Kubernetes in Production: A CTO Checklist Before Launching a Cluster
Kubernetes promises "autoscaling out of the box." In practice, a cluster without discipline is expensive chaos: CrashLoop, OOMKill, secrets in plain text, and Friday-night deploys via `kubectl apply -f`.
Key takeaway. Before production: separate namespaces, limits on every Deployment, Ingress+TLS, GitOps, restart monitoring, and etcd backups. One cluster for everything and Postgres in a Pod without an operator is a typical path to a night incident.
Minimum Production Checklist
- RBAC and namespaces — separate prod/stage, least privilege for CI.
- Requests/limits — on every Deployment; without limits, neighbors kill each other.
- Ingress + TLS — cert-manager, HSTS, rate limiting at the edge.
- GitOps — Argo CD / Flux, rollbacks with one click.
- Monitoring — Prometheus + alerts on pod restarts, saturation, error rate.
- etcd and PV backups — a DR plan on paper, not in the DevOps engineer's head.
Common Mistakes
- One cluster for everything — prod and experiments in the same namespace.
- Stateful workloads without an operator — PostgreSQL "in a Pod" without Patroni/Crunchy.
- No staging environment identical to prod topology.
We build and operate clusters in high-load and IoT projects. Services: turnkey Kubernetes, DevOps and CI/CD. Audit of an existing cluster — from ₽35,000, see pricing.
Related services
Kubernetes in production FAQ
RBAC and separate namespaces, requests/limits on every Deployment, Ingress+TLS, GitOps with rollback, restart/error-rate monitoring, and etcd/PV backups with a written DR plan.
Not the same namespace, and preferably not the same cluster: noisy neighbors, CI privileges, and a failed experiment can take prod down. Staging should mirror prod topology.
Without limits one Pod starves neighbors (OOMKill, throttling). Requests tell the scheduler where load will land; guessing does not.
Secrets, RBAC, limits, and etcd backups — those fail on night one. An audit of an existing cluster starts at RUB 35,000.
Want to apply this in practice?
Tell us about your system — we’ll propose a work plan and the metrics worth fixing in an SLA/SLO.
Related articles
SMB infra monitoring without DevOps: 5 signals that matter
Infrastructure monitoring without DevOps for SMBs: five signals — money-path uptime, disk, backups, slowdowns, and expiry dates. Telegram alerts, no Grafana.
Read ArticleCode from AI Agents: Checklist Before Production
AI agents write code: a pre-production control checklist for CTOs — leak, license, and silent-bug risks, review gates, and incident cost ranges in ₽.
Read ArticleProduction monitoring: 4 metrics anyone on the team can understand
Production monitoring in plain language: site speed, errors, traffic, and server headroom. What to check before ads and how not to learn about outages from angry customers. DevOps, Grafana, Prometheus.
Read ArticleDevOps and CI/CD in Production: What to Set Up First
DevOps services for business: build pipeline, staging, zero-downtime deploy, monitoring and rollback — priorities for the first 4–6 weeks.
Read Article