Production Readiness Checklist

Reliability Prerequisites

Before traffic, confirm the workload layer can survive routine disruption:

• Multiple replicas across nodes/zones with pod anti-affinity or topology spread — a single replica is a single point of failure
• PodDisruptionBudgets so kubectl drain cannot take out an entire service: kubectl get pdb -A
• Requests/limits on every container (no BestEffort strays): check with a policy or kubectl get pods -A -o json review
• Probes configured — readiness for traffic gating, liveness only for hangs
• Autoscaling headroom — HPA bounds set, node autoscaler healthy, capacity alerts firing before saturation

Workloads without these fail the first node upgrade or rolling restart you attempt.

Security Prerequisites

• Least-privilege RBAC — review bindings, and probe real identities: kubectl auth can-i list secrets --as=system:serviceaccount:prod:api -n prod
• Pod Security Admission enforced per namespace (baseline minimum, restricted where possible)
• No privileged pods / hostPath by policy — enforce with admission (PSA, Kyverno, or OPA)
• Image hygiene — digest-pinned images, scanning in CI, admission requiring trusted registries
• Secrets hygiene — encryption at rest via a KMS provider, no secrets in Git, rotation procedure documented
• NetworkPolicy — default-deny in sensitive namespaces with explicit allows

Every item here maps to an object you can list; anything unverifiable by command is a claim, not a control.

Operability and Verification

• Observability: metrics scraped (ServiceMonitors present), logs shipped centrally, alerts on saturation and error rate with tested routes
• Backups: Velero schedules running and restored at least quarterly with recorded RTO
• Certificate/component expiry: watch kubelet/client certs and Ingress certs — kubeadm certs check-expiration on kubeadm clusters
• Capacity: node headroom alerts, PDB-safe drain procedure documented and rehearsed
• Change safety: GitOps or CI with diffs, rollback path known (helm rollback/rollout undo), runbooks linked to alerts

Interview framing: present the checklist as layers — workload → namespace → cluster → supply chain — and for each item name the command that proves it. Prioritization rule: anything that turns a small failure into a cluster-wide outage outranks convenience features.