Before deploymentkubernetes-networking-readiness

Kubernetes Networking Readiness Checklist

14 items ·10 critical ·3 warn ·1 info

How to use this checklist

Network defects are the ones that present as everything else. Establish these facts while the cluster is healthy so you are not deriving them during an incident.

Mark an item N/A when it genuinely does not apply, and write down why. An unexplained N/A is the most common way a checklist stops working.

Sign-off

Every critical item must pass. A failing critical item blocks the deployment or the maintenance window; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.

Critical10 items

The CNI DaemonSet is Ready on every node, including nodes added after the cluster was built.
```
kubectl -n kube-system get ds
```
Pod CIDR, Service CIDR, and node network do not overlap with each other or with anything the cluster must reach.
```
kubectl cluster-info dump | grep -m2 -E "cluster-cidr|service-cluster-ip-range"
```
The Pod CIDR has room for the maximum planned node count multiplied by the per-node Pod limit. Resizing it later means rebuilding the cluster.
MTU is consistent across the underlay, the CNI overlay, and any VPN or tunnel in the path. An MTU mismatch presents as slow, not broken.
```
kubectl run mtu-test --rm -it --image=busybox --restart=Never -- ping -M do -s 1400 <target>
```

In-cluster DNS resolves Service names, cross-namespace names, and external names from a test Pod.

kubectl run dns-test --rm -it --image=busybox:1.36 --restart=Never -- nslookup kubernetes.default

CoreDNS runs at least two replicas, spread across nodes, with resource requests set and no CPU throttling under normal load.
```
kubectl -n kube-system get deploy coredns -o wide
```
Namespaces carrying sensitive workloads have a default-deny NetworkPolicy with explicit allows, and the CNI actually enforces NetworkPolicy.
```
kubectl get networkpolicy -A
```
At least one NetworkPolicy has been tested by attempting the connection it is supposed to block.
The ingress or Gateway controller runs more than one replica and its external address is stable across a controller restart.
```
kubectl get svc -A -o wide | grep LoadBalancer
```
Ingress TLS certificates have more than 30 days remaining, and renewal is automated and monitored rather than diarised.

Warning3 items

CoreDNS caching and the ndots setting have been reviewed against the workload. The default ndots:5 turns one external lookup into five.
```
kubectl -n kube-system get configmap coredns -o yaml
```
The kube-proxy mode (iptables, ipvs, nftables) or its eBPF replacement is known and recorded — troubleshooting differs completely between them.
```
kubectl -n kube-system logs ds/kube-proxy | grep -i "using.*proxier"
```
Egress paths, including any SNAT or egress gateway, are documented, and external dependencies are reachable from a Pod, not only from the node.

Info1 item

conntrack table size is sized for peak connection count. Exhaustion presents as random connection failures under load.
```
sysctl net.netfilter.nf_conntrack_max net.netfilter.nf_conntrack_count
```