50 Kubernetes Admin Commands and Troubleshooting Tricks for Every DevOps Engineer

Hello DevOps Engineers!

Over the years, while working with Kubernetes clusters, preparing for certifications, and troubleshooting production incidents, I've collected several command-line shortcuts, administration tricks, and troubleshooting techniques that save significant time.

In this article, I share practical Kubernetes commands that I frequently use for:

Kubernetes administration
Cluster maintenance
ETCD backup and recovery
Node troubleshooting
Cluster upgrades
Context and namespace management
Network debugging
JSONPath queries
Productivity improvements

Whether you're preparing for the CKA exam, managing production clusters, or simply looking to become faster with Kubernetes, this guide will help.

The 'kubectl' command flow architecture

Come on! let's explore about the API resources which we might be frequently use when we prepare the YAML files for each Kubernetes Objects.

Discover Kubernetes API Resources

One of the most useful commands when writing YAML manifests is:

kubectl api-resources

This command displays all available Kubernetes resources along with their API groups and versions.

Why This Matters

This is especially helpful when:

Writing Kubernetes manifest files
Troubleshooting API version mismatches
Migrating workloads between Kubernetes versions
Preparing for Kubernetes certification exams

Scenario 1: API Server Fails After Certificate Renewal

One of the first things Kubernetes administrators investigate during certificate-related outages is the API server certificate configuration.

cat /etc/kubernetes/manifests/kube-apiserver.yaml|grep tls-cert

Expected output:
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt

Why This Matters

Useful during:

Certificate renewal operations
API Server startup failures
Security audits
Cluster troubleshooting

Scenario 2: Finding the ETCD Client Certificate Used by API Server

The Kubernetes API Server communicates securely with ETCD using client certificates.
Inspect the API Server manifest:

cat /etc/kubernetes/manifests/kube-apiserver.yaml

Look for parameters such as:

--etcd-cafile
--etcd-certfile
--etcd-keyfile

These values identify the certificates used to authenticate with ETCD.

Productivity Boosters: Kubernetes CLI Aliases

If you use Kubernetes daily, aliases can save thousands of keystrokes.

Common Aliases

Yes, I do have many but here I would like to common usable Bash shell alias.

# kubectl can be used with k most common alias 
alias k='kubectl'

# This is to list all available objects, alias will be used with many Kubernetes Objects
alias kg='kubectl get'

# This will be used to describe any kubernetes object 
alias kdp='kubectl describe'

Looking into the logs

Kubernetes collects the logging from all the containers that run in a Pod.

# To look into the logs of any pod 
alias kl='kubectl logs'

# To get into the pod containers 
alias kei='kubectl exec -it'

Benefits

Faster troubleshooting
Reduced typing
Improved productivity
Helpful during certification exams

Scenario 4: Worker Node Maintenance Window

Production clusters frequently require maintenance activities such as:

Operating system patching
Security updates
Hardware maintenance
Infrastructure upgrades

Before maintenance, drain the node:kubectl drain node01 --ignore-daemonsets

Verify workload migration:

kubectl get pods -o wide
kubectl get nodes

Expected node status:

Ready,SchedulingDisabled

Interview Question: When maintenance on node01 completes, How to release that node back to Ready state?

Returning the Node to Service state

Once maintenance is complete, we need to use uncordon command option for return to Service state:

kubectl uncordon node01

Verify:

kubectl get nodes,pods -o wide

Production Tip

Before draining a node, always review Pod Disruption Budgets:

kubectl get pdb -A

This helps avoid application downtime during maintenance.

Interview Question: How do you prevent your node for not to perform schedule any new pods?

Scenario 5: Prevent Scheduling New Pods

To stop new workloads from being scheduled while allowing existing pods to continue running: Without effecting existing pods on the node make the node Unschedulable can be done with the cordon sub-command

 k cordon node01
 k get nodes -o wide

cordon sub-command will mark node as unschedulable.

Difference Between Drain and Cordon

Command	Existing Pods	New Pods
cordon	Remain Running	Not Scheduled
drain	Evacuated	Not Scheduled

Scenario 6: Kubernetes Upgrade planning

Similar to any OS package managers allow us to upgrade here we can do it for Kubernetes. But we need to be little cautious, If there is any upgrade plan then we need to check that from the kubenetes CLI. Before upgrading Kubernetes, always review the upgrade path.

 kubeadm upgrade plan

Why This Matters

The upgrade plan provides:

Available versions
Compatibility checks
Required upgrade sequence
Pre-upgrade validations

Never perform a production upgrade without reviewing the plan.

Scenario 7: Investigate about ETCD configurations

How do you find the ETCD cluster address from the ControlPlane?

A skilled Kubernetes administrator knows how to discover information directly from the cluster. From the describe output you can identify the etcd address which is present in the --advertis-client-urls value.

Finding ETCD Cluster Endpoint

k describe po etcd-controlplane -n kube-system|grep -i advertise-client

Example Output: 
Annotations:          kubeadm.kubernetes.io/etcd.advertise-client-urls: https://10.36.169.6:2379
      --advertise-client-urls=https://10.36.169.6:2379

How do you find ETCD version running on your Kubernetes Cluster?

To get the version of the ETCD by describe the etcd pod which is present in kube-sytem namespace.

k get po -n kube-system |grep etcd

Expected Output:
etcd-controlplane                      1/1     Running   0          22m

k describe po etcd-controlplane -n kube-system|grep -i image:

Expected Output: 
    Image:         k8s.gcr.io/etcd:3.5.3-0

Where is the ETCD server certificate file located?

