## See the exact API URL being called
kubectl get pods -v=6

## See full request and response headers
kubectl get pods -v=7

## See the complete request body (useful for apply/patch debugging)
kubectl apply -f deployment.yaml -v=8

## See the complete response body (the raw JSON from the API server)
kubectl get pods -v=9

## Check kubectl version (client and server)
kubectl version

## Check cluster connectivity
kubectl cluster-info

## Check that you have at least one node ready
kubectl get nodes

## Display the full kubeconfig (with sensitive data redacted)
kubectl config view

## Display the full kubeconfig with secrets visible
kubectl config view --raw

## Show only the current context name
kubectl config current-context

## List all available contexts
kubectl config get-contexts

## Switch to a different context
kubectl config use-context <context-name>

## Show details about a specific context
kubectl config get-contexts <context-name>

## Set a default namespace for the current context
## This avoids having to pass -n <namespace> on every command
kubectl config set-context --current --namespace=kubectl-lab

## Add a new cluster entry
kubectl config set-cluster my-new-cluster \
  --server=https://k8s.example.com:6443 \
  --certificate-authority=/path/to/ca.crt

## Add a new user entry with token authentication
kubectl config set-credentials my-user \
  --token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

## Add a new user entry with client certificate authentication
kubectl config set-credentials cert-user \
  --client-certificate=/path/to/client.crt \
  --client-key=/path/to/client.key

## Create a new context that binds cluster + user + namespace
kubectl config set-context my-context \
  --cluster=my-new-cluster \
  --user=my-user \
  --namespace=default

## Delete a context
kubectl config delete-context my-context

## Delete a cluster entry
kubectl config delete-cluster my-new-cluster

## Delete a user entry
kubectl config delete-user my-user

## The KUBECONFIG environment variable accepts a colon-separated list of files
## kubectl merges them at runtime (the first file is the default for writes)
export KUBECONFIG=~/.kube/config:~/.kube/cluster-2.config:~/.kube/cluster-3.config

## Verify that contexts from all files are visible
kubectl config get-contexts

## Permanently merge multiple files into one
## This creates a single flat file with all clusters, users, and contexts
KUBECONFIG=~/.kube/config:~/.kube/cluster-2.config kubectl config view \
  --flatten > ~/.kube/merged-config

## Use the merged config
export KUBECONFIG=~/.kube/merged-config

## Run a command against a different context without switching
kubectl get pods --context=staging-context

## Run a command in a specific namespace without changing default
kubectl get pods --namespace=kube-system

## Combine both overrides
kubectl get pods --context=production-context --namespace=monitoring

## Create the lab namespace
kubectl apply -f manifests/namespace.yaml

## Deploy sample resources
kubectl apply -f manifests/sample-deployment.yaml

## Wait for the deployment to be ready
kubectl wait --for=condition=available deployment/nginx-lab \
  -n kubectl-lab --timeout=120s

## Default table output (human-readable)
kubectl get pods -n kubectl-lab

## Wide output - shows additional columns (node name, IP, etc.)
kubectl get pods -n kubectl-lab -o wide

## YAML output - the full resource definition as YAML
kubectl get pods -n kubectl-lab -o yaml

## JSON output - the full resource definition as JSON
kubectl get pods -n kubectl-lab -o json

## Name-only output - just the resource type/name (great for scripting)
kubectl get pods -n kubectl-lab -o name

## JSONPath output - extract specific fields using JSONPath expressions
kubectl get pods -n kubectl-lab \
  -o jsonpath='{.items[*].metadata.name}'

## Custom columns - define your own tabular output
kubectl get pods -n kubectl-lab \
  -o custom-columns='NAME:.metadata.name,STATUS:.status.phase,IP:.status.podIP'

## Go template - use Go template syntax for complex formatting
kubectl get pods -n kubectl-lab \
  -o go-template='{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'

## Get a single pod as YAML (shows the complete spec including defaults)
kubectl get pod -n kubectl-lab -l app=nginx-lab -o yaml | head -80

## Get a single pod as JSON and pipe to jq for pretty formatting
kubectl get pod -n kubectl-lab -l app=nginx-lab -o json | jq '.items[0].metadata'

## Get just the spec section of a deployment
kubectl get deployment nginx-lab -n kubectl-lab -o json | jq '.spec'

## Get the status section of all pods
kubectl get pods -n kubectl-lab -o json | jq '.items[].status.phase'

## Get just pod names (useful for loops)
kubectl get pods -n kubectl-lab -o name
## Output: pod/nginx-lab-xxxx-yyyy

## Use in a loop to describe each pod
for pod in $(kubectl get pods -n kubectl-lab -o name); do
  echo "=== $pod ==="
  kubectl describe "$pod" -n kubectl-lab | head -20
done

## Delete all pods matching a label (using -o name)
## (Dry run - remove --dry-run=client to actually delete)
kubectl get pods -n kubectl-lab -l app=nginx-lab -o name | \
  xargs kubectl delete --dry-run=client

## Get all pod names as a space-separated list
kubectl get pods -n kubectl-lab \
  -o jsonpath='{.items[*].metadata.name}'

