Subcommands Reference¶

Subcommand overview¶

Subcommand	Aliases	Scope
`pods`	`pod`, `po`	Namespaced
`containers`	`container`	Namespaced
`nodes`	`node`, `no`	Cluster-wide
`namespace`	`namespaces`, `ns`	Cluster-wide
`pvc`	`pvcs`, `persistentvolumeclaim`, `persistentvolumeclaims`	Namespaced
`pv`	`pvs`, `persistentvolume`, `persistentvolumes`	Cluster-wide
`jobs`	`job`	Namespaced
`cronjobs`	`cronjob`, `cj`	Namespaced
`service`	`services`, `svc`	Namespaced
`deploy`	`deployment`, `deployments`	Namespaced
`events`	`event`, `ev`	Namespaced

For exact detection rules per subcommand, see Audit Rules.

pods¶

Lists pods that are not in a healthy steady state.

kubectl audit pods [-n NAMESPACE] [-A] [-l SELECTOR] [-o FORMAT]

Flagged when: phase ≠ Running, any container not Ready, or restart count ≥ 5. Succeeded/Completed pods are included.

Default columns: NAME, READY, STATUS, RESTARTS, AGE
With -A: prepends NAMESPACE column (same as kubectl get pods -A)

containers¶

Per-container rows — finer detail than pods.

kubectl audit containers [-n NAMESPACE] [-A] [-l SELECTOR] [-p POD] [-o FORMAT]

Flagged when: image pull errors, crash-loop waiting states, not ready, restart count ≥ 5, failed init containers.

Default columns: POD, NAME, READY, STATUS, RESTARTS, AGE, TYPE
With -o wide: adds PORTS, IMAGE, PULLPOLICY

pods vs containers

Use pods for a quick count. Use containers when you need to pinpoint which container inside a multi-container pod is broken.

nodes¶

Lists nodes that cannot be scheduled to.

kubectl audit nodes [-o FORMAT]

Flagged when: NotReady or SchedulingDisabled (cordoned via kubectl cordon).
Nodes are cluster-scoped — -n and -A do not apply.

namespace¶

Lists namespaces that are stuck deleting or contain no workloads.

kubectl audit namespace [-l SELECTOR] [-o FORMAT]

Aliases: namespaces, ns

Flagged when:

status.phase == Terminating (stuck deletion), or
the namespace has no workloads — none of: Pods, Deployments, StatefulSets, DaemonSets, ReplicaSets, Jobs, or CronJobs

ConfigMaps, Secrets, Services, and other non-workload objects alone do not prevent a namespace from being flagged as empty.

Namespaces are cluster-scoped — -n and -A do not apply. Use -l / --selector to filter the namespace list (for example kubectl audit ns -l team=platform).

pvc¶

Lists PersistentVolumeClaims not in Bound phase.

kubectl audit pvc [-n NAMESPACE] [-A] [-o FORMAT]

Flagged phases: Pending, Lost

pv¶

Lists PersistentVolumes not in Bound phase.

kubectl audit pv [-o FORMAT]

Flagged phases: Available, Released, Failed
PVs are cluster-scoped — -n and -A do not apply.

jobs¶

Lists failed Jobs.

kubectl audit jobs [-n NAMESPACE] [-A] [-l SELECTOR] [-o FORMAT]

Flagged when: status.failed > 0 (includes backoff limit reached, active deadline exceeded).

cronjobs¶

Lists suspended CronJobs.

kubectl audit cronjobs [-n NAMESPACE] [-A] [-l SELECTOR] [-o FORMAT]

Flagged when: spec.suspend = true

service¶

Lists Services whose selector matches no Pods.

kubectl audit service [-n NAMESPACE] [-A] [-l SELECTOR] [-o FORMAT]

Flagged when: non-empty spec.selector with no matching Pods in the namespace.
Skipped: type: ExternalName, empty selectors.

Note

-l/--selector filters the Service list. Pod matching always uses all Pods in the namespace.

deploy¶

Lists Deployments that are scaled down or have unhealthy replicas.

kubectl audit deploy [-n NAMESPACE] [-A] [-l SELECTOR] [-o FORMAT]

Flagged when: spec.replicas == 0, or readyReplicas < desired when desired > 0.
desired defaults to 1 when spec.replicas is unset (matches Kubernetes API default).

events¶

Lists Warning events.

kubectl audit events [-n NAMESPACE] [-A] [-l SELECTOR] [-o FORMAT]

Flagged when: type = Warning. Normal events are excluded.

Common flags¶

Flag	Short	Applies to	Description
`--all-namespaces`	`-A`	Namespaced targets	List across all namespaces
`--namespace`	`-n`	Namespaced targets	Target namespace
`--selector`	`-l`	All	Label selector (e.g., `app=web`)
`--output`	`-o`	All	Output format (see Output Formats)
`--context`		All	Kubeconfig context override
`--kubeconfig`		All	Path to kubeconfig file
`--pod`	`-p`	`containers` only	Filter to a single pod by exact name

Getting help¶

kubectl audit --help
kubectl audit <subcommand> --help