Cli on Lead DevOps

kubectl cheatsheet: essential commands for Kubernetes

Thu, 24 Sep 2026 00:00:00 +0000

kubectl is the primary interface to a Kubernetes cluster. This cheatheet covers routine operations — from context setup to pod debugging and namespace switching. All commands are verified against current kubectl versions (1.28+).

Installation and Context Setup

Installation depends on your OS. On Linux, use the package manager or the binary directly:

curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl && sudo mv kubectl /usr/local/bin/
kubectl version --client

Configuration lives in ~/.kube/config. A context defines the cluster, user, and default namespace.

Git Tag: Marking Releases and Bookmarks in History

Wed, 23 Sep 2026 00:00:00 +0000

Git Tag: Marking Releases and Bookmarks in History

Tags are Git’s mechanism for assigning meaningful labels to specific commits. Unlike branches, tags don’t move — they’re pinned to a commit and serve as anchors for releases, versions, and critical checkpoints. Without tags, release history devolves into a hash search — and that’s a direct path to deployment errors.

Types of Tags: Lightweight vs Annotated

There are two types of tags. Lightweight is just a name attached to a commit, with no additional metadata. Annotated is a full Git object with author, date, message, and signing capability.

pipx: Isolated Python CLI Tools Without the Mess

Thu, 10 Sep 2026 00:00:00 +0000

pipx solves a simple but chronic problem: you need to run a Python utility once or occasionally, and pip install pollutes the global environment or leaves behind a virtual environment you forget to clean up. pipx creates an isolated venv for each utility, installs dependencies there, and makes the binary available in $PATH. One command and the tool works without conflicting with anything.

What Is pipx and Why You Need It

pipx installs and runs Python applications in isolated virtual environments. Each utility lives in its own venv under ~/.local/pipx/venvs/, and its console-scripts are symlinked into ~/.local/bin/.

ip: Network Setup and Diagnostics in CLI

Mon, 07 Sep 2026 00:00:00 +0000

When ifconfig returns nothing and configuring a route requires a separate command, that’s not a system bug. It’s iproute2 — the package that replaced net-tools in modern Linux distributions. The ip utility from iproute2 is the standard interface for managing the Linux network stack. It covers interfaces, addresses, routes, ARP cache, routing policies, and namespace isolation.

Why iproute2 replaced net-tools

net-tools (ifconfig, route, arp, netstat, nameif) originated in BSD and migrated to Linux in the 1990s. By the 2000s it became clear: they cannot handle VLAN, IPsec, QoS, multicast routing, or Policy Routing. Each task required a separate command with unrelated syntax.

OpenSSL: TLS Certificate Verification and Parsing in CLI

Sun, 06 Sep 2026 00:00:00 +0000

Certificates expiring on prod at the worst moment — a familiar story. OpenSSL answers TLS certificate questions faster than any marketplace checker. Here are the key scenarios without the fluff.

Basic Certificate Parsing

The first command for any diagnostics is the text dump:

openssl x509 -text -noout -in cert.pem

Output shows Subject, Issuer, validity dates, signature algorithm, and public key. For a quick summary without the wall of text:

curl: HTTP Debugging in CLI

Fri, 04 Sep 2026 00:00:00 +0000

cURL is the standard tool for debugging HTTP in the terminal. It ships out of the box on Linux and macOS and is present in most Docker images. Need to quickly check an API, inspect response headers, or trace a redirect issue — one command line is enough.

Basic Debug Flags

The most common scenario: get a response and see what the server returned. The -i flag prints headers before the body, -v enables verbose mode with connection details.

ss: socket statistics instead of deprecated netstat

Thu, 03 Sep 2026 00:00:00 +0000

When netstat hangs on a server with tens of thousands of connections, it’s time to switch to ss. Part of the iproute2 package, ss queries the kernel directly via netlink instead of parsing /proc/net/*. The result is instant output with minimal overhead.

Why switch from netstat

netstat from net-tools relies on a deprecated approach: it reads from /proc/net/tcp, /proc/net/unix and converts numeric IDs to symbolic names. On a server with active connections, this takes seconds and spikes CPU usage.