Kubernetes
100daysofcode
Cka
Ckad
DevOps

Pod Commands — Complete Reference

Pradyumna Kumar Das

15 min readSep 21, 2026

Every Pod command you need for CKA, CKAD, and real work. Organized by what you are trying to do.

Assumed shell setup:

alias k=kubectl
export do="--dry-run=client -o yaml"
export now="--force --grace-period=0"
source <(kubectl completion bash)
complete -F __start_kubectl k

1. CREATE

Basic

k run web --image=nginx                          # simplest possible
k run web --image=nginx:1.27                     # pinned tag — always do this
k run web --image=nginx --port=80                # containerPort (documentation only)
k run web --image=nginx --restart=Never          # Pod (not managed)
k run web --image=nginx --restart=OnFailure      # creates a Job
k run web --image=nginx --restart=Always         # default from k run

With metadata

k run web --image=nginx --labels=app=frontend
k run web --image=nginx --labels="app=web,tier=front,env=prod"
k run web --image=nginx --annotations="owner=team-a"
k run web --image=nginx -n dev                   # in a namespace
k run web --image=nginx --namespace=dev

With commands and arguments

# SPACE after --, not equals
k run busybox --image=busybox -- sleep 3600
k run busybox --image=busybox -- /bin/sh -c "while true; do echo hi; sleep 5; done"

# --command overrides ENTRYPOINT (not just CMD)
k run busybox --image=busybox --command -- /bin/sh -c "echo start && sleep 3600"# args only (keeps image ENTRYPOINT)
k run nginx --image=nginx -- -g "daemon off;"

Flag

YAML field

Overrides

--command -- X Y

command: [X, Y]

Docker ENTRYPOINT

-- X Y (no --command)

args: [X, Y]

Docker CMD

With environment variables

k run web --image=nginx --env="ENV=prod"
k run web --image=nginx --env="A=1" --env="B=2"
k run web --image=nginx --env="ENV=prod" --env="DEBUG=true"

With resources

k run web --image=nginx \
  --requests='cpu=100m,memory=64Mi' \
  --limits='cpu=200m,memory=128Mi'

Interactive / throwaway

# temp shell inside cluster network, auto-deletes on exit
k run tmp --image=busybox --rm -it --restart=Never -- sh
k run tmp --image=alpine --rm -it --restart=Never -- sh
k run tmp --image=nicolaka/netshoot --rm -it --restart=Never -- bash   # network tools

# one-shot command, then delete
k run tmp --image=busybox --rm -it --restart=Never -- wget -qO- 10.244.1.5
k run tmp --image=busybox --rm -it --restart=Never -- nslookup kubernetes.default
k run curl --image=curlimages/curl --rm -it --restart=Never -- curl -s http://my-svc

Generate YAML (the exam technique)

k run web --image=nginx $do                              # print to stdout
k run web --image=nginx $do > pod.yaml                   # save to file
k run web --image=nginx --port=80 --labels=app=web $do > pod.yaml
k run busybox --image=busybox $do -- sleep 3600 > pod.yaml

# then
vim pod.yaml
k apply -f pod.yaml

From file

k apply -f pod.yaml                    # create or update (declarative)
k create -f pod.yaml                   # create only, errors if exists
k replace -f pod.yaml                  # replace existing
k replace --force -f pod.yaml          # delete + recreate
k apply -f ./manifests/                # whole directory
k apply -f https://example.com/pod.yaml
k apply -f pod.yaml --dry-run=server   # validate against the API server

Static Pod (node-level, no API server needed)

# on the node, drop YAML into the kubelet's manifest dir
/etc/kubernetes/manifests/

# find the configured path
grep staticPodPath /var/lib/kubelet/config.yaml# kubelet picks it up automatically; name gets -<nodename> suffix
# delete the file to delete the pod — kubectl delete will NOT work

2. READ / INSPECT

Listing

k get pods
k get po                               # short name
k get pods -o wide                     # + IP, node, nominated node, readiness gates
k get pods -A                          # all namespaces
k get pods --all-namespaces
k get pods -n kube-system
k get pods -w                          # watch live
k get pods --watch-only                # only show changes
k get pod web                          # single pod
k get pods,svc                         # multiple resource types