## Get the first pod's name
kubectl get pods -n kubectl-lab \
  -o jsonpath='{.items[0].metadata.name}'

## Get all pod IPs
kubectl get pods -n kubectl-lab \
  -o jsonpath='{.items[*].status.podIP}'

## Get pod names with newlines between them
kubectl get pods -n kubectl-lab \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'

## Get pod name and status on each line
kubectl get pods -n kubectl-lab \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.phase}{"\n"}{end}'

## Get pod name, node name, and pod IP (tab-separated)
kubectl get pods -n kubectl-lab \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.nodeName}{"\t"}{.status.podIP}{"\n"}{end}'

## Get container images for all pods
kubectl get pods -n kubectl-lab \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}'

## Get pods that are in Running phase
kubectl get pods -n kubectl-lab \
  -o jsonpath='{.items[?(@.status.phase=="Running")].metadata.name}'

## Get pods scheduled on a specific node (replace NODE_NAME with an actual node)
NODE_NAME=$(kubectl get nodes -o jsonpath='{.items[0].metadata.name}')
kubectl get pods -n kubectl-lab \
  -o jsonpath="{.items[?(@.spec.nodeName==\"${NODE_NAME}\")].metadata.name}"

## Get containers with memory limit of 128Mi
kubectl get pods -n kubectl-lab \
  -o jsonpath='{.items[*].spec.containers[?(@.resources.limits.memory=="128Mi")].name}'

## Find all container names across all pods (recursive descent)
kubectl get pods -n kubectl-lab \
  -o jsonpath='{..containers[*].name}'

## Find all image names using recursive descent
kubectl get pods -n kubectl-lab \
  -o jsonpath='{..image}'

## Get all label values for the "app" key
kubectl get pods -n kubectl-lab \
  -o jsonpath='{.items[*].metadata.labels.app}'

## Get all node names and their kernel versions
kubectl get nodes \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.nodeInfo.kernelVersion}{"\n"}{end}'

## Get all namespaces and their status
kubectl get namespaces \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.phase}{"\n"}{end}'

## Get all PVCs with their capacity and storage class
kubectl get pvc --all-namespaces \
  -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.spec.resources.requests.storage}{"\t"}{.spec.storageClassName}{"\n"}{end}'

## Extract all unique container images running in the cluster
kubectl get pods --all-namespaces \
  -o jsonpath='{.items[*].spec.containers[*].image}' | tr ' ' '\n' | sort -u

## Basic custom columns - pod name and status
kubectl get pods -n kubectl-lab \
  -o custom-columns='NAME:.metadata.name,STATUS:.status.phase'

## Extended custom columns - name, node, IP, status, restarts
kubectl get pods -n kubectl-lab \
  -o custom-columns='\
NAME:.metadata.name,\
NODE:.spec.nodeName,\
IP:.status.podIP,\
STATUS:.status.phase,\
RESTARTS:.status.containerStatuses[0].restartCount'

## Custom columns for deployments - name, replicas, available, image
kubectl get deployments -n kubectl-lab \
  -o custom-columns='\
NAME:.metadata.name,\
DESIRED:.spec.replicas,\
AVAILABLE:.status.availableReplicas,\
IMAGE:.spec.template.spec.containers[0].image'

## Custom columns from a file (for reuse)
## Create a columns file:
## NAME          NAMESPACE          NODE             STATUS
## .metadata.name .metadata.namespace .spec.nodeName  .status.phase
## Then use it:
## kubectl get pods --all-namespaces -o custom-columns-file=columns.txt

## Select pods with a specific label
kubectl get pods -n kubectl-lab -l app=nginx-lab

## Select pods with multiple label requirements (AND logic)
kubectl get pods -n kubectl-lab -l app=nginx-lab,tier=frontend

## Select pods where a label exists (any value)
kubectl get pods -n kubectl-lab -l 'tier'

## Select pods where a label does NOT exist
kubectl get pods -n kubectl-lab -l '!tier'

## Select pods with set-based requirements
kubectl get pods -n kubectl-lab -l 'tier in (frontend, backend)'
kubectl get pods -n kubectl-lab -l 'environment notin (production)'
kubectl get pods -n kubectl-lab -l 'version in (v1, v2),tier=frontend'

## Show labels as columns in the output
kubectl get pods -n kubectl-lab --show-labels

## Show specific labels as extra columns
kubectl get pods -n kubectl-lab -L app,tier,version

## Get pods by their status phase
kubectl get pods -n kubectl-lab --field-selector status.phase=Running

## Get pods NOT in Running state (find problematic pods)
kubectl get pods --all-namespaces --field-selector status.phase!=Running

## Get pods on a specific node
NODE_NAME=$(kubectl get nodes -o jsonpath='{.items[0].metadata.name}')
kubectl get pods --all-namespaces --field-selector "spec.nodeName=${NODE_NAME}"

## Get a specific pod by name using field selector
kubectl get pods -n kubectl-lab --field-selector metadata.name=nginx-lab

## Combine field selectors (AND logic)
kubectl get pods --all-namespaces \
  --field-selector 'status.phase=Running,metadata.namespace!=kube-system'

