Kubernetes Deployment Checklist

This file is the pack. It is markdown, not a live apply.

# Kubernetes Deployment Checklist

50 checks before you call a deployment production-ready. Tick them. The ones you skip are the ones you will explain later.

## How to use

- Walk the list against one service, not the whole cluster.
- Write the exception next to the item you are leaving undone.
- Do not apply a manifest you have not read.

## Workload

1. CPU and memory requests are set on every container.
2. Limits exist, and they are not an order of magnitude above the requests without a measured reason.
3. Production pods are owned by a Deployment, StatefulSet, or Job. A bare Pod has no undo.
4. The readiness probe fails when the process cannot serve, not merely when the process is alive.
5. The liveness probe is not the same slow handler as readiness. A slow request should not kill the process.
6. A slow boot uses a startupProbe so liveness does not restart a process that is still starting.
7. terminationGracePeriodSeconds is long enough for the process to finish in-flight work.
8. If the load balancer is slow to stop sending traffic, a preStop sleep or drain is written down.
9. The image tag is pinned. latest is not a version.
10. imagePullPolicy matches the tag. A floating tag with IfNotPresent will serve a stale image.
## Scheduling

11. Anything a user depends on runs more than one replica.
12. A PodDisruptionBudget stops a node drain from taking the last ready pod.
13. Spread or anti-affinity is set if one node dying should not take the service with it.
14. Required node affinity is something you can explain, not a leftover from a demo.
15. A PriorityClass is used only if you have decided who gets preempted.
16. The workload is not in the default namespace.
## Service and network

17. The Service selector matches the pod labels. Check endpoints before you check the mesh.
18. The Service is ClusterIP unless a node port or a cloud load balancer is a deliberate bill.
19. An Ingress or Gateway object has a controller installed. The object alone does nothing.
20. TLS terminates at the edge, and the certificate has a renewal path.
21. The hostname on the route is the hostname in DNS.
22. The namespace has a default-deny NetworkPolicy, then explicit allows.
23. DNS is allowed. A policy that blocks kube-dns looks like an application bug.
24. hostNetwork and hostPort are absent, or the exception is written next to the manifest.
## Identity

25. The pod uses a dedicated ServiceAccount, not the namespace default.
26. automountServiceAccountToken is false when the process does not call the Kubernetes API.
27. RBAC is namespace-scoped where a cluster role is not required.
28. The app is not bound to cluster-admin.
29. Secrets are not also baked into the image or copied into a ConfigMap.
30. etcd encryption, or an external secrets store, is a decision someone can name.
## Config

31. Each setting is mounted the way the app reads it: a file or an env var, not both for the same key.
32. A ConfigMap change has a rollout plan. Editing the object does not restart pods by itself.
33. Secrets do not appear in annotations, arguments, or logs.
34. Resource names are stable. A rename is not the rollback plan.
35. Environment variables injected by the platform are listed somewhere a new person can find them.
## Storage

36. The PVC access mode matches how many pods will mount it.
37. A database is not on emptyDir.
38. The StorageClass is the one you meant, not the cluster default by surprise.
39. A backup exists, and someone has restored it once.
40. securityContext fsGroup matches the UID the process runs as.
## Security context

41. runAsNonRoot is set.
42. readOnlyRootFilesystem is set where the app can tolerate it, with an emptyDir for anything that must write.
43. allowPrivilegeEscalation is false.
44. Capabilities are dropped, then the ones you need are added back.
45. privileged is not true.
## Rollout

46. Rolling update maxUnavailable does not take you below the PodDisruptionBudget.
47. You have rolled back once in a cluster that is not production.
48. The previous image is still pullable. A rollback to a deleted tag is a story, not a plan.
49. Migrations are compatible with the version you would roll back to, or the exception is written down.
50. The alert for this service links to a runbook.