Kubernetes Best Practices

We got our app running. But definitely thats not the end of road.

• Make sure to use the multi-stage build for your Docker images as much as possible

• Log and monitor everything you care about and remember: If its not monitored it doesn’t exist

• Leverage the Build cache and use the builder pattern to decrease your build time through faster build process

• Always use small base image keeping the number of layers minimised so that you build small images with less attack surface

• Always tag your images and don’t use the latest tag

• Make sure to always scan all your Docker Images and Containers for potential threats

• Never use any random Docker Image(s) and always use authorised images in your environment

• Categorise and accordingly split up your cluster through Namespace

• Use Network Policies to implement proper network segmentation and Role Based Access Control(RBAC) to create administrative boundaries between resources for proper segregation and control

• Never use Passwords, or API tokens in plain text or as environment variables, use secrets instead

• Use non-root user inside container with proper host to container, UID and GID mapping

• Make sure to always use Readiness & Liveness probes

• Use the ‘record’ option whenever performing updates for easier rollbacks

• For the purpose of bootstrapping don’t use sidecar, Use init container instead

• Ensure that the Readiness & Liveness probes are always properly utilised and monitored