## Get events for a specific namespace
kubectl get events -n kubectl-lab --field-selector type=Warning

## Sort pods by creation timestamp (oldest first)
kubectl get pods -n kubectl-lab --sort-by='.metadata.creationTimestamp'

## Sort pods by restart count (ascending)
kubectl get pods -n kubectl-lab \
  --sort-by='.status.containerStatuses[0].restartCount'

## Sort nodes by capacity CPU
kubectl get nodes --sort-by='.status.capacity.cpu'

## Sort events by last timestamp
kubectl get events -n kubectl-lab --sort-by='.lastTimestamp'

## Sort namespaces by name
kubectl get namespaces --sort-by='.metadata.name'

## List pods across ALL namespaces
kubectl get pods --all-namespaces
kubectl get pods -A  ## shorthand

## Combine with selectors and output formatting
kubectl get pods -A -l tier=frontend -o wide

## Get all services across all namespaces with custom columns
kubectl get svc -A \
  -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,TYPE:.spec.type,CLUSTER-IP:.spec.clusterIP'

## Describe a pod - shows events, conditions, container status, volumes, etc.
kubectl describe pod -l app=nginx-lab -n kubectl-lab

## Describe a deployment - shows rollout status, replica sets, conditions
kubectl describe deployment nginx-lab -n kubectl-lab

## Describe a node - shows capacity, allocatable, conditions, running pods
kubectl describe node $(kubectl get nodes -o jsonpath='{.items[0].metadata.name}')

## Describe a namespace
kubectl describe namespace kubectl-lab

## Describe a service
kubectl describe service nginx-lab -n kubectl-lab

## Explain a resource type (top-level fields)
kubectl explain pod

## Explain a specific field
kubectl explain pod.spec

## Explain a deeply nested field
kubectl explain pod.spec.containers

## Explain with full recursive output (shows ALL fields at all levels)
kubectl explain pod.spec.containers --recursive

## Explain deployment spec
kubectl explain deployment.spec

## Explain deployment strategy (shows the rollingUpdate fields)
kubectl explain deployment.spec.strategy

## Explain a CRD resource (if installed)
## kubectl explain myresource.spec

## Specify an API version if multiple versions exist
kubectl explain deployment --api-version=apps/v1

## List ALL available resource types in the cluster
kubectl api-resources

## Show only namespaced resources
kubectl api-resources --namespaced=true

## Show only cluster-scoped resources
kubectl api-resources --namespaced=false

## Show resources in a specific API group
kubectl api-resources --api-group=apps
kubectl api-resources --api-group=batch
kubectl api-resources --api-group=networking.k8s.io
kubectl api-resources --api-group=rbac.authorization.k8s.io

## Show resources that support a specific verb
kubectl api-resources --verbs=list
kubectl api-resources --verbs=create,delete
kubectl api-resources --verbs=watch

## Show output with more detail (including short names and API group)
kubectl api-resources -o wide

## Find a resource by short name
kubectl api-resources | grep -i deploy
## Shows: deployments  deploy  apps/v1  true  Deployment

## List all available API versions
kubectl api-versions

## Filter for a specific group
kubectl api-versions | grep apps
kubectl api-versions | grep networking
kubectl api-versions | grep batch

## Get the full YAML of a running resource (useful for comparison)
kubectl get deployment nginx-lab -n kubectl-lab -o yaml > running-deployment.yaml

## Compare a local manifest with what is running in the cluster
## (This shows what would change if you applied the local file)
kubectl diff -f manifests/sample-deployment.yaml

## Clean up the temporary file
rm -f running-deployment.yaml

## Create a namespace imperatively
kubectl create namespace test-imperative

## Create a deployment imperatively (no manifest file needed)
kubectl create deployment nginx-test \
  --image=nginx:1.25-alpine \
  --replicas=2 \
  -n test-imperative

## Create a service imperatively
kubectl create service clusterip nginx-test \
  --tcp=80:80 \
  -n test-imperative

## Create a configmap from literal values
kubectl create configmap app-config \
  --from-literal=key1=value1 \
  --from-literal=key2=value2 \
  -n test-imperative

## Create a secret from literal values
kubectl create secret generic db-secret \
  --from-literal=username=admin \
  --from-literal=password=secret123 \
  -n test-imperative

## Generate YAML without creating the resource (useful for bootstrapping manifests)
kubectl create deployment nginx-gen \
  --image=nginx:1.25-alpine \
  --replicas=3 \
  --dry-run=client -o yaml > generated-deployment.yaml

## Clean up
kubectl delete namespace test-imperative
rm -f generated-deployment.yaml

## Apply a single manifest file
kubectl apply -f manifests/sample-deployment.yaml

## Apply all manifests in a directory
kubectl apply -f manifests/

## Apply with a specific namespace override
kubectl apply -f manifests/sample-deployment.yaml -n kubectl-lab

## Apply from a URL
## kubectl apply -f https://raw.githubusercontent.com/example/repo/main/manifest.yaml

## Apply and record the command in the annotation (deprecated but still used)
kubectl apply -f manifests/sample-deployment.yaml --record