Output formats

k get pod web -o yaml
k get pod web -o json
k get pods -o name                             # pod/web, pod/redis
k get pods -o wide
k get pods --no-headers
k get pods --no-headers | wc -l                # count pods

Custom columns

k get pods -o custom-columns=NAME:.metadata.name,NODE:.spec.nodeName
k get pods -o custom-columns=\
NAME:.metadata.name,\
IMAGE:.spec.containers[*].image,\
NODE:.spec.nodeName,\
STATUS:.status.phase
k get pods -o custom-columns=NAME:.metadata.name,RESTARTS:.status.containerStatuses[0].restartCount

jsonpath

k get pod web -o jsonpath='{.spec.nodeName}{"\n"}'
k get pod web -o jsonpath='{.status.podIP}{"\n"}'
k get pod web -o jsonpath='{.spec.containers[0].image}{"\n"}'
k get pod web -o jsonpath='{.status.phase}{"\n"}'
k get pod web -o jsonpath='{.metadata.labels}{"\n"}'

# all pod names
k get pods -o jsonpath='{.items[*].metadata.name}'
# all images in cluster
k get pods -A -o jsonpath='{.items[*].spec.containers[*].image}' | tr ' ' '\n' | sort -u
# name + node pairs
k get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.nodeName}{"\n"}{end}'
# exit code of last terminated container
k get pod web -o jsonpath='{.status.containerStatuses[0].lastState.terminated.exitCode}{"\n"}'
# container names in a pod
k get pod web -o jsonpath='{.spec.containers[*].name}{"\n"}'

Sorting

k get pods --sort-by=.metadata.name
k get pods --sort-by=.metadata.creationTimestamp
k get pods --sort-by=.status.containerStatuses[0].restartCount
k get pods --sort-by=.spec.nodeName
k get pods -A --sort-by=.metadata.creationTimestamp

Filtering by label

k get pods -l app=web
k get pods -l app=web,tier=front              # AND
k get pods -l 'app in (web,api)'
k get pods -l 'app notin (db)'
k get pods -l app!=db
k get pods -l app                             # has the label, any value
k get pods -l '!app'                          # does NOT have the label
k get pods --show-labels
k get pods -L app,tier                        # labels as columns

Filtering by field

k get pods --field-selector status.phase=Running
k get pods --field-selector status.phase!=Running
k get pods --field-selector spec.nodeName=cka-worker
k get pods -A --field-selector metadata.namespace!=kube-system

Describe

k describe pod web
k describe pod web -n dev
k describe pods -l app=web
k describe pod web | grep -A15 Events
k describe pod web | grep -E "Warning|Failed|Error"    # the useful one
k describe pod web | grep -A5 "Last State"

Events

k get events
k get events --sort-by=.metadata.creationTimestamp
k get events --field-selector involvedObject.name=web
k get events --field-selector type=Warning
k get events -A --sort-by=.lastTimestamp
k events --for pod/web                          # k8s 1.28+
k events --for pod/web --watch

Explain (built-in docs, works offline, exam-legal)

k explain pod
k explain pod.spec
k explain pod.spec.containers
k explain pod.spec.containers.livenessProbe
k explain pod.spec.containers.resources
k explain pod.spec.volumes
k explain pod --recursive | less
k explain pod.spec --recursive | head -50
k explain pod.spec.securityContext --recursive

3. LOGS

k logs web
k logs web -f                          # follow
k logs web --previous                  # PREVIOUS crashed container — critical
k logs web -p                          # same, short flag
k logs web -c sidecar                  # specific container
k logs web --all-containers=true
k logs web --tail=50
k logs web --tail=-1                   # everything
k logs web --since=10m
k logs web --since=1h
k logs web --since-time=2026-09-21T10:00:00Z
k logs web --timestamps
k logs web --limit-bytes=1000

# multiple pods by label
k logs -l app=web
k logs -l app=web --all-containers=true --tail=100
k logs -l app=web -f --max-log-requests=10# save to file (exam questions often require this)
k logs web > /opt/logs.txt
k logs web -c app | grep ERROR > /opt/errors.txt

