kubernetes

Best Practices

• Set resource requests and limits for all containers (prevents noisy-neighbor issues)
• Use readiness and liveness probes for health checking (httpGet, tcpSocket, or exec)
• Run containers as non-root with read-only root filesystem when possible
• Use labels consistently (app.kubernetes.io/name, instance, version, component, managed-by)
• Define PodDisruptionBudgets for high-availability workloads
• Use ConfigMaps for configuration and Secrets for sensitive data (never hardcode)
• Set appropriate security contexts (runAsNonRoot, readOnlyRootFilesystem, capabilities drop ALL)
• Use specific image tags, not :latest in production
• Labels must be consistent between Deployment selector, Pod template, and Service selector
• Use namespaces to isolate workloads by environment or team
• Set terminationGracePeriodSeconds appropriate to the application's shutdown behavior
• Use topologySpreadConstraints or podAntiAffinity for high availability
• Use ServiceAccount with minimal RBAC permissions instead of default
• Define NetworkPolicy to restrict pod-to-pod communication

Documentation Sources