CLI · Kubernetes operations · Kubernetes contributors
kubectl
Inspect Kubernetes resources and prepare or apply manifests, with cluster context, namespace and permissions kept explicit.
Kubeconfig is executable configuration. A kubeconfig can invoke credential helper programs or point at an unintended server. Use trusted files and inspect the active context before connecting.
Understand the tool
What it does.
kubectl is the standard command-line client for the Kubernetes API. It can inspect workloads, generate resource manifests and request changes to a cluster. It also includes local tools such as client-side dry runs and Kustomize rendering, which are useful before any cluster request.
Why use it?
Use it when the work is understanding or operating a Kubernetes environment. Begin by confirming context and namespace. Local manifest generation lets you inspect what you intend to submit, while server-side validation and authorization remain separate checks in the target cluster.
A useful fit for
- Inspecting workload state
- Preparing Kubernetes manifests
- Reviewing environment-specific configuration
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Prepare a configuration manifest
A service needs a small configuration change that should be reviewed before deployment.
- Generate a manifest with a client-side dry run.
- Inspect names, namespace and data in the generated output.
- Use the team's cluster validation and approval process before applying it.
Intended outputA readable proposal without creating a cluster resource during preparation.
Use case 02
Investigate a workload in the right environment
An operator needs to explain why a workload is not ready.
- Confirm the active cluster context and explicit namespace.
- Read the relevant resource status and permitted events or logs.
- Separate observed symptoms from a proposed fix before requesting a change.
Intended outputAn investigation tied to the intended environment and available permissions.
A concrete starting point
Generate a ConfigMap for review
Prints a ConfigMap manifest for a synthetic reporting setting. The distinct example name and values were not used in the runtime probes.
kubectl create configmap reporting-settings --from-literal=format=json --dry-run=client -o yamlWhat this can change
Generates output locally and does not create the ConfigMap in a cluster. Treat literal values in shell history and generated files as visible data.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- A kubectl binary
- Trusted kubeconfig and authorization for cluster work
- An explicit cluster context and namespace for remote operations
- Authentication
- Local generation can run without an account. Cluster requests authenticate through the configured kubeconfig and must be authorized by the cluster.
- Can read
- Local manifests and kubeconfig
- Cluster resources and logs allowed by the active identity
- Can write or change
- Generated local output
- Cluster resources when a write command is issued and authorized
- Network and data flow
- The configured Kubernetes API server
- Authentication or remote configuration sources when configured
- Approval and control
- Check context and namespace before every impactful command. RBAC and admission policy live on the server; a successful local dry run does not prove a request will be accepted.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Windows, macOS and Linux
- Use a kubectl version within the supported minor-version skew of your API server; check the cluster version
Costs and account requirements
kubectl uses Apache 2.0 terms with no required software subscription. Kubernetes hosting, compute and support can cost separately.
Current pricing or plan information ↗Apache 2.0
Applies to kubectl; cluster providers and services have their own terms.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Kubeconfig is executable configuration
A kubeconfig can invoke credential helper programs or point at an unintended server. Use trusted files and inspect the active context before connecting.
Secret manifests still expose values
Base64 in a Secret manifest is reversible. Keep generated Secret files and terminal output out of public logs and repositories.
The wrong context changes the wrong cluster
A correct command can still target the wrong environment. Explicitly select context and namespace, and use the narrowest practical identity.
Where it may fall short
- Client-side generation does not exercise server schema, admission policy, RBAC or scheduling.
- Kustomize local loading rules are useful constraints, not a complete sandbox for arbitrary configuration.
Observed behavior · 2026-10-18
Runtime and security findings.
Client-side generation produced a ConfigMap and Secret without a cluster. Kustomize changed a replica count and rejected a file outside its root. Secret data was visibly reversible base64.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation · medium severity under stated conditions
Secret output is encoded, not concealed
The client-side Secret contained c3ludGhldGljLW9ubHk=, which decodes to the authored synthetic-only value. This says nothing about cluster encryption at rest because no cluster was contacted.
In practice: Treat Secret manifests, terminal history and generated output as sensitive material; use the team's secret-management process.
Observed in this evaluation
The default local loading rule rejected this outside file
Kustomize rejected ../outside.txt from the restricted directory. The control was observed for one configMapGenerator path, not every local or remote loading mechanism.
In practice: Keep local overlays self-contained and avoid weakening load restrictions without reviewing the additional files.
Documented concern · medium severity under stated conditions
Trust kubeconfig before using it
Kubernetes documents that an untrusted kubeconfig can cause code execution or file exposure. An apparently read-only kubectl command can still trigger configured authentication helpers.
In practice: Accept kubeconfig only from trusted sources, inspect exec entries and verify context before any cluster operation.
Version, environment and fixture
- Version or deployment
- v1.37.1; commit f78e722310e50bcaca9276be22276d9e91d91308
- Tested target
- https://dl.k8s.io/release/v1.37.1/bin/windows/amd64/kubectl.exe
- Artifact identity
- SHA-256 14b93c4916a6f37a06fbc1f46b0a1d2404c4f9741be09f00d6caf8af3b05f1d3 of the downloaded executable. Matched the official release checksum; detached signatures were not verified.
