Kubernetes Design & Code Review Checklist

• [ ] Multi-node cluster (avoid single point of failure)
• [ ] Separate environments (dev/staging/prod)
• [ ] Proper namespace strategy
• [ ] ResourceQuota configured
• [ ] LimitRange configured
• [ ] RBAC enabled
• [ ] Network Policies enabled
• [ ] Audit logging enabled
• [ ] High availability control plane

• [ ] One namespace per application/domain
• [ ] Environment isolation
• [ ] Consistent naming convention
• [ ] Quotas per namespace

Example:

production-payment
production-order
staging-payment
staging-order

Checklist:

• [ ] Correct workload type selected
• [ ] One responsibility per workload
• [ ] Horizontal scaling supported

• [ ] replicas > 1 in production
• [ ] RollingUpdate strategy used
• [ ] revisionHistoryLimit configured
• [ ] Proper labels
• [ ] Proper selectors

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxUnavailable: 1
    maxSurge: 1

Required labels:

labels:
  app: payment-api
  version: v1.2.0
  env: prod
  team: backend

Checklist:

• [ ] app
• [ ] version
• [ ] env
• [ ] team

Checklist:

• [ ] No latest tag
• [ ] Immutable version tag
• [ ] Trusted registry
• [ ] Vulnerability scan performed

Bad:

image: api:latest

Good:

image: api:v1.3.5

Checklist:

• [ ] runAsNonRoot
• [ ] readOnlyRootFilesystem
• [ ] allowPrivilegeEscalation=false
• [ ] capabilities dropped

securityContext:
  runAsNonRoot: true
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false

Checklist:

• [ ] CPU request
• [ ] CPU limit
• [ ] Memory request
• [ ] Memory limit

resources:
  requests:
    cpu: "250m"
    memory: "256Mi"
  limits:
    cpu: "500m"
    memory: "512Mi"

Checklist:

• [ ] HPA configured
• [ ] minReplicas defined
• [ ] maxReplicas defined
• [ ] CPU target configured
• [ ] Memory target configured

Example:

minReplicas: 2
maxReplicas: 10

Checklist:

• [ ] Configured
• [ ] Fast endpoint

livenessProbe:
  httpGet:
    path: /health
    port: 8080

Checklist:

• [ ] Configured
• [ ] Service traffic blocked until ready

readinessProbe:
  httpGet:
    path: /ready
    port: 8080

Checklist:

• [ ] Configured for slow startup applications

Checklist:

• [ ] ClusterIP for internal services
• [ ] LoadBalancer only when required
• [ ] NodePort avoided

Checklist:

• [ ] TLS enabled
• [ ] HTTPS redirect enabled
• [ ] Rate limiting configured
• [ ] WAF considered

Checklist:

• [ ] Default deny policy
• [ ] Explicit allow rules
• [ ] Namespace isolation

kind: NetworkPolicy

Checklist:

• [ ] Dynamic provisioning
• [ ] StorageClass used
• [ ] Backup strategy exists
• [ ] Recovery tested

Checklist:

• [ ] StatefulSet used
• [ ] PVC attached
• [ ] Data persistence verified

Checklist:

• [ ] Only non-sensitive data
• [ ] Version controlled
• [ ] Environment specific

Checklist:

• [ ] No secrets in Git
• [ ] No secrets in ConfigMap
• [ ] Rotation process defined
• [ ] External secret manager preferred

Checklist:

• [ ] Least privilege principle
• [ ] Dedicated ServiceAccounts
• [ ] No cluster-admin usage

Bad:

cluster-admin

Good:

Role
RoleBinding

Checklist:

• [ ] Non-root containers
• [ ] No privileged mode
• [ ] Seccomp profile
• [ ] AppArmor profile

Checklist:

• [ ] Image signing
• [ ] SBOM generated
• [ ] Vulnerability scanning

Checklist:

• [ ] Multiple replicas
• [ ] Pod anti-affinity
• [ ] Multi-zone deployment

podAntiAffinity:

Checklist:

• [ ] PDB configured

minAvailable: 1

Checklist:

• [ ] SIGTERM handled
• [ ] preStop hook configured
• [ ] terminationGracePeriodSeconds set

Checklist:

• [ ] Centralized logging
• [ ] Structured JSON logs
• [ ] Correlation ID support

Checklist:

• [ ] CPU metrics
• [ ] Memory metrics
• [ ] Request metrics
• [ ] Error metrics
• [ ] Business metrics

Checklist:

• [ ] Distributed tracing enabled
• [ ] Request correlation supported

Checklist:

• [ ] Automated build
• [ ] Automated test
• [ ] Automated deployment
• [ ] Rollback support

Checklist:

• [ ] Git as source of truth
• [ ] Pull-based deployment
• [ ] Drift detection enabled

Checklist:

• [ ] Rolling deployment
• [ ] Canary deployment
• [ ] Blue-Green deployment

Checklist:

• [ ] Requests properly sized
• [ ] HPA configured
• [ ] Cluster Autoscaler configured
• [ ] Spot instances evaluated
• [ ] Unused resources removed

Checklist:

• [ ] Database backup
• [ ] Persistent volume backup
• [ ] Secret backup
• [ ] Configuration backup

Checklist:

• [ ] Restore procedure documented
• [ ] Recovery tested regularly
• [ ] Recovery Time Objective (RTO) defined
• [ ] Recovery Point Objective (RPO) defined

1. [ ] Will it survive a Pod crash?
2. [ ] Will it survive a Node crash?
3. [ ] Will it survive a Zone failure?
4. [ ] Can it scale automatically?
5. [ ] Can it be deployed with zero downtime?
6. [ ] Can it be rolled back safely?
7. [ ] Is it secure by default?
8. [ ] Is it observable?
9. [ ] Can another engineer maintain it?
10. [ ] Can it run at 3 AM without waking me up?

If all answers are YES, the Kubernetes platform/workload is considered Production Ready.