Debug Kubernetes Cluster: troubleshooting commands
33 commands in 4 groups: Events, Live Debug, Cluster Health, API Discovery. Click or tap any command to copy it. Official documentation: kubernetes.io.
Open in the interactive cheat sheet search, stars and every other section
Events
Inspect cluster events to understand what happened to resources: warnings, restarts, scheduling failures.
kubectl events --watch --types=Warning
Stream warning events live
kubectl events -n <namespace> --types=Warning
Modern events CLI: filter by Warning type
kubectl get events --field-selector=involvedObject.name=<name>
Events for a specific object
kubectl get events --field-selector=type=Warning
Only Warning events
kubectl get events -n <namespace>
Events in a namespace
kubectl get events -A --sort-by='.metadata.creationTimestamp'
All events sorted by time
kubectl get events -n <namespace> --watch
Stream events in real time
Live Debug
Spawn ephemeral containers, debug copies of pods, or get a privileged shell on a node without modifying the original workload.
kubectl debug -it <pod> --image=<nonroot-image> --profile=restricted
Restricted PSS profile (non-root, all caps dropped), needs an image that runs as non-root
kubectl debug -it <pod> --image=alpine --profile=baseline
Profile compatible with the baseline Pod Security Standard
kubectl debug -it <pod> --image=alpine --profile=netadmin
Debug with NET_ADMIN and NET_RAW capabilities
kubectl debug -it <pod> --image=alpine --profile=sysadmin
Privileged debug container (sysadmin profile)
kubectl debug node/<node> -it --image=busybox --profile=sysadmin
Privileged shell on a node in host namespaces, host root mounted at /host
kubectl debug -it <pod> --image=nicolaka/netshoot --target=<container> --profile=general
Ephemeral container sharing the target process namespace, ideal for distroless images
kubectl debug <pod> -it --image=busybox --copy-to=<debug-pod> --profile=general
Debug copy of a pod, the original keeps running untouched
kubectl debug <pod> -it --image=busybox --copy-to=<debug-pod> --share-processes --profile=general
Debug copy with shared PID namespace between debug and target containers
Cluster Health
Check API server reachability, control plane component statuses, and version compatibility.
kubectl cluster-info
Show API server and DNS endpoints
kubectl cluster-info dump
Full cluster state dump to stdout
kubectl get apiservices
APIService resources and their availability state
kubectl get --raw='/livez?verbose'
API server liveness probe with per-check breakdown
kubectl get --raw='/readyz?verbose'
API server readiness probe with per-check breakdown
kubectl get pods -n kube-system
Status of all control plane component pods
kubectl get pods -A --sort-by='.metadata.creationTimestamp'
All pods sorted by creation time
kubectl get pods -A | grep -v Running
Show all non-Running pods cluster-wide
kubectl logs -n kube-system <pod>
Logs of a control plane component (apiserver, scheduler…)
kubectl logs -n kube-system <pod> --previous
Logs from a crashed control plane container
kubectl version
Client and server versions
API Discovery
Discover what resources the cluster exposes and inspect their schemas. Mirrored from Cluster Health for in-flow debugging.
kubectl api-resources
List all available API resources
kubectl api-resources --api-group=<group>
Resources in a specific API group
kubectl api-resources --namespaced=false
Cluster-scoped resources only
kubectl api-resources --namespaced=true
Namespace-scoped resources only
kubectl explain <resource>
Describe a resource and its top-level fields
kubectl explain <resource>.spec.<field>
Explain a specific nested field
kubectl explain <resource> --recursive
Show full nested field tree