# kubectl get -o jsonpath: Extract Fields to Gate CI

> kubectl get -o jsonpath pulls a single field for scripts and gates. Reference for the jsonpath syntax, range, escaping in shells, and the parsing errors.

Source: https://latchkey.dev/learn/command-reference/kubectl-get-jsonpath-gate  
Updated: 2026-06-30

kubectl get -o jsonpath=<expr> extracts a specific field (or list) from a resource so a pipeline can test or store it.

Parsing kubectl output with grep is fragile. jsonpath addresses the exact field you want and is stable across kubectl versions.

## What it does

kubectl get with `-o jsonpath` evaluates a JSONPath expression against the resource JSON and prints the matched value(s). `range`/`end` iterate lists, `{"\n"}` injects newlines, and the result is plain text suited to assigning to a shell variable.

## Common usage

```Terminal
kubectl get deploy api -o jsonpath='{.status.readyReplicas}'
# all pod names matching a label, one per line
kubectl get pods -l app=api \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}'
# gate: fail if no ready replicas
test "$(kubectl get deploy api -o jsonpath='{.status.readyReplicas}')" \
  -ge 1 || exit 1
```

## Options

| Syntax | What it does |
| --- | --- |
| -o jsonpath='{path}' | Print the value at the JSONPath |
| {range .items[*]} ... {end} | Iterate over a list |
| {.a.b} | Navigate nested fields |
| {"\n"} / {"\t"} | Insert a newline or tab between values |
| -o jsonpath-as-json | Emit the matched value as JSON (1.24+) |

## In CI

Quote the whole expression in single quotes so the shell does not expand `$` or `{}`. For a field that may be absent (like readyReplicas on a brand-new deploy), jsonpath prints an empty string, so guard the comparison or use `kubectl wait` instead of polling.

## Common errors in CI

"error: error parsing jsonpath ... unrecognized character" usually means the shell ate part of the expression; wrap it in single quotes. "error: ... is not found" with `-o jsonpath` is rare since missing fields yield empty output, but a wrong root (querying `.spec` of a list without `.items`) returns nothing. Comparing an empty string with `-ge` throws "integer expression expected"; default it to 0.

## Using this in CI

A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.

```Terminal
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods

# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info

# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes
```

> Always set `--request-timeout` in CI. Without it an unreachable API server hangs until the job times out, which turns a thirty-second failure into a twenty-minute one.

## FAQ

### kubectl get -o jsonpath: Extract Fields to Gate CI?

Parsing kubectl output with grep is fragile. jsonpath addresses the exact field you want and is stable across kubectl versions.

### What it does?

kubectl get with -o jsonpath evaluates a JSONPath expression against the resource JSON and prints the matched value(s). range/end iterate lists, {"\n"} injects newlines, and the result is plain text suited to assigning to a shell variable.

### In CI?

Quote the whole expression in single quotes so the shell does not expand $ or {}. For a field that may be absent (like readyReplicas on a brand-new deploy), jsonpath prints an empty string, so guard the comparison or use kubectl wait instead of polling.

### Common errors in CI?

"error: error parsing jsonpath ... unrecognized character" usually means the shell ate part of the expression; wrap it in single quotes. "error: ... is not found" with -o jsonpath is rare since missing fields yield empty output, but a wrong root (querying .spec of a list without .items) returns nothing.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt