Kubernetes Cheatsheet

Pods Reference

Use this Kubernetes reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

Minimal Pod Manifest

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  labels:
    app: my-app
spec:
  containers:
  - name: app
    image: nginx:1.27
    ports:
    - containerPort: 80

Pods are ephemeral. In production, use a Deployment to manage Pods. Create bare Pods only for one-off debugging.

Common Pod Fields

spec:
  restartPolicy: Always        # Always | OnFailure | Never
  terminationGracePeriodSeconds: 30
  hostNetwork: false
  dnsPolicy: ClusterFirst
  serviceAccountName: my-sa
  imagePullSecrets:
  - name: registry-creds
  containers:
  - name: app
    image: myrepo/app:v2
    imagePullPolicy: IfNotPresent   # Always | Never | IfNotPresent
    command: ["/bin/sh"]
    args: ["-c", "echo hello"]
    workingDir: /app
    env:
    - name: APP_ENV
      value: production
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: password
    ports:
    - name: http
      containerPort: 8080
      protocol: TCP
    resources:
      requests:
        cpu: "100m"
        memory: "128Mi"
      limits:
        cpu: "500m"
        memory: "256Mi"

Init Containers

Run to completion before app containers start. Good for DB migrations, config fetch.

spec:
  initContainers:
  - name: wait-for-db
    image: busybox
    command: ['sh', '-c', 'until nc -z postgres 5432; do sleep 2; done']
  containers:
  - name: app
    image: myapp:v1

Sidecar Containers (Kubernetes 1.29+)

Native sidecars start before app containers and restart independently:

spec:
  initContainers:
  - name: log-forwarder
    image: fluent/fluent-bit
    restartPolicy: Always     # makes it a sidecar
  containers:
  - name: app
    image: myapp:v1

Health Probes

containers:
- name: app
  image: myapp:v1
  livenessProbe:              # restart container if this fails
    httpGet:
      path: /healthz
      port: 8080
    initialDelaySeconds: 10
    periodSeconds: 15
    failureThreshold: 3
  readinessProbe:             # remove from Service endpoints if this fails
    httpGet:
      path: /ready
      port: 8080
    initialDelaySeconds: 5
    periodSeconds: 10
  startupProbe:               # disables liveness/readiness until passes
    httpGet:
      path: /healthz
      port: 8080
    failureThreshold: 30      # 30 * 10s = 5 min startup window
    periodSeconds: 10

Probe type	Handler options
HTTP	`httpGet: { path, port, scheme, httpHeaders }`
TCP	`tcpSocket: { port }`
Exec	`exec: { command: [...] }`
gRPC	`grpc: { port, service }`

Volume Mounts

spec:
  volumes:
  - name: config-vol
    configMap:
      name: app-config
  - name: tmp
    emptyDir: {}
  containers:
  - name: app
    image: myapp:v1
    volumeMounts:
    - name: config-vol
      mountPath: /etc/config
      readOnly: true
    - name: tmp
      mountPath: /tmp

Security Context

spec:
  securityContext:            # Pod-level
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
  - name: app
    securityContext:          # Container-level (overrides pod-level)
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
        add: ["NET_BIND_SERVICE"]

Pod Phase and Conditions

Phase	Meaning
`Pending`	Accepted but not yet running (scheduling or image pull)
`Running`	At least one container running
`Succeeded`	All containers exited 0
`Failed`	At least one container exited non-0
`Unknown`	Node communication lost

kubectl Pod Commands

Command	What it does
`kubectl get pods`	List pods in current namespace
`kubectl get pods -A`	List pods in all namespaces
`kubectl get pod my-pod -o wide`	Show node, IP, etc.
`kubectl describe pod my-pod`	Events, probe status, conditions
`kubectl logs my-pod`	Stdout of first container
`kubectl logs my-pod -c sidecar`	Stdout of named container
`kubectl logs my-pod --previous`	Logs from last crashed container
`kubectl exec -it my-pod -- bash`	Interactive shell
`kubectl exec my-pod -- env`	Run command, print output
`kubectl delete pod my-pod`	Delete pod (Deployment recreates it)
`kubectl delete pod my-pod --grace-period=0 --force`	Force-delete stuck pod
`kubectl port-forward pod/my-pod 8080:80`	Forward local 8080 → pod 80
`kubectl cp my-pod:/app/log.txt ./log.txt`	Copy file from pod