Every cluster audit I run turns up some version of the same problems. Here's the checklist I actually use, distilled down to the twelve things worth checking first.
Security
- RBAC is not
cluster-admineverywhere. Service accounts with blanket cluster-admin bindings are the single most common finding. - Network policies exist and default-deny. Without them, any pod can talk to any pod.
- Secrets aren't stored as plain env vars in manifests. Use an external secrets store or at minimum encrypt etcd at rest.
- Pod Security Standards are enforced, not just documented in a wiki nobody reads.
Resource Management
- Every workload has requests and limits. Unbounded pods are how one bad deploy takes down a node.
- Cluster autoscaler (or Karpenter) is actually tuned, not left on defaults from a tutorial.
- PodDisruptionBudgets exist for anything stateful.
Networking
- Ingress controller has rate limiting configured.
- DNS resolution is monitored — CoreDNS falling over is a silent killer.
- Service mesh mTLS, if present, is actually enforced, not permissive-mode forever.
Operations
- etcd backups are automated and tested. A backup nobody has restored from is a hope, not a plan.
- Alerting exists for API server latency, not just pod crashes.
If more than three of these are missing, that's usually where I start. Most clusters I audit fail six or seven — which is exactly why the audit pays for itself in the first incident it prevents.
For the reasoning behind each of these, and how to actually check for it in your own cluster, see the Kubernetes Production Readiness Guide — this checklist is the condensed version of it.
Want a second pair of eyes on your cluster? See the Kubernetes Cluster Audit or review the sample audit report.