Specify a pinned version on each container image
Why? Otherwise, latest version is fetched, which makes it unpredictable and intransparent as to which versions are deployed in the cluster
Why? K8s knows the Pod state, not the application state. Sometimes pod is running, but container inside crashed. With liveness probe we can let K8s know when it needs to restart the container
Why? Let's K8s know if application is ready to receive traffic
Why? To make sure 1 buggy container doesn't eat up all resources, breaking the cluster
Don't use NodePort in production
Why? NodePort exposes Worker Nodes directly, multiple points of entry to secure. Better alternative: Loadbalancer or Ingresss
Always deploy more than 1 replica for for each application
Why? To make sure your application is always available, no downtime for users!
Always have more than 1 Worker Node
Why? Avoid single point of failure with just 1 Node
Label all your K8s resources
Why? Have an identifier for your components to group pods and reference in Service e.g.
Use namespaces to group your resources
Why? To organize resources and to define access rights based on namespaces e.g.
Security Best Practices
Ensure Images are free of vulnerabilities
Why? Third-party libraries or base images can have known vulnerabilities. You can do manual vulnerability scans or better automated scans in CI/CD pipeline.
No root access for containers
Why? With root access they have access to host-level resources. Much more damage possible, if container gets hacked!
Keep K8s version up to date
Why & How? Latest versions include patches to previous security issues etc. Upgrade with zero downtime by having multiple nodes and pod replicas on different nodes.