## Server-side apply (recommended for CI/CD and controllers)
## Server-side apply tracks field ownership and prevents conflicts
kubectl apply -f manifests/sample-deployment.yaml --server-side

## Server-side apply with a custom field manager name
kubectl apply -f manifests/sample-deployment.yaml \
  --server-side \
  --field-manager=my-ci-pipeline

## Force-apply to resolve conflicts (use with caution)
kubectl apply -f manifests/sample-deployment.yaml \
  --server-side \
  --force-conflicts

## Client-side dry run - validates locally, does NOT contact the API server
## Catches YAML syntax errors but NOT schema violations
kubectl apply -f manifests/sample-deployment.yaml --dry-run=client

## Server-side dry run - sends the request to the API server but does NOT persist
## Catches schema violations, admission webhook rejections, and RBAC issues
kubectl apply -f manifests/sample-deployment.yaml --dry-run=server

## Combine dry-run with output to see what would be created
kubectl apply -f manifests/sample-deployment.yaml --dry-run=server -o yaml

## Generate manifests with create and dry-run (great for bootstrapping)
kubectl create deployment test-gen \
  --image=nginx:latest \
  --replicas=3 \
  --dry-run=client -o yaml

## Show what would change if you applied a manifest
## (similar to 'git diff' - shows additions, removals, changes)
kubectl diff -f manifests/sample-deployment.yaml

## Diff all manifests in a directory
kubectl diff -f manifests/

## Diff with server-side apply
kubectl diff -f manifests/sample-deployment.yaml --server-side

## Replace replaces the ENTIRE resource (not a merge)
## First export the current state
kubectl get deployment nginx-lab -n kubectl-lab -o yaml > /tmp/nginx-lab.yaml

## Modify the file, then replace
## Any fields not in the file will be REMOVED from the resource
kubectl replace -f /tmp/nginx-lab.yaml

## Replace with --force (deletes and re-creates the resource)
## WARNING: this causes downtime!
kubectl replace -f /tmp/nginx-lab.yaml --force

## Clean up temp file
rm -f /tmp/nginx-lab.yaml

## Deploy the resource we will use for patching exercises
kubectl apply -f manifests/patch-examples.yaml

## Verify the initial state
kubectl get deployment patch-target -n kubectl-lab -o yaml | head -40

## Add an annotation using strategic merge patch
kubectl patch deployment patch-target -n kubectl-lab \
  --type=strategic \
  -p '{"metadata":{"annotations":{"patched-by":"strategic-merge"}}}'

## Update the replica count
kubectl patch deployment patch-target -n kubectl-lab \
  -p '{"spec":{"replicas":3}}'

## Add a new container to the pod spec
## Strategic merge patch uses the container "name" as the merge key,
## so this ADDS a sidecar without removing the existing nginx container
kubectl patch deployment patch-target -n kubectl-lab \
  -p '{"spec":{"template":{"spec":{"containers":[{"name":"sidecar","image":"busybox:1.36","command":["sh","-c","while true; do echo sidecar; sleep 60; done"]}]}}}}'

## Update an existing container's image (matched by name)
kubectl patch deployment patch-target -n kubectl-lab \
  -p '{"spec":{"template":{"spec":{"containers":[{"name":"nginx","image":"nginx:1.25-alpine"}]}}}}'

## Verify the patch was applied
kubectl get deployment patch-target -n kubectl-lab -o jsonpath='{.spec.template.spec.containers[*].name}'

## Reset the deployment first
kubectl apply -f manifests/patch-examples.yaml

## Add an annotation using JSON merge patch
kubectl patch deployment patch-target -n kubectl-lab \
  --type=merge \
  -p '{"metadata":{"annotations":{"patched-by":"json-merge"}}}'

## Update the image
kubectl patch deployment patch-target -n kubectl-lab \
  --type=merge \
  -p '{"spec":{"template":{"spec":{"containers":[{"name":"nginx","image":"nginx:1.25-alpine"}]}}}}'

## Reset the deployment
kubectl apply -f manifests/patch-examples.yaml

## Add an annotation using JSON Patch
kubectl patch deployment patch-target -n kubectl-lab \
  --type=json \
  -p '[{"op":"add","path":"/metadata/annotations/patched-by","value":"json-patch"}]'

## Replace the replica count using JSON Patch
kubectl patch deployment patch-target -n kubectl-lab \
  --type=json \
  -p '[{"op":"replace","path":"/spec/replicas","value":4}]'

## Add a new label using JSON Patch
kubectl patch deployment patch-target -n kubectl-lab \
  --type=json \
  -p '[{"op":"add","path":"/metadata/labels/patched","value":"true"}]'

## Remove an annotation using JSON Patch
kubectl patch deployment patch-target -n kubectl-lab \
  --type=json \
  -p '[{"op":"remove","path":"/metadata/annotations/patched-by"}]'

## Multiple operations in a single patch
kubectl patch deployment patch-target -n kubectl-lab \
  --type=json \
  -p '[
    {"op":"replace","path":"/spec/replicas","value":2},
    {"op":"add","path":"/metadata/labels/multi-patched","value":"true"},
    {"op":"replace","path":"/spec/template/spec/containers/0/image","value":"nginx:1.25-alpine"}
  ]'

