All resources
Kubernetes · Practical outline
Kubernetes Production Readiness Checklist
By Shahrooz Mehmood · · 8 min read
Kubernetes makes it easy to run a container and surprisingly easy to run it badly. Use this checklist to review a workload — or a whole cluster — before it carries production traffic.
Workload configuration
The settings every production deployment should define explicitly.
- Readiness probe reflects whether the pod can actually serve requests.
- Liveness probe only restarts genuinely stuck processes, with conservative thresholds.
- CPU and memory requests based on observed usage; memory limits set deliberately.
- At least two replicas for user-facing services, spread across zones.
- PodDisruptionBudget to protect availability during node maintenance.
- Graceful shutdown handling (preStop hook, terminationGracePeriodSeconds).
Scaling
Plan for both more traffic and node failures.
- Horizontal Pod Autoscaler on services with variable load.
- Cluster Autoscaler or Karpenter configured with sensible node limits.
- Load tests that confirm scaling behavior before launch.
Security
Defaults in Kubernetes are permissive; tighten them.
- Containers run as non-root with a read-only root filesystem where possible.
- RBAC follows least privilege; no workloads use cluster-admin.
- Default-deny NetworkPolicies with explicit allow rules.
- Secrets synced from a managed store, not committed to Git.
- Images scanned in CI and pulled from a trusted registry by digest.
- Pod Security Standards enforced at the namespace level.
Observability
You should know something is wrong before your customers do.
- Metrics for latency, traffic, errors and saturation per service.
- Structured logs shipped to a central store with consistent labels.
- Alerts based on user-facing symptoms, each with an owner and a runbook.
- Dashboards annotated with deployments.
Operations
The procedures that matter at 3 a.m.
- Documented, tested rollback procedure.
- Backup and restore tested for stateful components.
- Cluster upgrade plan and version support policy.
- Runbooks for the most likely failure modes.