kubernetes

Manifest Standards

Workloads

• Always set resource requests AND limits for CPU and memory
• Use PodDisruptionBudget for all production Deployments
• Set terminationGracePeriodSeconds appropriate to the workload
• Use topologySpreadConstraints for HA across zones
• Prefer Deployment unless ordering matters (StatefulSet) or every-node is needed (DaemonSet)
• Always set securityContext:

  securityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities:
      drop: ["ALL"]