To find the server certificate the file location present in '--cert-file' line. To skip -- in the grep use back slash

k describe po etcd-controlplane -n kube-system|grep '\--cert-file'
      --cert-file=/etc/kubernetes/pki/etcd/server.crt

Alternative: another way is to get certifiate files and key files of etcd. You know that etcd is a static pod and which will have the definitions and configuration details as manifest file at /etc/kubernetes/manifests/etcd.yaml. To run the the etcd backup we must pass certfiles, key files. Let's find those from the manifest file.

 cat /etc/kubernetes/manifests/etcd.yaml |grep "\-file"

Where is the ETCD CA Certificate file located?

Generally CA certificates file will be saved as ca.crt.

k describe po etcd-controlplane -n kube-system|grep -i ca.crt
      --peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
      --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt

Scenario 8: Backup and Recovery of ETCD database

ETCD database BACKUP to a snapshot using following command

The ETCD Recovery flow

ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key \
snapshot save /opt/snapshot-pre-boot.db

# validate snapshot created in the /opt directory.
ls -l /opt

How to restore the etcd cluster database?

Same command only in place of save use restore option.

ETCDCTL_API=3 etcdctl  --data-dir /var/lib/etcd-from-backup \
snapshot restore /opt/snapshot-pre-boot.db

Why Every Administrator Should Practice This

ETCD recovery is one of the most important Kubernetes disaster recovery skills.

Working with Kubernetes Contexts

To see available clusters:

To know number of clusters configured on the node you can use the following :

k config view
# Be specific to cluster listing you can use get-clusters 
k config get-clusters

These commands help administrators manage multiple Kubernetes environments.

Productivity Tools Used by Senior Kubernetes Engineers

Your life will be easy if you know these two tools as your tricks! kubectx, kubens two customized command line tools.

kubectx

Switching between clusters becomes significantly easier with kubectx.

Installation

git clone https://github.com/ahmetb/kubectx /opt/kubectx
ln -s /opt/kubectx/kubectx /usr/local/bin/kubectx

Examples

kubectx
kubectx -c
kubectx -h

Benefits

Instant cluster switching
Reduced configuration mistakes
Faster multi-cluster management

kubectx examples

sudo git clone https://github.com/ahmetb/kubectx /opt/kubectx
sudo ln -s /opt/kubectx/kubectx /usr/local/bin/kubectx
kubectx -h
kubectx -c
kubectx

Download and Setup the kubectx

kubens

Managing namespaces becomes easier with kubens. Setup the kubens and using it for switching between namespaces.

sudo ln -s /opt/kubectx/kubens /usr/local/bin/kubens
kubens
kubens -h
kubens kube-system
k get po
kubens -
k get po

Kubernetes namespace switching tool kubens setup and executions

Benefits

Quick namespace switching
Improved productivity
Reduced command complexity

Kubernetes Network Troubleshooting Tricks

To find the weave-net running on which node

k get po -n kube-system -l name=weave-net -o wide

Useful for:

CNI troubleshooting
Node mapping
Network diagnostics

Identify DNS Components

What is the DNS implementation in your Kubernetes Cluster?

To know dns details the label used 'k8s-app-kube' we can run on pods, deployments we can get the complete implementation of DNS on the Kube:

k -n kube-system get po,deploy -l k8s-app=kube-dns

The execution sample output

Finding Node info using JSONPATH

To work on the jsonpath you must know what is the output in JSON format first. then we can narrow-down to the required field data to be extracted. JSONPath is one of the most powerful Kubernetes troubleshooting techniques.

k get nodes -o jsonp 
k get nodes -o jsonp | jq
k get nodes -o jsonp | jq -c 'paths' |grep InternalIP

To get the InternalIP address of each node can be retrived first we need to give a try for first node than we can change to all nodes using '*'.

k get no -o jsonpath='{.items[0].status.addresses}'|jq
k get no -o jsonpath='{.items[*].status.addresses[0]}'|jq
k get no -o jsonpath='{.items[*].status.addresses[?(@.type=="InternalIP")]}'
k get no -o jsonpath='{.items[*].status.addresses[?(@.type=="InternalIP")].address}'

Why Learn JSONPath?

JSONPath allows administrators to:

Extract specific fields
Generate automation reports
Build monitoring scripts
Improve troubleshooting efficiency

Kubectl autocomplete

Set up autocomplete enable in bash shell if that is your current shell, bash-completion package should be installed first.

source <(kubectl completion bash)

Let's add this above line for autocomplete permanently in the .bashrc

> ~/.bashrc

Reader Challenge: Kubernetes Administrator Lab

Try these exercises without referring back to the article.

Beginner Challenge

Create Kubernetes aliases.
Enable kubectl auto-completion.
Switch namespaces using kubens.

Intermediate Challenge

Cordon a worker node.
Drain the node.
Verify pod migration.
Return the node to service.

Advanced Challenge

Create an ETCD backup.
Delete a test namespace.
Restore ETCD from backup.
Verify resources are restored.

Expert Challenge

Without using Google:

Find ETCD version.
Find ETCD certificate.
Find API Server certificate.
Find Internal Node IPs using JSONPath.

Document your findings and compare them with the examples in this guide.

Reference

Official cheat sheet

What's Your Favorite Kubernetes Command?

Every Kubernetes engineer develops a set of commands they use daily.

Which command has saved you the most time?

kubectl describe
kubectl logs
kubectl drain
etcdctl snapshot save
kubectx
kubens

Share your favorite Kubernetes troubleshooting command in the comments. It might help another engineer solve their next production incident.

Happy Learning and Happy Kubernetes Administration!Hope you have enjoyed this post.