Kubernetes and the Answer is… 42!
summary
A field‑tested checklist of 42 Kubernetes readiness checks that names the exact fixes and tools used: SBOM and image scanning with Trivy, multi‑stage builds and avoiding latest tags, non‑root users, dropped capabilities and read‑only root, liveness/readiness and startup probes, CPU/memory and ephemeral storage limits, init containers, serviceAccount token auto‑mounts, named ports, network policies, PDBs, HPA/KEDA scaling, revisionHistoryLimit and sane rolling update settings, optional container signing, and continuous policy enforcement with Keyverno.
AI-written summary · about
chapters (21)
- 0:00Kubernetes checklist
- 0:41Stateful vs stateless apps
- 1:22Security and SBOM
- 2:04Non-root users minimal images
- 3:11Multi-stage deployments scanning
- 4:19Latest tag risks root user
- 5:25Read-only filesystems volume mounts
- 6:09Resource limits memory
- 7:13Ephemeral storage init containers
- 7:55Service account tokens API
- 8:39Priority class security context
- 9:21Topology spread anti-affinity
- 10:03Tolerations spot nodes
- 10:46Labels deadlines
- 11:29ConfigMaps secrets annotations
- 12:32Revision history rolling updates
- 13:17Container signing observability
- 14:23Horizontal pod autoscaling PDBs
- 15:26Named ports network policies
- 16:08Certificates DNS updates
- 16:54Production readiness checklist
related talks
26mMulti-layer hardening in Kubernetes
36mKubernetes Confessions: Real Mistakes We’ve All Made (and What They Teach Us)
29mHow to make Kubernetes rhyme with prod readiness
42mMastering Kubernetes: Challenges, Strategies, and Best Practices
44mTop 5 container and Kubernetes best practices
45mTroubleshooting containerized applications
36mHow to make Kubernetes rhyme with prod readiness - Tiffany Jernigan and Matthias Haeussler
33mWhat We Learned from Reading 100+ Kubernetes Post-Mortems