kubectl One-Liners I Actually Use in Incidents

These are the commands I reach for during an incident, roughly in the order I run them.

Find what's actually broken

kubectl get pods -A --field-selector=status.phase!=Running

Last restart reason across a namespace

kubectl get pods -n prod -o json | \
  jq -r '.items[] | select(.status.containerStatuses[]?.restartCount > 0) |
    "\(.metadata.name) \(.status.containerStatuses[0].lastState.terminated.reason)"'

Tail logs from every pod matching a label

kubectl logs -n prod -l app=checkout -f --max-log-requests=20 --prefix

Previous container logs after a crash loop

kubectl logs <pod> -c <container> --previous

Which node is under memory pressure

kubectl top nodes --sort-by=memory

Events sorted by time, not name

kubectl get events -n prod --sort-by='.lastTimestamp'

Exec into a pod with no shell (debug container)

kubectl debug -it <pod> --image=busybox:1.36 --target=<container>

Find pods that are pending and why

kubectl get pods -A --field-selector=status.phase=Pending -o wide
kubectl describe pod <pod> | grep -A5 Events

Keep this list nearby — under load you don't want to be reconstructing jq filters from scratch.