4. EXEC / SHELL

k exec web -- ls /usr/share/nginx/html
k exec web -- cat /etc/nginx/nginx.conf
k exec web -- env
k exec web -- ps aux
k exec -it web -- sh
k exec -it web -- /bin/bash
k exec -it web -c sidecar -- sh              # specific container
k exec web -- sh -c 'echo hello > /tmp/f && cat /tmp/f'
k exec web -- sh -c 'echo "hi" > /usr/share/nginx/html/index.html'

# test from inside the cluster
k exec web -- wget -qO- http://my-svc
k exec web -- nslookup kubernetes.default
k exec web -- curl -s http://10.244.1.5
k exec web -- cat /var/run/secrets/kubernetes.io/serviceaccount/token

Use sh not bash on slim images (alpine, busybox, distroless-ish). bash often does not exist.

Ephemeral debug container (for distroless / no shell)

k debug -it web --image=busybox --target=web
k debug -it web --image=nicolaka/netshoot --target=web
k debug node/cka-worker -it --image=busybox       # debug a node
k debug web -it --copy-to=web-debug --image=busybox   # copy pod with debug container

5. FILE TRANSFER

k cp web:/etc/nginx/nginx.conf ./nginx.conf        # pod -> local
k cp ./index.html web:/usr/share/nginx/html/       # local -> pod
k cp web:/var/log ./logs -c sidecar                # specific container
k cp ./file dev/web:/tmp/file                      # with namespace
k cp web:/tmp/data ./data --retries=3

Requires tar in the container. Fails silently-ish on images without it.

6. NETWORKING / ACCESS

k port-forward pod/web 8080:80             # localhost:8080 -> pod:80
k port-forward web 8080:80                 # same
k port-forward pod/web 8080                # same port both sides
k port-forward pod/web 8080:80 8443:443    # multiple
k port-forward pod/web :80                 # random local port
k port-forward --address 0.0.0.0 pod/web 8080:80   # listen on all interfaces

# then
curl localhost:8080

# pod IP is only reachable INSIDE the cluster
IP=$(k get pod web -o jsonpath='{.status.podIP}')
k run tmp --image=busybox --rm -it --restart=Never -- wget -qO- $IP

# raw API proxy
k proxy --port=8001
curl http://localhost:8001/api/v1/namespaces/default/pods/web

7. UPDATE / PATCH

What you CAN change on a running Pod

Field

Mutable

spec.containers[*].image

yes

spec.activeDeadlineSeconds

yes (decrease only)

spec.tolerations

yes (additions only)

spec.terminationGracePeriodSeconds

yes (to 1, during delete)

metadata.labels

yes

metadata.annotations

yes

everything else

k set image pod/web web=nginx:1.25
k set image pod/web nginx=nginx:1.25 redis=redis:7      # multi-container

k label pod web env=prod
k label pod web env=staging --overwrite
k label pod web env-                                     # remove label
k label pods --all env=test
k label pods -l app=web tier=frontendk annotate pod web owner=team-a
k annotate pod web owner=team-b --overwrite
k annotate pod web owner-k patch pod web -p '{"spec":{"containers":[{"name":"web","image":"nginx:1.25"}]}}'
k patch pod web --type=json -p='[{"op":"replace","path":"/spec/containers/0/image","value":"nginx:1.25"}]'
k patch pod web -p '{"metadata":{"labels":{"env":"prod"}}}'k edit pod web
KUBE_EDITOR=nano k edit pod web

When the field is immutable

Pod "web" is invalid: spec: Forbidden: pod updates may not change fields
other than `spec.containers[*].image`...

k get pod web -o yaml > web.yaml
vim web.yaml
k replace --force -f web.yaml

8. DELETE

k delete pod web
k delete pod web --grace-period=30                 # default is 30
k delete pod web --grace-period=0 --force          # immediate, no cleanup
k delete pod web $now                              # same, aliased
k delete pods web redis sleeper                    # multiple
k delete pods --all
k delete pods --all -n dev
k delete pods --all -A
k delete pods -l app=web                           # by label
k delete pods --field-selector status.phase=Failed
k delete -f pod.yaml
k delete pods --all --wait=false                   # don't block

