44. Production-readiness checklist

Use it as a PR template for a new service, or as a launch review.

Image

• Multi-stage build; minimal base (distroless/Chainguard/slim); pinned by digest
• Runs as numeric non-root UID; no secrets in layers, ARGs or ENV
• Exec-form ENTRYPOINT; handles SIGTERM; graceful shutdown within the grace period
• Multi-arch; SBOM + provenance attached; signed; CRITICAL CVEs gated in CI

Workload

• Deployment/StatefulSet (never bare pods); ≥ 2 replicas (≥ 3 across zones for critical paths)
• CPU + memory requests from measured data; memory limit = request; runtime memory-aware (GOMEMLIMIT/JVM flags)
• startup/liveness/readiness probes, with liveness free of dependency checks
• preStop sleep + terminationGracePeriodSeconds budget adds up
• PDB allows ≥ 1 eviction; topology spread across zones/nodes
• PriorityClass set; tolerations tuned for stateless fast failover
• HPA/KEDA on a meaningful signal; replicas removed from the manifest; DB connection math checked
• Config via ConfigMap with hash-based rollout; secrets via ESO, mounted as files where possible

Security

• Own ServiceAccount; token not mounted unless needed; least-privilege RBAC
• PSA restricted passes: non-root, drop ALL, no privilege escalation, read-only root FS, seccomp RuntimeDefault
• NetworkPolicies: default deny + explicit ingress/egress; metadata endpoint blocked
• Workload identity for cloud APIs; no static credentials anywhere

Observability

• OTel traces with context propagation (HTTP + messaging); RED metrics; bounded-cardinality attributes
• Structured JSON logs with trace_id; no secrets/PII in logs
• Dashboard (RED + saturation + dependencies) as code
• SLOs defined; burn-rate alerts; every alert has a runbook; on-call rotation knows the service

Delivery and data

• Deployed only via GitOps; digest-pinned; promotion = PR; rollback = revert, rehearsed
• Canary with automated analysis for user-facing services
• Migrations are backward compatible (expand/contract); run as a hook, not at app start
• Backups automated and restore-tested; RPO/RTO written down and measured
• Load-tested to 2× expected peak; chaos experiments for pod, node and dependency failure