Production Best Practices

Practical guidelines for running reliable, maintainable workloads in production.

Once the basics click, these habits separate a toy cluster from a production-ready one.

Reliability

  • Set resource requests and limits on every container.
  • Define liveness and readiness probes.
  • Run at least 2–3 replicas and spread them with anti-affinity.
  • Use a PodDisruptionBudget so upgrades don't take all replicas down at once.

Maintainability

  • Store all manifests in Git (GitOps); never click-configure production.
  • Pin image tags or digests — avoid latest.
  • Use namespaces and labels consistently.

Security & cost

  • Least-privilege RBAC and non-root containers.
  • Set ResourceQuotas and LimitRanges per namespace.
  • Autoscale with the HPA to match demand.

Example

Example · yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web-pdb
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: web

When to use it

  • A team adds resource requests and limits to every container as a production prerequisite, preventing noisy-neighbor resource starvation.
  • An operator enforces immutable image tags (never :latest) in CI so every deployment is reproducible and traceable to a specific build.
  • A platform team mandates liveness and readiness probes on all services so the cluster accurately routes traffic and self-heals without operator intervention.

More examples

Production-ready Deployment

Combines pinned image tag, resource limits, rolling update strategy, and readiness probe in one production-grade Deployment spec.

Example · yaml
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  template:
    spec:
      containers:
        - name: api
          image: myapi:v1.4.2   # pinned tag, never :latest
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 256Mi
          readinessProbe:
            httpGet:
              path: /health
              port: 8080

Security best practices checklist

Audits running pods for security anti-patterns: containers running as root and images using the mutable :latest tag.

Example · bash
# Scan running deployments for common issues
kubectl get pods -A -o json | \
  jq '.items[] | select(.spec.containers[].securityContext.runAsRoot == true) | .metadata.name'

# Check images using :latest tag
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}' \
  | grep ':latest'

Pod Disruption Budget

Guarantees that at least 2 web pods remain available during voluntary disruptions like node drains or Deployment updates.

Example · yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web-pdb
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: web

Related

k8s probesk8s helm

Discussion

  • Be the first to comment on this lesson.
Production Best Practices — Kubernetes | SoundsCode