Stuck in Terminating

k delete pod web --grace-period=0 --force
k patch pod web -p '{"metadata":{"finalizers":null}}'       # finalizer stuck
k get pod web -o jsonpath='{.metadata.finalizers}{"\n"}'    # inspect first

9. TROUBLESHOOTING WORKFLOW

Step 1 — which lifecycle stage broke?

k get pods -o wide

Status

Broken stage

Go to

Pending

scheduler — no node assigned

describe, check Events + node capacity

ContainerCreating

kubelet — volume/network setup

describe, check volumes + CNI

ImagePullBackOff / ErrImagePull

containerd — registry

describe, check image name, secrets, TLS

CrashLoopBackOff

your app — starts then dies

logs --previous, exit code

Running but 0/1

readiness probe failing

describe, check probe config

Error / Failed

container exited non-zero

logs --previous, exit code

Completed

ran and exited 0

expected for Jobs; wrong for Deployments

Terminating (stuck)

finalizer or node gone

force delete, patch finalizers

Evicted

node pressure

describe node, free disk/memory

OOMKilled

exceeded memory limit

raise resources.limits.memory

Step 2 — read the warnings only

k describe pod web | grep -E "Warning|Failed|Error"

Normal events are things that worked. Do not read them. Warning is the answer.

Step 3 — dead container logs

k logs web --previous
k logs web --previous -c app

Step 4 — exit code

k get pod web -o jsonpath='{.status.containerStatuses[0].lastState.terminated.exitCode}{"\n"}'
k get pod web -o jsonpath='{.status.containerStatuses[0].lastState.terminated.reason}{"\n"}'
k describe pod web | grep -A5 "Last State"

Exit code

Meaning

Fix

finished OK, but restartPolicy: Always restarts it

give it a long-running command, or use a Job

application error

Get Pradyumna Kumar Das’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

read the logs

125

container runtime failed

check containerd

126

command found, not executable

check permissions / shebang

127

command not found

typo in command/args

137

SIGKILL — OOMKilled

raise memory limit

139

SIGSEGV — segfault

application bug

143

SIGTERM — graceful shutdown

usually normal

Step 5 — full state dump

k get pod web -o yaml
k get pod web -o jsonpath='{.status.conditions}' | jq
k get pod web -o json | jq '.status'

Common errors and fixes

Error

Cause

Fix

AlreadyExists

name taken in that namespace

k delete pod X $now then recreate

0/3 nodes available: Insufficient cpu

requests too high

lower resources.requests

node(s) had untolerated taint

taint blocks scheduling

add toleration

didn't match node selector

bad nodeSelector

fix label or selector

manifest unknown / not found

bad image name or tag

correct the image

pull access denied

private registry

create + attach imagePullSecrets

x509: certificate signed by unknown authority

corporate TLS proxy, node lacks CA

install CA into node trust store

exec: "X": executable file not found

typo in command, or binary absent

space not = after --

unable to upgrade connection: pod does not exist

wrong name or namespace

k get pods -A | grep X

OCI runtime exec failed: "bash": no such file

slim image

use sh

field is immutable

non-mutable Pod field

k replace --force -f

The connection to the server localhost:8080 was refused

no kubeconfig

export KUBECONFIG=~/.kube/config

Private registry secret

k create secret docker-registry regcred \
  --docker-server=myreg.io \
  --docker-username=user \
  --docker-password=pass \
  --docker-email=a@b.com

spec:
  imagePullSecrets:
    - name: regcred
  containers:
    - name: app
      image: myreg.io/app:1.0

10. RESOURCE USAGE

k top pod                              # needs metrics-server
k top pod web
k top pod --containers
k top pods -A
k top pods --sort-by=cpu
k top pods --sort-by=memory
k top pods -l app=web
k top node

