Production Readiness

You now know the pieces. Before real users arrive, there is one more step, a careful check, that your application is ready to be run for real. In this lesson, we gather everything into a checklist, in four areas. Reliability, security, observability, and cost.

• Four areas to check
• Reliability and security
• Observability and cost

Reliability checklist

First, reliability. Run at least two or three replicas of every important service. Spread them across nodes, and zones. Set resource requests and limits. Add readiness and liveness probes. Use a pod disruption budget, so that maintenance never removes too many pods at once. And define a rolling update strategy, that keeps enough pods available. These few settings turn a demo into a service.

Security checklist

Second, security. Run containers as non root, with a read only file system. Give each application its own service account, with least privilege. Apply network policies, so that only needed traffic flows. Keep secrets in a proper secret store, and encrypt et see dee. Scan and sign images, and pull them only from trusted registries. Enforce all of this with admission policies, so it cannot be forgotten.

Observability and cost checklist

Third, observability. Collect metrics, logs, and events, with alerts for the golden signals, and a runbook for each alert. Fourth, cost. Right size your requests, using real usage. Use autoscaling, so you pay for what you need. Put quotas on namespaces. Label everything by team, so you can see who spends what. And review the bill regularly, because clusters tend to grow quietly.

A disruption budget

One setting deserves its own example, the pod disruption budget. It says, for pods with the label app equals web, at least two must stay available. When you drain a node for maintenance, Kubernetes will refuse to evict a pod, if that would break the promise. It waits, and evicts the pods one at a time, as replacements become ready. A tiny file, which protects every upgrade.

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web-pdb
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: web

Summary