- Environment and fixture
- Windows 11 x64; Python 3.12.10 harness. Raw timestamps use UTC.
- Fresh per-tool home, config, cache and temporary directories. Child environments used allowlisted OS/runtime paths without inherited account credentials. Only synthetic local files were used.
- Configuration isolation is a test control, not an operating-system sandbox.
- KUBECONFIG pointed to a fresh path with no cluster credentials. All manifests and values were synthetic.
Checks and results
5 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Pinned client versionMet expectation
- Method
Use an isolated KUBECONFIG path with no cluster credentials. Command argument array: ["kubectl", "version", "--client", "-o", "json"].- Expected
- Print only client version information.
- Observed
- Exit 0. clientVersion.gitVersion="v1.37.1", gitCommit="f78e722310e50bcaca9276be22276d9e91d91308".
Generate a ConfigMap locallyMet expectation
- Method
Use an isolated KUBECONFIG path with no cluster credentials. Command argument array: ["kubectl", "create", "configmap", "ionbin-fixture", "--from-literal=mode=test", "--dry-run=client", "-o", "json"].- Expected
- Print a ConfigMap without creating a cluster resource.
- Observed
- Exit 0. kind=ConfigMap, metadata.name=ionbin-fixture, data={"mode":"test"}.
Inspect Secret encoding locallyMet expectation
- Method
Use an isolated KUBECONFIG path with no cluster credentials. The literal token is synthetic-only, not a real credential. Command argument array: ["kubectl", "create", "secret", "generic", "ionbin-fixture", "--from-literal=token=synthetic-only", "--dry-run=client", "-o", "json"].- Expected
- Print the synthetic Secret with base64 data.
- Observed
- Exit 0. kind=Secret, metadata.name=ionbin-fixture, data.token="c3ludGhldGljLW9ubHk="; decoding yields synthetic-only.
Render a local replica overrideMet expectation
- Method
Create overlay/deployment.yaml with: apiVersion: apps/v1 kind: Deployment metadata: name: ionbin-fixture spec: replicas: 1 selector: matchLabels: app: ionbin-fixture template: metadata: labels: app: ionbin-fixture spec: containers: - name: app image: example.invalid/fixture:1 Create overlay/kustomization.yaml with: resources: - deployment.yaml replicas: - name: ionbin-fixture count: 2 Command argument array: ["kubectl", "kustomize", "overlay"].- Expected
- Render the Deployment with replicas=2.
- Observed
- Exit 0. Rendered one apps/v1 Deployment named ionbin-fixture with spec.replicas=2 and image example.invalid/fixture:1. No image was pulled or resource submitted.
Reject a file outside the Kustomize rootMet expectation
- Method
Create outside.txt containing synthetic-outside-root followed by a newline. Create restricted/kustomization.yaml with: configMapGenerator: - name: outside-probe files: - ../outside.txt Command argument array: ["kubectl", "kustomize", "restricted"].- Expected
- Reject loading ../outside.txt outside the selected root.
- Observed
- Exit 1. Error loading file sources [../outside.txt]: security; the file was not in or below the restricted directory.
Practical caveats
- No Kubernetes API server was contacted; local generation cannot establish RBAC, admission behavior or deployment success.
- The evaluated client is v1.37.1. Confirm supported version skew before using it with a real cluster.
What this evaluation does not establish
- Cluster connections, server-side dry runs, RBAC, admission policy, deployment and client/server compatibility.
- Exec authentication plugins, real Secrets, encryption at rest and every Kustomize filesystem or remote-loading boundary.
The basis for this review
Why it’s in the collection.
Adds Kubernetes inspection and manifest preparation, a distinct workflow for readers who already operate clusters. Its placement reflects that specialized prerequisite and does not imply lower quality than general-purpose tools. The original catalog order is preserved; this is an editorial position, not a measured adoption or security rank.
The number is an editorial starting order within the cli tools collection. It does not measure popularity, speed, reliability or safety.
Why we added it
Adds Kubernetes operations and local manifest generation; client-only behavior can be distinguished from cluster authorization.
Selection evidence checked .
- Repository interest
- 3,361 GitHub stars at this snapshot ↗
Interest in the official kubectl split source mirror. This does not measure adoption of Kubernetes or kubectl.
- Repository activity
- Last push reported by GitHub: . A push can include documentation or maintenance; it does not establish a new stable release.
- Release signal
- No release was reported by the checked GitHub latest-release endpoint. The evaluated package version is recorded above.
- A single dated repository-interest/release snapshot; not measured adoption, growth, effectiveness or security.
- Repository interest and release activity do not establish reliability, model quality or safety. The evaluation names the exact version and conditions tested.
What we reviewed
- Official documentation, repository, license and release identity
- Practical access boundaries and a separate bounded runtime evaluation
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- kubectl reference ↗kubernetes.io
- Kubeconfig trust and context selection ↗kubernetes.io
- Kustomize manifest generation ↗kubernetes.io
- Secret data and storage caveats ↗kubernetes.io
- kubectl repository ↗github.com
- Apache 2.0 license ↗github.com