# QoS class
k get pod web -o jsonpath='{.status.qosClass}{"\n"}'

QoS class

Condition

Evicted

Guaranteed

requests == limits, all containers

last

Burstable

requests set, < limits

middle

BestEffort

nothing set

first

11. SCHEDULING CONTROL

# see where pods landed
k get pods -o wide
k get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.nodeName}{"\n"}{end}'

# node labels for nodeSelector
k get nodes --show-labels
k label node cka-worker disktype=ssd
k label node cka-worker disktype-# taints
k taint node cka-worker key=value:NoSchedule
k taint node cka-worker key=value:NoSchedule-        # remove
k describe node cka-worker | grep -i taint# cordon / drain
k cordon cka-worker
k uncordon cka-worker
k drain cka-worker --ignore-daemonsets --delete-emptydir-data
k drain cka-worker --ignore-daemonsets --force        # includes unmanaged pods

# nodeSelector
spec:
  nodeSelector:
    disktype: ssd

# direct node assignment (bypasses scheduler)
spec:
  nodeName: cka-worker# toleration
spec:
  tolerations:
    - key: "key"
      operator: "Equal"
      value: "value"
      effect: "NoSchedule"# node affinity
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: disktype
                operator: In
                values: ["ssd"]

12. MULTI-CONTAINER PODS

k logs web -c app
k logs web --all-containers=true
k exec -it web -c sidecar -- sh
k get pod web -o jsonpath='{.spec.containers[*].name}{"\n"}'
k describe pod web | grep -A3 "Containers:"

# init container logs
k logs web -c init-db
k get pod web -o jsonpath='{.spec.initContainers[*].name}{"\n"}'
k get pod web -o jsonpath='{.status.initContainerStatuses[0].state}' | jq

apiVersion: v1
kind: Pod
metadata:
  name: web
spec:
  initContainers:
    - name: init-db
      image: busybox
      command: ['sh', '-c', 'until nslookup db; do sleep 2; done']
  containers:
    - name: app
      image: nginx:1.27
      volumeMounts:
        - name: shared
          mountPath: /usr/share/nginx/html
    - name: sidecar
      image: busybox
      command: ['sh', '-c', 'while true; do date >> /data/index.html; sleep 10; done']
      volumeMounts:
        - name: shared
          mountPath: /data
  volumes:
    - name: shared
      emptyDir: {}

Containers in a Pod share a network namespace — they reach each other on localhost.
Init containers run to completion, in order, before app containers start.

13. CONFIG INJECTION

k create configmap app-config --from-literal=KEY=value
k create configmap app-config --from-literal=A=1 --from-literal=B=2
k create configmap app-config --from-file=config.properties
k create configmap app-config --from-file=./configs/
k create configmap app-config --from-env-file=.env

k create secret generic db-secret --from-literal=password=s3cret
k create secret generic db-secret --from-file=./password.txt
k create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=...
k create secret tls tls-secret --cert=tls.crt --key=tls.keyk get configmap app-config -o yaml
k get secret db-secret -o jsonpath='{.data.password}' | base64 -d

spec:
  containers:
    - name: app
      image: nginx
      env:
        - name: SINGLE_KEY
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: KEY
        - name: SECRET_VAL
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: password
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
      envFrom:
        - configMapRef:
            name: app-config
        - secretRef:
            name: db-secret
      volumeMounts:
        - name: config-vol
          mountPath: /etc/config
        - name: secret-vol
          mountPath: /etc/secret
          readOnly: true
  volumes:
    - name: config-vol
      configMap:
        name: app-config
    - name: secret-vol
      secret:
        secretName: db-secret

14. PROBES

k describe pod web | grep -A5 Liveness
k describe pod web | grep -A5 Readiness
k get pod web -o jsonpath='{.status.conditions}' | jq
k explain pod.spec.containers.livenessProbe --recursive

spec:
  containers:
    - name: app
      image: nginx
      livenessProbe:               # restart container if failing
        httpGet:
          path: /healthz
          port: 8080
        initialDelaySeconds: 10
        periodSeconds: 10
        timeoutSeconds: 1
        failureThreshold: 3
      readinessProbe:              # remove from Service endpoints if failing
        exec:
          command: ["cat", "/tmp/ready"]
        initialDelaySeconds: 5
        periodSeconds: 5
      startupProbe:                # disables the other two until it passes
        tcpSocket:
          port: 8080
        failureThreshold: 30
        periodSeconds: 10

