Production & Security Best Practices

Specify a pinned version on each container image

Why? Otherwise, latest version is fetched, which makes it unpredictable and intransparent as to which versions are deployed in the cluster

Configure a liveness probe on each container

Why? K8s knows the Pod state, not the application state. Sometimes pod is running, but container inside crashed. With liveness probe we can let K8s know when it needs to restart the container

Configure a readiness probe on each container

Why? Let's K8s know if application is ready to receive traffic

Configure resource limits & requests for each container

Why? To make sure 1 buggy container doesn't eat up all resources, breaking the cluster

Don't use NodePort in production

Why? NodePort exposes Worker Nodes directly, multiple points of entry to secure. Better alternative: Loadbalancer or Ingresss

Always deploy more than 1 replica for for each application

Why? To make sure your application is always available, no downtime for users!

Always have more than 1 Worker Node

Why? Avoid single point of failure with just 1 Node

Label all your K8s resources

Why? Have an identifier for your components to group pods and reference in Service e.g.

Use namespaces to group your resources

Why? To organize resources and to define access rights based on namespaces e.g.

Security Best Practices

Ensure Images are free of vulnerabilities

Why? Third-party libraries or base images can have known vulnerabilities. You can do manual vulnerability scans or better automated scans in CI/CD pipeline.

No root access for containers

Why? With root access they have access to host-level resources. Much more damage possible, if container gets hacked!

Keep K8s version up to date

Why & How? Latest versions include patches to previous security issues etc. Upgrade with zero downtime by having multiple nodes and pod replicas on different nodes.