## Test operation - succeeds only if the value matches (useful for conditional updates)
## This will fail if the replicas is not 2
kubectl patch deployment patch-target -n kubectl-lab \
  --type=json \
  -p '[
    {"op":"test","path":"/spec/replicas","value":2},
    {"op":"replace","path":"/spec/replicas","value":5}
  ]'

## Deploy the multi-container pod for debugging exercises
kubectl apply -f manifests/multi-container-pod.yaml

## Wait for the pod to be ready
kubectl wait --for=condition=Ready pod/multi-container-pod \
  -n kubectl-lab --timeout=120s

## Execute a command in the default container
kubectl exec multi-container-pod -n kubectl-lab -- ls /

## Execute a command in a specific container
kubectl exec multi-container-pod -n kubectl-lab -c app -- nginx -v

## Execute a command in the sidecar container
kubectl exec multi-container-pod -n kubectl-lab -c sidecar -- cat /var/log/app/sidecar.log

## Open an interactive shell in the default container
kubectl exec -it multi-container-pod -n kubectl-lab -- /bin/sh

## Open an interactive shell in a specific container
kubectl exec -it multi-container-pod -n kubectl-lab -c sidecar -- /bin/sh

## Run multiple commands using sh -c
kubectl exec multi-container-pod -n kubectl-lab -- \
  sh -c 'echo "Hostname: $(hostname)" && echo "Date: $(date)"'

## Check environment variables
kubectl exec multi-container-pod -n kubectl-lab -- env

## Check network connectivity from inside the pod
kubectl exec multi-container-pod -n kubectl-lab -- \
  sh -c 'wget -qO- --timeout=5 http://nginx-lab.kubectl-lab.svc.cluster.local || echo "Service not reachable"'

## Check DNS resolution inside the pod
kubectl exec multi-container-pod -n kubectl-lab -- \
  sh -c 'nslookup kubernetes.default.svc.cluster.local 2>/dev/null || cat /etc/resolv.conf'

## View logs from the default container
kubectl logs multi-container-pod -n kubectl-lab

## View logs from a specific container
kubectl logs multi-container-pod -n kubectl-lab -c app
kubectl logs multi-container-pod -n kubectl-lab -c sidecar

## Follow logs in real time (like tail -f)
kubectl logs -f multi-container-pod -n kubectl-lab -c sidecar

## Show logs from the last 10 lines
kubectl logs --tail=10 multi-container-pod -n kubectl-lab -c sidecar

## Show logs from the last 30 seconds
kubectl logs --since=30s multi-container-pod -n kubectl-lab -c sidecar

## Show logs from all containers in a pod
kubectl logs multi-container-pod -n kubectl-lab --all-containers=true

## Show logs from all pods with a specific label
kubectl logs -l app=nginx-lab -n kubectl-lab

## Show logs with timestamps
kubectl logs --timestamps multi-container-pod -n kubectl-lab -c sidecar

## Show previous container logs (if the container crashed and restarted)
kubectl logs multi-container-pod -n kubectl-lab -c app --previous 2>/dev/null || \
  echo "No previous container logs (container has not restarted)"

## Copy a file FROM a pod to local machine
kubectl exec multi-container-pod -n kubectl-lab -c app -- \
  sh -c 'echo "Hello from pod" > /tmp/test.txt'
kubectl cp kubectl-lab/multi-container-pod:/tmp/test.txt /tmp/from-pod.txt -c app
cat /tmp/from-pod.txt

## Copy a file TO a pod from local machine
echo "Hello from local" > /tmp/to-pod.txt
kubectl cp /tmp/to-pod.txt kubectl-lab/multi-container-pod:/tmp/to-pod.txt -c app
kubectl exec multi-container-pod -n kubectl-lab -c app -- cat /tmp/to-pod.txt

## Copy a directory from a pod
kubectl cp kubectl-lab/multi-container-pod:/etc/nginx /tmp/nginx-config -c app

## Clean up temp files
rm -f /tmp/from-pod.txt /tmp/to-pod.txt
rm -rf /tmp/nginx-config

## Forward local port 8080 to pod port 80
kubectl port-forward multi-container-pod 8080:80 -n kubectl-lab &
## Test it: curl http://localhost:8080
## Kill the port-forward: kill %1

## Forward to a service (distributes across pods)
kubectl port-forward service/nginx-lab 8080:80 -n kubectl-lab &
## Test it: curl http://localhost:8080
## Kill the port-forward: kill %1

## Forward to a deployment (picks one pod)
kubectl port-forward deployment/nginx-lab 8080:80 -n kubectl-lab &
## Kill the port-forward: kill %1

## Forward multiple ports
kubectl port-forward multi-container-pod 8080:80 9090:9090 -n kubectl-lab &
## Kill the port-forward: kill %1

## Bind to all interfaces (not just localhost) - useful in VMs/containers
kubectl port-forward --address 0.0.0.0 multi-container-pod 8080:80 -n kubectl-lab &
## Kill the port-forward: kill %1

