命令速查¶
这不是一份完整的 kubectl 手册，而是一张「遇到问题时先敲什么」的速查表。建议把常用命令做成 alias，但要知道 alias 背后发生了什么。
上下文与命名空间¶
kubectl config get-contexts
kubectl config use-context kind-k8s-lab
kubectl config set-context --current --namespace=demo
kubectl config view --minify
kubectl cluster-info
查看资源¶
kubectl get pods -o wide
kubectl get pods --show-labels
kubectl get pods -l app=demoapp
kubectl get pods --field-selector status.phase=Running
kubectl get all -n demo
kubectl get rs,deploy,svc,ep,ing -n demo
kubectl get events -n demo --sort-by=.lastTimestamp
kubectl describe pod <pod> -n demo
kubectl describe node <node>
kubectl explain deployment.spec.strategy
kubectl explain pod.spec.containers --recursive | less
自定义列¶
kubectl get pods -o custom-columns=\
'NAME:.metadata.name,STATUS:.status.phase,NODE:.spec.nodeName,IP:.status.podIP'
jsonpath¶
# 所有 Pod 的 IP
kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.podIP}{"\n"}{end}'
# 镜像列表
kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}'
# 重启次数
kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.containerStatuses[*].restartCount}{"\n"}{end}'
排序与过滤¶
kubectl get pods --sort-by=.status.startTime
kubectl get pods --sort-by=.metadata.creationTimestamp
kubectl get nodes -o wide --sort-by=.metadata.name
日志与调试¶
kubectl logs <pod> -n demo
kubectl logs <pod> -c <container> -n demo
kubectl logs <pod> --previous -n demo
kubectl logs -f deploy/demoapp -n demo
kubectl logs -l app=demoapp --tail=100 -n demo
kubectl exec -it <pod> -n demo -- sh
kubectl exec <pod> -n demo -- cat /etc/config/app.yaml
kubectl cp demo/<pod>:/tmp/app.log ./app.log
kubectl port-forward -n demo svc/demoapp 8080:80
kubectl debug -it <pod> -n demo --image=busybox:1.36 --target=app
# 节点上看容器
crictl ps
crictl logs <container-id>
crictl inspect <container-id> | jq '.status'
journalctl -u kubelet -n 200 --no-pager
journalctl -u containerd -n 100 --no-pager
部署与变更¶
kubectl apply -f app.yaml
kubectl apply --server-side -f app.yaml
kubectl diff -f app.yaml
kubectl delete -f app.yaml
kubectl create namespace demo --dry-run=client -o yaml | kubectl apply -f -
kubectl scale deploy/demoapp --replicas=5 -n demo
kubectl set image deploy/demoapp demoapp=ikubernetes/demoapp:v1.1 -n demo
kubectl rollout status deploy/demoapp -n demo
kubectl rollout history deploy/demoapp -n demo
kubectl rollout undo deploy/demoapp -n demo
kubectl rollout restart deploy/demoapp -n demo
kubectl wait --for=condition=Available deploy/demoapp --timeout=120s -n demo
kubectl annotate deploy/demoapp kubernetes.io/change-cause="v1.1" --overwrite -n demo
kubectl label pod <pod> app=demoapp --overwrite
kubectl patch svc demoapp -p '{"spec":{"type":"NodePort"}}'
节点维护¶
kubectl get nodes -o wide
kubectl describe node <node>
kubectl top nodes
kubectl cordon <node>
kubectl drain <node> --ignore-daemonsets --delete-emptydir-data
kubectl uncordon <node>
kubectl taint node <node> maintenance=true:NoSchedule
kubectl taint node <node> maintenance=true:NoSchedule-
kubectl label node <node> disktype=ssd
权限与安全¶
kubectl auth whoami
kubectl auth can-i get pods -n demo
kubectl auth can-i --list -n demo
kubectl auth can-i get pods --as=system:serviceaccount:demo:reader -n demo
kubectl create serviceaccount reader -n demo
kubectl create role pod-reader --verb=get,list,watch --resource=pods -n demo
kubectl create rolebinding reader-binding \
--role=pod-reader \
--serviceaccount=demo:reader \
-n demo
存储¶
kubectl get pv,pvc -A
kubectl describe pvc <pvc> -n demo
kubectl get storageclass
kubectl patch storageclass nfs-csi -p \
'{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'
kubectl patch pvc app-data -p \
'{"spec":{"resources":{"requests":{"storage":"5Gi"}}}}'
网络¶
kubectl get svc,ep,endpointslice -n demo
kubectl get ingress -n demo
kubectl run curl --image=curlimages/curl:8.10.1 --rm -it --restart=Never -- \
curl -s http://demoapp.demo.svc.cluster.local
kubectl run dns --image=busybox:1.36 --rm -it --restart=Never -- \
nslookup kubernetes.default
# 在节点上抓包（需要 root）
tcpdump -i any -nn port 80 -c 20
# 查看 Service 转发规则
iptables-save | grep demoapp
ipvsadm -Ln
集群与 etcd¶
kubectl get --raw='/readyz?verbose'
kubectl get --raw='/livez?verbose'
kubectl get componentstatuses # 已弃用，仅旧集群
kubectl api-resources
kubectl api-versions
kubectl get --raw /metrics | head
etcd 快照（kubeadm 集群）：
ETCDCTL_API=3 etcdctl \
--endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key \
snapshot save /var/backups/etcd-$(date +%F).db
Helm¶
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update
helm search repo prometheus
helm install monitoring prometheus-community/kube-prometheus-stack -n monitoring --create-namespace
helm upgrade --install app ./chart -n demo -f values-prod.yaml
helm list -A
helm history app -n demo
helm rollback app 1 -n demo
helm template app ./chart -f values.yaml | less
helm diff upgrade app ./chart -f values.yaml # 需要 helm-diff 插件
helm uninstall app -n demo
一键证据收集¶
#!/usr/bin/env bash
NS=${1:-default}
OUT="k8s-evidence-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$OUT"
kubectl get pods -n "$NS" -o wide > "$OUT/pods.txt"
kubectl get events -n "$NS" --sort-by=.lastTimestamp > "$OUT/events.txt"
kubectl get svc,ep,ing -n "$NS" -o wide > "$OUT/network.txt"
kubectl get pvc -n "$NS" > "$OUT/pvc.txt"
kubectl get nodes -o wide > "$OUT/nodes.txt"
for p in $(kubectl get pods -n "$NS" -o name | cut -d/ -f2); do
kubectl describe pod "$p" -n "$NS" > "$OUT/describe-$p.txt" 2>&1
kubectl logs "$p" -n "$NS" --all-containers --tail=200 \
> "$OUT/logs-$p.txt" 2>&1
done
echo "collected to $OUT"
常见别名¶
alias k='kubectl'
alias kgp='kubectl get pods -o wide'
alias kgs='kubectl get svc'
alias kd='kubectl describe'
alias kl='kubectl logs'
alias kx='kubectl exec -it'
alias kaf='kubectl apply -f'
alias kdel='kubectl delete'
alias kctx='kubectl config use-context'
alias kns='kubectl config set-context --current --namespace'