The Ultimate kubectl CLI Speed Cheat Sheet: Ace Your CKA Exam

# 1. Main kubectl alias
alias k=kubectl

# 2. Fast YAML Generator shortcut
export do="--dry-run=client -o yaml"

# Set default namespace for current context
k config set-context --current --namespace=finance

# Verify current context & active namespace
k config get-contexts
k config current-context

# Basic Nginx Pod
k run nginx-pod --image=nginx $do > pod.yaml

# Pod with custom command and arguments
k run busybox-pod --image=busybox --restart=Never $do -- /bin/sh -c "sleep 3600" > pod.yaml

# Pod with labels and exposed container port
k run web --image=httpd:alpine --port=80 --labels="tier=frontend,app=web" $do > web-pod.yaml

# Create Deployment with 3 replicas
k create deployment web-deploy --image=nginx:1.25 --replicas=3 $do > deploy.yaml

# Scale deployment on the fly
k scale deployment web-deploy --replicas=5

# Update image and check rollout history
k set image deployment/web-deploy nginx=nginx:1.26
k rollout status deployment/web-deploy
k rollout undo deployment/web-deploy

# Expose Deployment as ClusterIP (Port 80 -> TargetPort 8080)
k expose deployment web-deploy --port=80 --target-port=8080 --name=web-service

# Expose as NodePort with YAML export
k expose deployment web-deploy --type=NodePort --port=80 --target-port=80 --name=web-np $do > svc-nodeport.yaml

# Direct Service creation
k create service clusterip backend-svc --tcp=8080:8080 $do > svc.yaml

# Create basic Ingress with host and path routing
k create ingress web-ingress \
  --rule="app.example.com/api*=backend-svc:8080" \
  --rule="app.example.com/*=web-service:80" \
  $do > ingress.yaml

# Ingress with default backend
k create ingress simple-ingress \
  --default-backend=fallback-svc:8080 \
  $do > ingress-default.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: secure-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
  - hosts:
      - secure.example.com
    secretName: tls-secret
  rules:
  - host: secure.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

# 1. Gateway definition
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: prod-gateway
spec:
  gatewayClassName: eg-gateway-class
  listeners:
  - name: http
    protocol: HTTP
    port: 80
---
# 2. HTTPRoute definition
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api-route
spec:
  parentRefs:
  - name: prod-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /api
    backendRefs:
    - name: backend-svc
      port: 8080

# ConfigMap from literal values
k create configmap app-config --from-literal=DB_HOST=10.0.0.5 --from-literal=DB_PORT=5432

# ConfigMap from an existing configuration file
k create configmap nginx-conf --from-file=nginx.conf

# Secret from literal password or env file
k create secret generic db-secret --from-literal=password=SuperSecret123
k create secret generic app-secret --from-env-file=.env

# Inject ConfigMap or Secret directly into a Deployment's env
k set env deployment/web-deploy --from=configmap/app-config
k set env deployment/web-deploy --from=secret/db-secret

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  storageClassName: standard

spec:
  volumes:
  - name: storage-vol
    persistentVolumeClaim:
      claimName: data-pvc
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: storage-vol
      mountPath: /var/data

# 1. Create a ServiceAccount
k create serviceaccount app-sa

# 2. Create a Role with specific resource access
k create role pod-reader --verb=get,list,watch --resource=pods,pods/log

# 3. Bind Role to ServiceAccount in a namespace
k create rolebinding read-pods-binding --role=pod-reader --serviceaccount=default:app-sa

# 4. Cluster-wide permissions (ClusterRole & ClusterRoleBinding)
k create clusterrole node-viewer --verb=get,list --resource=nodes
k create clusterrolebinding view-nodes-binding --clusterrole=node-viewer --serviceaccount=default:app-sa

# 5. Check permissions (Can I do this?)
k auth can-i create deployments --as=system:serviceaccount:default:app-sa
k auth can-i delete pods -n production

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 80

# Get Internal IPs of all Worker Nodes
k get nodes -o jsonpath='{.items[*].status.addresses[?(@.type=="InternalIP")].address}'

# Extract Pod names and their Node placements
k get pods -o custom-columns=POD:.metadata.name,NODE:.spec.nodeName,STATUS:.status.phase

# Decode Secret data directly without manual base64 decoding
k get secret db-secret -o jsonpath='{.data.password}' | base64 -d

# Run a quick temporary debugging container inside the cluster network
k run net-debug --rm -i --tty --image=curlimages/curl -- /bin/sh

# Stream logs with timestamps and limit lines
k logs -f deployment/web-deploy --tail=50 --timestamps

# View resource usage across all namespaces
k top nodes
k top pods -A --sort-by=cpu
k top pods -A --sort-by=memory

# Inspect events sorted by recent creation
k get events -A --sort-by='.metadata.creationTimestamp'