## Attach to a running container's stdout (read-only by default)
## This is different from exec - attach connects to the main process
kubectl attach multi-container-pod -n kubectl-lab -c sidecar

## Attach with stdin enabled (for interactive processes)
## kubectl attach -it <pod> -c <container> -n <namespace>

## Press Ctrl+C to detach

## Create an ephemeral debug container in a running pod
## This adds a temporary container with debugging tools
kubectl debug multi-container-pod -n kubectl-lab \
  --image=busybox:1.36 \
  -it \
  --target=app \
  -- /bin/sh

## Debug by creating a copy of the pod (original pod is untouched)
kubectl debug multi-container-pod -n kubectl-lab \
  --image=busybox:1.36 \
  --copy-to=debug-pod \
  -it \
  -- /bin/sh

## Debug a node by creating a privileged pod on it
## This gives you access to the node's filesystem at /host
NODE_NAME=$(kubectl get nodes -o jsonpath='{.items[0].metadata.name}')
kubectl debug node/${NODE_NAME} -it --image=busybox:1.36

## Clean up debug pods
kubectl delete pod debug-pod -n kubectl-lab --ignore-not-found

## Wait for a deployment to be available
kubectl wait --for=condition=available deployment/nginx-lab \
  -n kubectl-lab --timeout=120s

## Wait for a pod to be ready
kubectl wait --for=condition=Ready pod -l app=nginx-lab \
  -n kubectl-lab --timeout=60s

## Wait for a pod to be deleted
## (start a deletion in another terminal first)
## kubectl wait --for=delete pod/<pod-name> -n kubectl-lab --timeout=60s

## Wait for a job to complete
## kubectl wait --for=condition=complete job/<job-name> -n kubectl-lab --timeout=300s

## Wait for all pods in a namespace to be ready
kubectl wait --for=condition=Ready pods --all -n kubectl-lab --timeout=120s

## Wait using a JSONPath expression
## Wait until a deployment has the desired replicas available
kubectl wait --for=jsonpath='{.status.availableReplicas}'=3 \
  deployment/nginx-lab -n kubectl-lab --timeout=120s

## Check the rollout status of a deployment
kubectl rollout status deployment/nginx-lab -n kubectl-lab

## View the rollout history (shows revisions)
kubectl rollout history deployment/nginx-lab -n kubectl-lab

## View details of a specific revision
kubectl rollout history deployment/nginx-lab -n kubectl-lab --revision=1

## Trigger a new rollout by updating the image
kubectl set image deployment/nginx-lab nginx=nginx:1.25-alpine -n kubectl-lab

## Watch the rollout progress
kubectl rollout status deployment/nginx-lab -n kubectl-lab --watch

## Pause a rollout (prevents further updates from being applied)
kubectl rollout pause deployment/nginx-lab -n kubectl-lab

## Resume a paused rollout
kubectl rollout resume deployment/nginx-lab -n kubectl-lab

## Undo the last rollout (rollback to previous revision)
kubectl rollout undo deployment/nginx-lab -n kubectl-lab

## Rollback to a specific revision
kubectl rollout undo deployment/nginx-lab -n kubectl-lab --to-revision=1

## Restart all pods in a deployment (rolling restart)
## This is useful to pick up configmap/secret changes
kubectl rollout restart deployment/nginx-lab -n kubectl-lab

## Create a Horizontal Pod Autoscaler (HPA)
## Scales between 2 and 10 replicas based on CPU utilization
kubectl autoscale deployment nginx-lab -n kubectl-lab \
  --min=2 --max=10 --cpu-percent=50

## Check the HPA status
kubectl get hpa -n kubectl-lab

## Describe the HPA for detailed metrics and conditions
kubectl describe hpa nginx-lab -n kubectl-lab

## Delete the HPA when done
kubectl delete hpa nginx-lab -n kubectl-lab

## Deploy the RBAC demo resources
kubectl apply -f manifests/rbac-demo.yaml

## Verify the resources were created
kubectl get serviceaccount,role,rolebinding -n kubectl-lab -l app=rbac-demo

## Check if your current user can perform an action
kubectl auth can-i create pods -n kubectl-lab
kubectl auth can-i delete deployments -n kubectl-lab
kubectl auth can-i get secrets -n kubectl-lab
kubectl auth can-i create clusterroles

## Check what a specific service account can do
kubectl auth can-i list pods \
  --as=system:serviceaccount:kubectl-lab:lab-viewer \
  -n kubectl-lab

## The lab-viewer service account should be able to list pods
kubectl auth can-i get pods \
  --as=system:serviceaccount:kubectl-lab:lab-viewer \
  -n kubectl-lab

## The lab-viewer service account should NOT be able to create pods
kubectl auth can-i create pods \
  --as=system:serviceaccount:kubectl-lab:lab-viewer \
  -n kubectl-lab

## The lab-restricted service account has NO permissions
kubectl auth can-i list pods \
  --as=system:serviceaccount:kubectl-lab:lab-restricted \
  -n kubectl-lab

## Check all permissions (list everything the user can do)
kubectl auth can-i --list -n kubectl-lab

## Check all permissions for a service account
kubectl auth can-i --list \
  --as=system:serviceaccount:kubectl-lab:lab-viewer \
  -n kubectl-lab

