Kubernetes Production Checklist

What this checklist is

A pre-launch verification list for a workload going to production on Kubernetes, and for the cluster it lands on. Each check has a severity and a command or test that proves it, covering cluster version and access, resources, probes, availability, Pod security, RBAC and network policy, secrets and images, autoscaling, and backups of cluster state.

It has 9 chapters and 46 checks, each with how to verify it and how much it matters. For teams taking a workload to production on Kubernetes.

Chapter by chapter

1. Cluster version, upgrades and control plane access (8 checks)

Whether the cluster itself is on a supported release, can be upgraded safely, and keeps its control plane out of reach.

2. Requests, limits and capacity (5 checks)

Whether every container tells the scheduler what it needs, cannot take a node down with it, and has room to grow.

3. Health probes and graceful shutdown (4 checks)

Whether traffic only reaches Pods that can serve it, stuck Pods get restarted without cascading restarts, and shutdowns drop no requests.

4. Replicas, spread and disruptions (5 checks)

Whether the workload survives the loss of a Pod, a node or a zone, and routine maintenance such as node drains and upgrades.

5. Pod security (5 checks)

Whether a compromised container is boxed in: enforced Pod Security Standards, non-root, minimal privileges and no unneeded credentials.

6. RBAC and network policy (4 checks)

Whether people and workloads hold only the permissions they need, and Pods can only talk to what they are meant to.

7. Secrets and container images (6 checks)

Whether credentials are stored and delivered safely, and the images that run are known, scanned and pinned.

8. Autoscaling and day-two operations (4 checks)

Whether the workload scales with demand without fighting your deploys, and the team will see Kubernetes-level failures.

9. Backups of cluster state and data (5 checks)

Whether you could rebuild the workload, and the cluster under it, after losing the control plane, a namespace or a volume.

How it works on Sefism

The checklist is one page: each check has a severity (must, should or nice to have) and a concrete way to verify it, and members can tick checks off as they go. The opening chapters are open to everyone. Adding it to your account uses credits, opens every chapter and keeps your progress.

Every claim is checked against the sources listed on the page (8 cited).