Checklist · Delivery

Kubernetes workload pre-deploy

Checks for a manifest or Helm chart before it reaches a shared cluster.

Owner: Platform and application engineersTime: 30 minISO 27001 A.8.9ISO 27001 A.8.22ISO 27001 A.8.24

0 of 18

Image and pod security

Image comes from the internal registry, is referenced by digest, and was scanned with no open critical findings.
Container runs as non-root with a read-only root filesystem.
allowPrivilegeEscalation is false; all Linux capabilities dropped, only needed ones added back.
No privileged containers, hostPath mounts, hostNetwork or hostPID.
Seccomp profile set to RuntimeDefault or stricter.

Resources and reliability

CPU and memory requests and limits set from measured usage.
Liveness, readiness and startup probes defined and tested.
At least two replicas for anything user-facing, with a PodDisruptionBudget and anti-affinity.
Rolling update strategy keeps capacity during release.

Identity, secrets and network

A dedicated ServiceAccount with only the RBAC it needs; token not mounted if the pod does not call the API.
Secrets come from the external secret store, not committed manifests; rotation is defined.
NetworkPolicy denies by default and allows only the required ingress and egress.
Namespace has pod security admission set to restricted, or an agreed exception.
Ingress terminates TLS with a managed certificate; no plain HTTP route to the service.

Observability and change

Logs go to stdout/stderr and are collected centrally; no secrets or personal data in them.
Metrics endpoint scraped; alerts exist for crash loops, saturation and error rate.
The manifest passes the policy checks (admission or CI) with no suppressed violations.
Deployed from Git by the pipeline; nobody applies it by hand with kubectl.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed. ISO references show where a list helps, not that it satisfies a control.

See these as tasks in Cisodium All checklists

Готові вийти
за межі застарілого GRC?

14 днів безкоштовно. Без кредитної картки. Хмара або on-premises.

Замовити демо Звʼязатися з продажами →