## Check access to a specific resource by name
kubectl auth can-i get pods/nginx-lab \
  --as=system:serviceaccount:kubectl-lab:lab-viewer \
  -n kubectl-lab

## Check access to subresources (like pod logs)
kubectl auth can-i get pods/log \
  --as=system:serviceaccount:kubectl-lab:lab-viewer \
  -n kubectl-lab

## Show the current user information (requires K8s 1.27+)
kubectl auth whoami 2>/dev/null || echo "whoami requires Kubernetes 1.27+"

## Show whoami output as YAML
kubectl auth whoami -o yaml 2>/dev/null || echo "whoami requires Kubernetes 1.27+"

## List all roles in the namespace
kubectl get roles -n kubectl-lab

## List all role bindings in the namespace
kubectl get rolebindings -n kubectl-lab

## Get the full YAML of a role (to see its rules)
kubectl get role pod-reader -n kubectl-lab -o yaml

## List cluster-level roles (there are many built-in ones)
kubectl get clusterroles | head -20

## Show details of the built-in admin ClusterRole
kubectl get clusterrole admin -o yaml

## List all cluster role bindings
kubectl get clusterrolebindings | head -20

## kubectl discovers plugins automatically
## Any executable named "kubectl-<name>" in your PATH becomes "kubectl <name>"

## List all installed plugins
kubectl plugin list

## Example: create a simple plugin
## (This creates a script that shows pod count per namespace)
cat > /tmp/kubectl-pod-count << 'SCRIPT'
#!/bin/bash
## kubectl pod-count - Shows the number of pods in each namespace
echo "NAMESPACE            POD_COUNT"
echo "-------------------  ---------"
kubectl get pods --all-namespaces --no-headers 2>/dev/null | \
  awk '{count[$1]++} END {for (ns in count) printf "%-20s %d\n", ns, count[ns]}' | \
  sort
SCRIPT
chmod +x /tmp/kubectl-pod-count

## Add to PATH and test it
export PATH=$PATH:/tmp
kubectl pod-count

## Clean up
rm -f /tmp/kubectl-pod-count

## Update the krew plugin index
kubectl krew update

## Search for plugins
kubectl krew search

## Search for a specific plugin
kubectl krew search ctx
kubectl krew search ns

## Install popular plugins
kubectl krew install ctx        ## Switch contexts easily
kubectl krew install ns         ## Switch namespaces easily
kubectl krew install neat       ## Remove clutter from kubectl output
kubectl krew install tree       ## Show resource ownership tree
kubectl krew install images     ## Show container images in use
kubectl krew install access-matrix  ## Show RBAC access matrix
kubectl krew install who-can    ## Show who can perform an action

## Use installed plugins
kubectl ctx                     ## List and switch contexts
kubectl ns                      ## List and switch namespaces
kubectl neat get pod -n kubectl-lab -l app=nginx-lab -o yaml  ## Clean YAML output
kubectl tree deployment nginx-lab -n kubectl-lab               ## Resource hierarchy

## Show info about a plugin
kubectl krew info ctx

## Uninstall a plugin
kubectl krew uninstall ctx

## List installed plugins
kubectl krew list

## Start the kubectl proxy (runs in background on port 8001)
## The proxy handles authentication for you
kubectl proxy --port=8001 &

## Now you can make unauthenticated HTTP requests to the API server
## List all API versions
curl -s http://localhost:8001/api | jq .

## List all available API groups
curl -s http://localhost:8001/apis | jq '.groups[].name'

## List pods in the kubectl-lab namespace
curl -s http://localhost:8001/api/v1/namespaces/kubectl-lab/pods | jq '.items[].metadata.name'

## Get a specific deployment
curl -s http://localhost:8001/apis/apps/v1/namespaces/kubectl-lab/deployments/nginx-lab | jq '.metadata.name'

## List all services in all namespaces
curl -s http://localhost:8001/api/v1/services | jq '.items[] | {namespace: .metadata.namespace, name: .metadata.name}'

## List all nodes
curl -s http://localhost:8001/api/v1/nodes | jq '.items[].metadata.name'

## Get cluster health endpoints
curl -s http://localhost:8001/healthz
curl -s http://localhost:8001/readyz
curl -s http://localhost:8001/livez

## Stop the proxy
kill %1 2>/dev/null

## kubectl get --raw sends a raw GET request and returns the raw response
## This is useful for accessing API endpoints that kubectl doesn't have a command for

## Get the API server version
kubectl get --raw /version | jq .

## List API discovery document
kubectl get --raw /api/v1 | jq '.resources[].name' | head -20

## Get metrics (requires metrics-server)
kubectl get --raw /apis/metrics.k8s.io/v1beta1/nodes 2>/dev/null | jq . || \
  echo "metrics-server not installed"

## Get pod metrics
kubectl get --raw /apis/metrics.k8s.io/v1beta1/namespaces/kubectl-lab/pods 2>/dev/null | jq . || \
  echo "metrics-server not installed"

