Kubernetes Cost and Security Hygiene Checklist

Kubernetes technical debt grows quietly.

Resource quotas are missing until a namespace floods the cluster. RBAC becomes permissive until someone asks why a service account can access production secrets. Cost drift accumulates until “we’ll fix it later” becomes permanent.

This checklist is designed for a quarterly hygiene review on production clusters.

Cost hygiene

• Ensure every production workload has resource requests and limits.
• Enforce namespace-level quotas so teams can’t accidentally exhaust cluster capacity.
• Periodically rightsizing candidates: compare requested resources vs observed usage and adjust.
• Review node pool instance selection so you aren’t paying for unused capacity.

Security hygiene

• Apply least-privilege RBAC. Avoid wildcard verbs outside system namespaces.
• Use default-deny network policies per namespace, then add explicit allows.
• Adopt Pod Security Standards (for example, “restricted” for production namespaces) when compatible with your workloads.
• Keep images scanned and pinned (avoid unpinned mutable tags).

OrchesTerra connection: drift visibility

Many hygiene gaps exist because the cluster changes over time, while your declarative model falls out of sync.

OrchesTerra helps teams detect drift in security- and governance-sensitive configurations and then reconcile those changes through governed workflows.

Start with drift reconciliation to see the end-to-end remediation pattern.

Common pitfalls

1. Treating quotas as optional.
2. Forgetting health checks (configuration being “in sync” is not the same as being healthy).
3. Creating network policies and never testing blocked traffic.
4. Rightsizing without a measurement baseline.
5. Scanning images once and then assuming the risk is solved forever.