Before deploymentkubernetes-control-plane-readiness

Control Plane Readiness Checklist

14 items ·10 critical ·4 warn ·0 info

How to use this checklist

The control plane is the only component whose failure you cannot route around with more replicas of the workload. Work this list on a cluster you believe is already healthy — the point is to find the single points of failure that a green kubectl get nodes hides.

Mark an item N/A when it genuinely does not apply, and write down why. An unexplained N/A is the most common way a checklist stops working.

Sign-off

Every critical item must pass. A failing critical item blocks the deployment or the maintenance window; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.

Critical10 items

Three or five control-plane nodes, never two or four. An even member count raises the quorum requirement without raising the failure tolerance.
```
kubectl get nodes -l node-role.kubernetes.io/control-plane
```

Control-plane nodes sit in distinct failure domains (hosts, racks, or availability zones), and that separation is verified rather than assumed.

kubectl get nodes -l node-role.kubernetes.io/control-plane -o custom-columns=NAME:.metadata.name,ZONE:.metadata.labels.topology\.kubernetes\.io/zone

The API server load balancer has no single point of failure of its own, and its health check tests /readyz rather than a TCP connect.
```
curl -sk https://<apiserver-vip>:6443/readyz?verbose
```
etcd reports every member healthy and one leader. A cluster sitting on its quorum floor is an open incident, not a steady state.
```
etcdctl --write-out=table endpoint status --cluster
```
etcd data directory is on low-latency storage, and backend commit p99 is inside the 25 ms budget. etcd is latency-bound, not throughput-bound.
```
etcdctl check perf
```
No control-plane certificate expires within 90 days, and the renewal procedure has been performed at least once by the team that owns it.
```
kubeadm certs check-expiration
```
kubelet and control-plane versions are inside the supported version-skew window, and no node is more than three minor versions behind the API server.
```
kubectl get nodes -o custom-columns=NAME:.metadata.name,KUBELET:.status.nodeInfo.kubeletVersion
```
Secrets are encrypted at rest in etcd via an EncryptionConfiguration, not stored as plain base64.
```
kubectl get secrets -A -o name | head -1 | xargs -I{} kubectl get {} -o yaml
```
Anonymous authentication is disabled on the API server, or is restricted to the health endpoints only.
```
curl -sk https://<apiserver-vip>:6443/api/v1/namespaces
```
Alerts fire on API server error rate, API server latency, etcd leader changes, and certificate expiry — and each has been tested to fire.

Warning4 items

etcd database size is well under the configured quota, and a defragmentation procedure exists for when it is not.
```
etcdctl --write-out=table endpoint status --cluster
```
The cluster CA expiry date is recorded in the runbook. CA rotation is a different, much larger procedure than leaf renewal, and it needs lead time.
```
kubeadm certs check-expiration | grep -i "certificate authority"
```
Audit logging is enabled with a policy that records at least metadata for every request, and the log ships off the control-plane node.
```
kubectl get --raw /healthz && ls -l /var/log/kubernetes/audit.log
```
kube-scheduler and kube-controller-manager run with leader election enabled so that only one instance is active at a time.
```
kubectl -n kube-system get lease
```