Production & Security Best Practices
Last updated
Last updated
Why? Otherwise, latest version is fetched, which makes it unpredictable and intransparent as to which versions are deployed in the cluster
Why? K8s knows the Pod state, not the application state. Sometimes pod is running, but container inside crashed. With liveness probe we can let K8s know when it needs to restart the container
Why? Let's K8s know if application is ready to receive traffic
Why? To make sure 1 buggy container doesn't eat up all resources, breaking the cluster
Why? NodePort exposes Worker Nodes directly, multiple points of entry to secure. Better alternative: Loadbalancer or Ingresss
Why? To make sure your application is always available, no downtime for users!
Why? Avoid single point of failure with just 1 Node
Why? Have an identifier for your components to group pods and reference in Service e.g.
Why? To organize resources and to define access rights based on namespaces e.g.
Why? Third-party libraries or base images can have known vulnerabilities. You can do manual vulnerability scans or better automated scans in CI/CD pipeline.
Why? With root access they have access to host-level resources. Much more damage possible, if container gets hacked!
Why & How? Latest versions include patches to previous security issues etc. Upgrade with zero downtime by having multiple nodes and pod replicas on different nodes.