Probe

Fails →

Use for

liveness

container restarted

detect deadlock / hung process

readiness

pod removed from Service endpoints

detect “not ready for traffic yet”

startup

container restarted; blocks other probes until pass

slow-booting apps

15. SECURITY CONTEXT

k exec web -- id
k exec web -- whoami
k get pod web -o jsonpath='{.spec.securityContext}' | jq
k get pod web -o jsonpath='{.spec.containers[0].securityContext}' | jq
k explain pod.spec.securityContext --recursive

spec:
  securityContext:                 # pod level — applies to all containers
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    runAsNonRoot: true
  containers:
    - name: app
      image: nginx
      securityContext:             # container level — overrides pod level
        runAsUser: 2000
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        privileged: false
        capabilities:
          add: ["NET_ADMIN", "SYS_TIME"]
          drop: ["ALL"]

16. SERVICE ACCOUNTS

k create serviceaccount app-sa
k get serviceaccount
k get sa app-sa -o yaml
k run web --image=nginx --serviceaccount=app-sa $do > pod.yaml   # older kubectl
k set serviceaccount pod web app-sa                              # not for live pods
k auth can-i list pods --as=system:serviceaccount:default:app-sa
k create token app-sa                                            # k8s 1.24+

spec:
  serviceAccountName: app-sa
  automountServiceAccountToken: false

# token location inside the pod
k exec web -- cat /var/run/secrets/kubernetes.io/serviceaccount/token
k exec web -- cat /var/run/secrets/kubernetes.io/serviceaccount/namespace

17. VOLUMES

k describe pod web | grep -A10 Volumes
k get pod web -o jsonpath='{.spec.volumes}' | jq
k exec web -- df -h
k exec web -- mount | grep /data

spec:
  containers:
    - name: app
      image: nginx
      volumeMounts:
        - name: scratch
          mountPath: /scratch
        - name: host
          mountPath: /host-log
        - name: data
          mountPath: /data
        - name: cfg
          mountPath: /etc/cfg
  volumes:
    - name: scratch
      emptyDir: {}
    - name: scratch-mem
      emptyDir:
        medium: Memory
        sizeLimit: 128Mi
    - name: host
      hostPath:
        path: /var/log
        type: Directory
    - name: data
      persistentVolumeClaim:
        claimName: my-pvc
    - name: cfg
      configMap:
        name: app-config

18. NAMESPACES

k get pods -n dev
k get pods -A
k create namespace dev
k config set-context --current --namespace=dev     # set default — do this in the exam
k config view --minify | grep namespace
k get pods --all-namespaces -o wide
k delete namespace dev                             # deletes everything inside

Forgetting -n <namespace> is the number one way to lose exam marks.

19. CONTEXT SAFETY

k config current-context                # RUN THIS FIRST, EVERY SESSION
k config get-contexts
k config use-context kind-cka
k config set-context --current --namespace=dev
k cluster-info
k api-resources
k api-resources --namespaced=true
k api-versions
k version --short

20. POD YAML — FULL ANNOTATED REFERENCE

apiVersion: v1
kind: Pod
metadata:
  name: web
  namespace: default
  labels:
    app: frontend
    tier: web
  annotations:
    owner: team-a
spec:
  # --- scheduling ---
  nodeSelector:
    disktype: ssd
  nodeName: cka-worker                  # bypasses scheduler entirely
  tolerations:
    - key: "key"
      operator: "Equal"
      value: "value"
      effect: "NoSchedule"
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: disktype
                operator: In
                values: ["ssd"]

