About the Kubectl Quick Reference cheat sheet
kubectl has a small number of verbs and an enormous number of flags, and the flags are where the useful behaviour lives. Most of what separates fast debugging from slow debugging is knowing which flags exist rather than memorising more commands.
Three are worth internalising above the rest. The output flag with jsonpath or custom columns turns any query into exactly the columns you want, which removes most of the reason to pipe into grep. The previous-container flag on logs shows the output of the container that just crashed, which is the only place a crash reason is recorded. And field selectors filter server-side, which matters on a cluster large enough that listing everything is slow.
The habit worth building is preferring describe over get when something is wrong. The events at the bottom of describe output explain scheduling failures, image pull failures, and probe failures directly, and they are the first place to look rather than the last.
Frequently asked questions
How do I see logs from a container that already crashed?
Use the previous flag on kubectl logs, which returns the output of the last terminated instance rather than the running one. This is the only way to see why a CrashLoopBackOff container failed, because the current instance may have just started or not be running at all. Combine with the container flag when the pod has more than one.
What is the difference between apply, create, and replace?
create fails if the object exists. replace overwrites it entirely and drops anything not in your file. apply performs a three-way merge between your file, the live object, and the last applied configuration, so it changes only the fields you specify. Use apply for essentially everything — it is the only one that behaves sensibly when a controller also writes to the object.
How do I get just one field out of a resource?
Use the output flag with jsonpath and the path to the field, or custom-columns when you want several fields as a table across many objects. Both avoid parsing YAML with text tools, which breaks as soon as a value contains a character you did not expect. For anything more involved, output JSON and pipe to jq.
How do I debug a pod with no shell in the image?
Use kubectl debug to attach an ephemeral container with your own tooling image into the running pod, sharing its namespaces. This is the correct answer for distroless and scratch images, where there is nothing to exec into. You can also copy a pod with a modified spec when you need to change the command without disturbing the original.
Why is kubectl slow on a large cluster?
Usually because you are listing everything and filtering client-side. Use field selectors and label selectors so the API server does the filtering, and limit results when you only need a sample. Requests across all namespaces on a large cluster are expensive for the API server as well as for you.
Need this managed for you, not just automated?
We're also a hands-on DevOps consultancy — Kubernetes, CI/CD, and cloud infrastructure.