Kubernetes Cluster Health Check

Check control plane component health

Verify kube-apiserver, controller-manager, scheduler are running and responsive.

Verify etcd cluster health and backups

Run etcdctl/cluster-health and confirm a recent successful backup exists.

Confirm all nodes are Ready and clear pressures

Run kubectl get nodes and inspect diskPressure/memoryPressure/NetworkUnavailable.

Inspect pods for CrashLoopBackOff and OOMKilled

List failing pods across namespaces and prioritize repeating failures.

Describe affected pods and recent events

Use kubectl describe pod to see events and termination reasons.

Collect container logs from failing pods

Fetch current and previous logs (kubectl logs --previous) for crash context.

Audit resource requests and limits for workloads

Identify missing or unrealistic requests/limits that cause scheduling or OOMs.

List pods missing CPU/memory requests or limits

Query deployments/statefulsets and flag pods without requests/limits.

Check PersistentVolume and PVC capacity and I/O errors

Inspect PVC usage and storage class events for provisioning or I/O failures.

Scan certificate expiry for cluster and TLS certs

Find certificates near expiry for kube-apiserver, kubelet, and ingress endpoints.

Check kube-apiserver and kubelet certificate expiry

Use kubeadm or openssl to inspect API server and node cert dates.

Ensure metrics-server and cluster metrics are available

Confirm kubectl top nodes/pods works and metrics-server pods are Ready.

Test HPA scaling behavior

Generate load and verify HPA scales pods as expected and stabilizes.

Run image vulnerability scanning for container images

Scan images with Trivy/Clair and prioritize fixing high CVEs in production images.

Review RBAC bindings for over-permissive roles

List ClusterRoleBindings and tighten any broad or unused privileges.

Validate DNS resolution and service endpoints

Test CoreDNS pods, resolve service names, and curl critical service endpoints.