As neededkubernetes-node-maintenance

Node Maintenance Checklist

12 items ·11 critical ·1 warn ·0 info

How to use this checklist

For taking a single node out of service and putting it back. The drain is the dangerous half; the uncordon is the half people forget.

Mark an item N/A when it genuinely does not apply, and write down why. An unexplained N/A is the most common way a checklist stops working.

Sign-off

Every critical item must pass. A failing critical item blocks the deployment or the maintenance window; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.

Critical11 items

The remaining nodes can hold this node's Pods. Draining into a cluster with no headroom converts one maintenance into an outage.
```
kubectl describe nodes | grep -A5 "Allocated resources"
```
PodDisruptionBudgets for workloads on this node permit the eviction. Check before draining, not when the drain hangs.
```
kubectl get pdb -A
```
Stateful workloads on this node are identified, and it is known whether their storage follows them to another node.
```
kubectl get pods --field-selector spec.nodeName=<node> -o wide
```
Pods using hostPath or local PersistentVolumes are identified — they cannot move, and --delete-emptydir-data will destroy their scratch data.
The node is cordoned before the drain so that nothing new is scheduled onto it.
```
kubectl cordon <node>
```
The drain is run with an explicit timeout and its output is read, rather than being left to run unattended.
```
kubectl drain <node> --ignore-daemonsets --delete-emptydir-data --timeout=600s
```
The node holds only DaemonSet Pods after the drain, and evicted Pods are Running elsewhere rather than Pending.
```
kubectl get pods --field-selector spec.nodeName=<node> -o wide
```
The maintenance itself is performed and its outcome recorded — the reason the node was drained is actually resolved.
The node reports Ready and its kubelet, container runtime, and CNI Pod are healthy before it is uncordoned.
```
kubectl get node <node> -o wide
```
The node is uncordoned. A cluster slowly losing capacity to forgotten cordons is a common and avoidable failure.
```
kubectl uncordon <node>
```

No node anywhere in the cluster is left unschedulable at the end of the window.

kubectl get nodes -o json | jq -r '.items[] | select(.spec.unschedulable==true) | .metadata.name'

Warning1 item

Workload distribution is checked after the node returns — Kubernetes does not rebalance existing Pods back on its own.
```
kubectl get pods -A -o wide | awk '{print $8}' | sort | uniq -c
```