## Health check endpoints
kubectl get --raw /healthz
kubectl get --raw /readyz
kubectl get --raw /livez

## Get the API server URL from kubeconfig
APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
echo "API Server: ${APISERVER}"

## Create a service account token for direct API access
TOKEN=$(kubectl create token lab-viewer -n kubectl-lab --duration=10m 2>/dev/null)

## If the create token command is not available (K8s < 1.24), use:
## TOKEN=$(kubectl get secret -n kubectl-lab -o jsonpath='{.items[?(@.type=="kubernetes.io/service-account-token")].data.token}' | base64 -d)

if [ -n "${TOKEN}" ]; then
  ## Make an API call using the token
  ## --insecure is used here for lab purposes; in production, use the CA cert
  curl -s --insecure \
    -H "Authorization: Bearer ${TOKEN}" \
    "${APISERVER}/api/v1/namespaces/kubectl-lab/pods" | jq '.items[].metadata.name'

  ## This should fail because lab-viewer can only read pods, not deployments
  curl -s --insecure \
    -H "Authorization: Bearer ${TOKEN}" \
    "${APISERVER}/apis/apps/v1/namespaces/kubectl-lab/deployments" | jq '.message'
else
  echo "Could not create token. Skipping token-based access exercise."
fi

## Add these to your ~/.bashrc or ~/.zshrc

## Basic alias
alias k='kubectl'

## Get commands
alias kg='kubectl get'
alias kgp='kubectl get pods'
alias kgd='kubectl get deployments'
alias kgs='kubectl get services'
alias kgn='kubectl get nodes'
alias kga='kubectl get all'

## Get with options
alias kgpw='kubectl get pods -o wide'
alias kgpa='kubectl get pods --all-namespaces'

## Describe
alias kd='kubectl describe'
alias kdp='kubectl describe pod'
alias kdd='kubectl describe deployment'

## Apply and delete
alias ka='kubectl apply -f'
alias kdel='kubectl delete'

## Logs
alias kl='kubectl logs'
alias klf='kubectl logs -f'

## Exec
alias kex='kubectl exec -it'

## Context and namespace
alias kctx='kubectl config get-contexts'
alias kns='kubectl config set-context --current --namespace'

## Watch pods continuously (updates in place)
kubectl get pods -n kubectl-lab --watch

## Short form
kubectl get pods -n kubectl-lab -w

## Watch with wide output
kubectl get pods -n kubectl-lab -o wide -w

## Watch events as they happen
kubectl get events -n kubectl-lab --watch

## Watch a specific resource
kubectl get deployment nginx-lab -n kubectl-lab -w

## kubectl caches API discovery information locally
## Force refresh the discovery cache
kubectl api-resources --cached=false > /dev/null

## The discovery cache is stored at:
## ~/.kube/cache/discovery/

## For frequently repeated commands in scripts, use --request-timeout
kubectl get pods -n kubectl-lab --request-timeout=5s

## Use --chunk-size to paginate large result sets
kubectl get pods --all-namespaces --chunk-size=100

## Generate deployment YAML without creating it
kubectl create deployment quick-nginx \
  --image=nginx:alpine \
  --replicas=3 \
  --dry-run=client -o yaml

## Generate service YAML
kubectl create service clusterip my-service \
  --tcp=80:8080 \
  --dry-run=client -o yaml

## Generate job YAML
kubectl create job my-job \
  --image=busybox \
  --dry-run=client -o yaml -- echo "Hello"

## Generate cronjob YAML
kubectl create cronjob my-cronjob \
  --image=busybox \
  --schedule="0 * * * *" \
  --dry-run=client -o yaml -- echo "Hello"

## Generate configmap YAML
kubectl create configmap my-config \
  --from-literal=key=value \
  --dry-run=client -o yaml

## Generate secret YAML
kubectl create secret generic my-secret \
  --from-literal=password=s3cr3t \
  --dry-run=client -o yaml

## Generate namespace YAML
kubectl create namespace my-ns \
  --dry-run=client -o yaml

## Generate serviceaccount YAML
kubectl create serviceaccount my-sa \
  --dry-run=client -o yaml

## Generate role YAML
kubectl create role my-role \
  --verb=get,list \
  --resource=pods \
  --dry-run=client -o yaml

## Generate rolebinding YAML
kubectl create rolebinding my-binding \
  --role=my-role \
  --serviceaccount=default:my-sa \
  --dry-run=client -o yaml

## Show resource usage for nodes (requires metrics-server)
kubectl top nodes 2>/dev/null || echo "metrics-server not installed"

## Show resource usage for pods
kubectl top pods -n kubectl-lab 2>/dev/null || echo "metrics-server not installed"

## Sort by CPU usage
kubectl top pods -n kubectl-lab --sort-by=cpu 2>/dev/null || echo "metrics-server not installed"

## Sort by memory usage
kubectl top pods -n kubectl-lab --sort-by=memory 2>/dev/null || echo "metrics-server not installed"

## Show container-level resource usage
kubectl top pods -n kubectl-lab --containers 2>/dev/null || echo "metrics-server not installed"

## Show resource usage across all namespaces
kubectl top pods -A --sort-by=cpu 2>/dev/null || echo "metrics-server not installed"