What Does “Production Ready” Really Mean for a Kubernetes Cluster?
summary
Defines a practical checklist: secure TLS everywhere with rotatable certs and an external key signer, disable kubelet read-only ports, enforce RBAC and network policies, and run Prometheus + kube-state-metrics for SLO-aware monitoring. Shows how to make a cluster upgradeable without control-plane downtime by moving cluster lifecycle into declarative controllers using kubeadm HA patterns and the emerging Cluster API, explains CSR-based kubelet identity issuance, and warns that multi-master alone is not equivalent to true HA.
AI-written summary · about
chapters (18)
- 0:00Intro
- 2:58Production Ready
- 4:26Trust of Lifecycle
- 5:39Security
- 6:37Cluster Components
- 7:29Cluster Upgrades
- 9:46Conformance
- 11:37Architecture
- 14:32High Availability
- 15:27Securing Kubernetes
- 17:00API Authentication and Authorization
- 18:27Access Ports
- 21:32Network Policing
- 24:50Kubernetes Aspect Layers
- 25:38How to Achieve Production Ready
- 27:42Certificates
- 30:00Declarative Control
- 33:03Recap
related talks
29mHow to make Kubernetes rhyme with prod readiness
32mHow to make kubernetes rhyme with prod readiness
22mAnatomy of a production grade Kubernetes cluster
36mHow to make Kubernetes rhyme with prod readiness - Tiffany Jernigan and Matthias Haeussler
26mNoobernetes 102: Get Ready for Production
24mNoobernetes 102: Get Ready for Production
29m11 5 years of kubernetes and looking to the future
38mBuilding for Trust: How to Secure Your Kubernetes Cluster