  # --- lifecycle ---
  restartPolicy: Always                 # Always | OnFailure | Never
  terminationGracePeriodSeconds: 30
  activeDeadlineSeconds: 3600
  hostname: web
  subdomain: mysvc
  dnsPolicy: ClusterFirst  # --- identity ---
  serviceAccountName: app-sa
  automountServiceAccountToken: false  # --- security (pod level) ---
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    runAsNonRoot: true  # --- registry auth ---
  imagePullSecrets:
    - name: regcred  # --- init containers: run in order, to completion, before app containers ---
  initContainers:
    - name: init-db
      image: busybox
      command: ['sh', '-c', 'until nslookup db; do sleep 2; done']  # --- app containers ---
  containers:
    - name: app
      image: nginx:1.27
      imagePullPolicy: IfNotPresent     # Always | IfNotPresent | Never
      command: ["nginx"]                # overrides ENTRYPOINT
      args: ["-g", "daemon off;"]       # overrides CMD
      workingDir: /app
      ports:
        - name: http
          containerPort: 80
          protocol: TCP
      env:
        - name: ENV
          value: "prod"
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
      envFrom:
        - configMapRef:
            name: app-config
      resources:
        requests:
          cpu: 100m
          memory: 64Mi
        limits:
          cpu: 200m
          memory: 128Mi
      volumeMounts:
        - name: data
          mountPath: /data
          readOnly: false
      livenessProbe:
        httpGet:
          path: /healthz
          port: 80
        initialDelaySeconds: 10
        periodSeconds: 10
      readinessProbe:
        tcpSocket:
          port: 80
        initialDelaySeconds: 5
      startupProbe:
        httpGet:
          path: /healthz
          port: 80
        failureThreshold: 30
        periodSeconds: 10
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
      lifecycle:
        postStart:
          exec:
            command: ["sh", "-c", "echo started"]
        preStop:
          exec:
            command: ["sh", "-c", "nginx -s quit"]  volumes:
    - name: data
      emptyDir: {}

21. EXAM SPEED PATTERNS

# generate + edit + apply — never hand-type apiVersion
k run web --image=nginx $do > p.yaml && vim p.yaml && k apply -f p.yaml

# edit an immutable field
k get pod web -o yaml > p.yaml && vim p.yaml && k replace --force -f p.yaml# instant delete (saves 30s per pod)
k delete pod web $now# throwaway network test
k run tmp --image=busybox --rm -it --restart=Never -- wget -qO- http://my-svc# find field names without leaving the terminal
k explain pod.spec.containers.livenessProbe --recursive# set default namespace once instead of typing -n every command
k config set-context --current --namespace=ecom# write output to the exact path the question demands
k get pods -o wide > /opt/answers/q3.txt
k logs web --previous > /opt/answers/q7.txt# count things
k get pods --no-headers | wc -l
k get pods --no-headers -l app=web | wc -l
k get pods -A --no-headers --field-selector status.phase=Running | wc -l

The 6 exam rules

k config current-context — every question specifies a context. Run its use-context line.
-n <namespace> — or k config set-context --current --namespace=X. Most common lost mark.
Never hand-write YAML. Always $do.
Exact file path, exact filename when asked to save output.
Stuck > 6 minutes? Flag it, move on. All questions weighted equally.
k explain beats the docs site. Faster, offline, allowed.

22. THE 25 COMMANDS THAT COVER 90%

# safety
k config current-context
k config set-context --current --namespace=X

# create
k run NAME --image=IMG --labels=k=v --port=80
k run NAME --image=IMG $do > p.yaml
k run tmp --image=busybox --rm -it --restart=Never -- sh
k apply -f p.yaml# read
k get pods -o wide
k get pods -l app=web
k get pod NAME -o yaml
k get pod NAME -o jsonpath='{.spec.nodeName}{"\n"}'
k describe pod NAME | grep -E "Warning|Failed|Error"
k get events --sort-by=.metadata.creationTimestamp
k explain pod.spec.containers# debug
k logs NAME
k logs NAME --previous
k logs NAME -c CONTAINER
k exec -it NAME -- sh
k port-forward pod/NAME 8080:80
k top pod NAME# modify
k set image pod/NAME CONTAINER=IMG
k label pod NAME k=v --overwrite
k edit pod NAME
k replace --force -f p.yaml# delete
k delete pod NAME $now
k delete pods -l app=web