Before deploymentkubernetes-worker-readiness

Worker Node Readiness Checklist

14 items ·8 critical ·5 warn ·1 info

How to use this checklist

A worker node is production-ready when it fails predictably. Most of this list is about what the node does under pressure, not what it does when everything is fine.

Mark an item N/A when it genuinely does not apply, and write down why. An unexplained N/A is the most common way a checklist stops working.

Sign-off

Every critical item must pass. A failing critical item blocks the deployment or the maintenance window; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.

Critical8 items

Every node reports Ready with no active MemoryPressure, DiskPressure, or PIDPressure condition.
```
kubectl get nodes -o wide
```
kubeReserved and systemReserved are configured, so that a runaway Pod cannot starve the kubelet and the container runtime off the node.
```
kubectl get node <node> -o jsonpath'{.status.allocatable}'
```
Allocatable is meaningfully smaller than capacity. If they are equal, nothing is reserved and the node has no headroom.
```
kubectl describe node <node> | grep -A6 Allocatable
```
Hard and soft eviction thresholds are set for memory.available, nodefs.available, and imagefs.available.
The container runtime is CRI-conformant (containerd or CRI-O) and its version is recorded. Nothing on the node depends on dockershim.
```
crictl version
```
Time is synchronised on every node. Certificate validation and log correlation both fail silently when it is not.
```
timedatectl show -p NTPSynchronized
```
Required sysctls are set persistently, not just for the running boot — net.bridge.bridge-nf-call-iptables and net.ipv4.ip_forward in particular.
```
sysctl net.ipv4.ip_forward net.bridge.bridge-nf-call-iptables
```
The pool can lose its largest node and still schedule everything that was running on it.
```
kubectl describe nodes | grep -A5 "Allocated resources"
```

Warning5 items

Swap is configured deliberately — either off, or on with the kubelet swap behaviour explicitly chosen. It is not left to the distribution default.
```
swapon --show
```
The image filesystem has headroom for the largest expected image pull plus the garbage-collection threshold.
```
df -h /var/lib/containerd
```
Image garbage collection thresholds are set, and image pull credentials do not depend on a single expiring token.
Kernel version and required modules (overlay, br_netfilter) are consistent across the node pool. A single odd node is a future 3 a.m. page.
```
lsmod | grep -E "overlay|br_netfilter"
```
Nodes carry accurate topology labels (zone, region, instance type) so that spread constraints and storage topology work.
```
kubectl get nodes --show-labels
```

Info1 item

node-problem-detector or an equivalent reports kernel and runtime faults that do not surface as a NotReady condition.