k8s-review

Review Kubernetes manifests in severity order: first check blockers like missing resource requests and limits, broken probes, secrets in git, and unpinned image tags, then availability items like replicas, PodDisruptionBudgets, and HPA. Validate with kubectl apply --dry-run=server and kubectl diff before applying.

A production readiness checklist should cover resource requests and limits on every container, distinct readiness and liveness probes, pinned image tags, securityContext with runAsNonRoot, at least two replicas with a PodDisruptionBudget, sane rolling update strategy, HPA configuration, and least-privilege RBAC.

CrashLoopBackOff usually means the container exits immediately after starting, most often from a missing environment variable or secret, or a failed database migration. Check kubectl logs --previous to see the last container's output before it died.

OOMKilled (exit code 137) happens when container memory usage exceeds its configured limit. Compare actual usage from kubectl top pods --containers against the limit, then either raise the memory limit or fix the underlying memory leak.

CPU limits are optional and often omitted because CPU throttling can hurt latency more than it helps. Memory limits are essential for OOM protection, while CPU requests alone are sufficient for scheduling and HPA targeting.

No, combining HPA with a fixed replicas field in the same Deployment causes conflicts, especially with GitOps tools like ArgoCD or Flux that fight the autoscaler over replica count. Remove the replicas field and let HPA manage scaling between its min and max bounds.