Skip to main content
OpsRoadmaps

Checklists / kubernetes-production

Kubernetes Production Readiness Checklist

Before a workload takes production traffic: resources, probes, limits, and failure behavior all decided.

9 steps · 9 required · last reviewed (next review 2027-03-19) · updated 2026-09-21

Related focus areas:CloudOpsPlatform EngineeringSRE

Roadmaps covering the same ground:AWS Security ImprovementCloud Cost OptimizationIncident Management MaturityObservability MaturityPlatform Engineering AdoptionProduction-Ready KubernetesResilience and DR ImprovementSRE Adoption

Sign in to run this checklist

This is the "will it survive contact with production" review for any workload moving onto Kubernetes. Kubernetes fails workloads in specific, well-understood ways — OOMKills, crash loops, evictions, terminated-but-not-drained — and every item here closes one of those.

If a box cannot be checked, that is not a blocker per se — it is a decision you are making implicitly. Write down which ones you are consciously deferring.

  1. Requests and limits are set for CPU and memory

    required

    Without requests the scheduler places pods blindly; without limits one leaky container takes the node down with it.

  2. Liveness and readiness probes exist and test different things

    required

    Readiness pulls a pod from rotation when it cannot serve; liveness restarts it when it cannot recover. Mixing them up causes outage-inducing restart loops.

  3. PodDisruptionBudgets protect the service during node drains and upgrades

    required

    A voluntary disruption (upgrade, drain) must not drop availability below your floor — without a PDB, the cluster will happily kill all replicas at once.

  4. More than one replica runs, across different nodes

    required

    One replica on one node means every node maintenance is an outage.

  5. Horizontal Pod Autoscaling is configured (or deliberately not)

    required

    Traffic spikes are when users care most; either scale automatically or document why manual scaling is fast enough.

  6. Resource quotas and namespace limits exist for shared clusters

    required

    Without quotas, one team's test load-starves another team's production within the same namespace economics.

  7. Container images are pinned by digest, not :latest

    required

    A floating tag means today's deploy and yesterday's rollback may be different binaries you never reviewed.

  8. Secrets come from a secret manager, not base64 in git

    required

    Base64 is encoding, not protection — and git history is forever.

  9. Stateful workloads have a story for storage, backup, and restore

    required

    Kubernetes will reschedule your pod to another node; whether your data follows is a decision you make now, not during the incident.

Run it against your real gaps

A checklist is most useful when you know which controls you are actually missing. A free OpsRoadmaps assessment scores your controls with explainable findings and builds a roadmap from the results.

Assess my stack

Checklists document self-reported practice. Items were last reviewed 2026-09-19 — adapt them to your own environment.