Kubernetes Cluster Setup Checklist
A setup checklist for new managed Kubernetes clusters covering version and CIDR planning, network-policy-capable CNI, IAM-integrated RBAC, autoscaling, and a codified platform add-on layer.
When to Use This Checklist
Use this when standing up a new managed Kubernetes cluster (EKS, AKS, or GKE) that teams will build on. It covers the foundational decisions, networking, security integration, and platform add-ons that are painful to retrofit later. Pair it with the Kubernetes production-readiness checklist, which covers the workloads you run on top.
Getting the cluster foundation right means application teams inherit a safe, observable platform rather than reinventing it.
How to Use This Checklist
Make the irreversible decisions first: CIDR ranges, CNI choice, and IAM integration are expensive to change after workloads land. Plan node pools around workload shapes and enable autoscaling so capacity follows demand.
Install the platform layer (ingress, certificates, observability, policy) before teams onboard, so every workload gets it for free. Codify the cluster and its add-ons in IaC and GitOps so the platform is reproducible. Finish with a smoke-test deployment to confirm the whole stack works.
What Good Looks Like
A well-provisioned cluster runs a supported version with a planned upgrade cadence, non-overlapping CIDR ranges, and a network-policy-capable CNI. Node pools match workload types, autoscaling is live, and cluster RBAC maps to cloud IAM. Ingress, certificates, observability, and policy guardrails are installed, secrets integration works, and everything is defined in IaC and GitOps. A smoke test confirms the platform end to end.
Common Pitfalls
Undersized or overlapping CIDR ranges block future growth and peering. Choosing a CNI without network-policy support blocks segmentation later. Skipping IAM integration leads to long-lived static credentials. Bolting on observability after teams onboard means early workloads run blind. And click-ops clusters drift and cannot be reproduced after an incident or a region expansion.
Related Resources
Use CNCF cloud-native principles and Pod Security Standards for the security baseline, GitOps principles for add-on delivery, and platform-engineering practices to frame the cluster as an internal product. Service-mesh best practices apply if you add a mesh.