Skip to content

Kubernetes and Helm Useful Commands

The commands below port and expand the old useful_commands page. Read-only diagnostics are safe defaults. Commands that change resources require the owning repository and approved deployment workflow.

Context

List contexts and identify the active one:

kubectl config get-contexts
kubectl config current-context

Switch deliberately:

kubectl config use-context <cluster-context>
kubectl config current-context

Never rely only on the terminal prompt to identify a production cluster.

Workloads

kubectl get deployments -n <namespace>
kubectl get statefulsets -n <namespace>
kubectl get daemonsets -n <namespace>
kubectl get pods -n <namespace> -o wide
kubectl get pods -n <namespace> --show-labels

Inspect a workload or pod:

kubectl describe deployment <deployment> -n <namespace>
kubectl describe pod <pod> -n <namespace>
kubectl get events -n <namespace> --sort-by=.lastTimestamp

Services and Endpoints

kubectl get services -n <namespace>
kubectl get endpoints -n <namespace>
kubectl get endpointslices -n <namespace>
kubectl describe service <service> -n <namespace>

If a Service has no endpoints, compare its selector with pod labels before investigating the load balancer or firewall.

Creating or Changing a Service

Production Services belong in the Helm chart/configuration repository. Preview a proposed manifest before pull request:

kubectl apply --dry-run=server -f <service-manifest.yaml>
kubectl diff -f <service-manifest.yaml>

A pushed-telemetry load-balancer Service typically defines the namespace, approved load-balancer annotations, protocol/port, target port, selectors, and traffic policy. Copy current annotations and network identifiers from the owning cluster configuration—not from old screenshots or documentation.

Do not run kubectl apply directly in production unless an approved emergency Method of Procedure authorizes it. Reconcile any emergency change back to Git immediately.

Logs

Current logs:

kubectl logs <pod> -n <namespace> --all-containers --since=30m

Follow one container:

kubectl logs --follow <pod> -n <namespace> -c <container>

Logs from the previous crashed container:

kubectl logs <pod> -n <namespace> -c <container> --previous

Redact tokens, authorization headers, customer payloads, and device credentials before attaching logs to an incident.

Rollout Status and History

kubectl rollout status deployment/<deployment> -n <namespace>
kubectl rollout history deployment/<deployment> -n <namespace>
kubectl get replicasets -n <namespace>

Use the source-controlled rollback workflow. kubectl rollout undo changes live state outside Git and is reserved for an explicitly approved emergency procedure.

Configuration and Secrets

List object metadata without printing secret values:

kubectl get configmaps -n <namespace>
kubectl get secrets -n <namespace>
kubectl describe secret <secret-name> -n <namespace>

kubectl describe secret shows metadata and key names, not decoded values. Avoid kubectl get secret ... -o yaml/json in recorded terminals.

The old guide created Secrets by manually base64-encoding usernames and passwords. That procedure is not ported as an approved production method because base64 is not encryption. Use InfoSec Keeper and the managed Helm/Argo secret integration. See InfoSec Keeper.

Prometheus Discovery Resources

kubectl get servicemonitors -n <namespace>
kubectl describe servicemonitor <name> -n <namespace>
kubectl get prometheusrules -n <namespace>

If custom resources are not recognized, confirm the correct context and installed CRDs before assuming the resource is absent.

Helm Repositories and Versions

helm repo list
helm repo update
helm search repo <chart-name> --versions

The WxCDI chart pipeline may use an OCI/ECR registry instead of a traditional Helm repository. Use the ECR synchronization portal and owning repository instructions for the authoritative versions.

Helm Rendering and Release Inspection

helm lint <chart-directory>
helm template <release-name> <chart-directory> -f <non-secret-values.yaml>
helm list -n <namespace>
helm status <release-name> -n <namespace>
helm history <release-name> -n <namespace>
helm get values <release-name> -n <namespace>
helm get manifest <release-name> -n <namespace>

Do not include output containing rendered Secrets in tickets or documentation.