Kubernetes Operational Review

Kubernetes Operational Review

Overview

Production readiness review for Kubernetes workloads. Checks that deployments are resilient, observable, and operable — covering health probes, disruption budgets, rollout strategy, observability, and graceful shutdown. A workload that passes security and cost review can still cause outages if it lacks proper probes or PDBs.

Only triggers when there is clear evidence of Kubernetes usage. When ambiguous, ask the user before proceeding.

When to Use

• When reviewing K8s workloads for production readiness
• When auditing health probe configuration (liveness, readiness, startup)
• When checking PodDisruptionBudgets and rollout strategy
• When evaluating observability setup (logging, metrics, tracing)
• When reviewing graceful shutdown and dependency management

When NOT to Use

• For Terraform operational review — use the sre agent in infra-code mode
• For security concerns — use kubernetes-security-audit
• For cost concerns — use kubernetes-cost-review
• When no K8s evidence is detected and user hasn't mentioned K8s

Workflow

1. Detect K8s presence: Confirm K8s manifests exist. If ambiguous, ask user.
2. Collect scope: Identify all workloads (Deployments, StatefulSets, DaemonSets, Jobs, CronJobs).
3. Probe audit: Check every workload for liveness, readiness, and startup probes. See ops-checklist.md for detailed checks.
4. Disruption audit: Verify PDBs exist for production workloads, check minAvailable/maxUnavailable values.
5. Rollout audit: Check rolling update strategy, maxSurge, maxUnavailable configuration.
6. Topology audit: Review topology spread constraints, pod anti-affinity for HA.
7. Observability audit: Check for monitoring annotations, logging sidecars, tracing config.
8. Shutdown audit: Verify preStop hooks, terminationGracePeriodSeconds, SIGTERM handling.
9. Dependency audit: Check init containers, dependency ordering, ConfigMap/Secret reload strategy.
10. EKS-specific checks (if EKS detected): ALB ingress annotations, CloudWatch Container Insights, EBS CSI driver, ExternalDNS.
11. Deprecation flag: If deprecated APIs are found, flag them and recommend deprecation-check-and-upgrade.
12. Produce report: Use the template from templates.md.

See ops-checklist.md for detailed check tables.

Critical Checks

• Deployments/StatefulSets without readiness probes (traffic sent to unready pods)
• Identical liveness and readiness probes (liveness should be simpler, checking process health, not dependencies)
• No PodDisruptionBudget for multi-replica workloads
• terminationGracePeriodSeconds shorter than actual shutdown time
• Missing topology spread or anti-affinity for HA workloads
• No preStop hook when the application needs graceful drain time

Common Mistakes

Related Skills

If you find issues outside the operational domain during the review, recommend the relevant K8s skill:

• RBAC misconfigurations, missing securityContext, secrets in env vars → recommend kubernetes-security-audit
• Over-provisioned resources, missing HPA, LoadBalancer cost → recommend kubernetes-cost-review
• Helm chart structural issues → recommend kubernetes-helm-review

Supporting Files

• ops-checklist.md — Detailed check tables for probes, PDBs, rollout, topology, observability, shutdown, and dependencies
• templates.md — Report output template with readiness scoring

Source: infraspecdev/tesseract — distributed by TomeVault.