-template='{{range $k, $v := .data}}{{$k}}: {{$v | base64decode}}{{"\n"}}{{end}}'

One line per key, when you don't know what the secret holds.

Decode a secret key with a dot in its name

kubectl get secret <name> -o jsonpath='{.data.tls\.crt}' | base64 -d

JSONPath reads a dot as a separator, so tls.crt has to be escaped.

Change the default namespace for kubectl

kubectl config set-context --current --namespace=<namespace>

Stored in the kubeconfig, so every terminal on that context follows. A typo is accepted and later commands just find nothing.

Show which namespace kubectl is using

kubectl config view --minify -o jsonpath='{..namespace}'

Prints nothing when the context sets none, which means default.

Pods

Delete all failed and evicted pods

kubectl delete pods -A --field-selector=status.phase=Failed

Clears the Evicted rows left by node pressure. Their logs go too, so save anything you still need.

List failed and evicted pods

kubectl get pods -A --field-selector=status.phase=Failed

What the delete would take. CrashLoopBackOff pods are Running, not Failed, so they stay.

Tail the logs of every pod in a deployment

kubectl logs -f deploy/api --all-containers

Follows the deployment's pods together, sidecars included.