Go-live checklist

Readiness + liveness probes on /health

Service must not receive traffic until ready.

CPU/memory requests and limits set

Avoid noisy neighbor and OOM kills.

PodDisruptionBudget for HA workloads

At least minAvailable: 1 or maxUnavailable: 1.

Ingress TLS (cert-manager or valid cert)

No plain HTTP in production.

Image tag pinned (digest or semver from CI)

No :latest in prod.

Secrets via Vault / External Secrets — not plain YAML

No credentials in git or ConfigMap.

Backups verified (Velero / DB snapshot / restore test)

Run restore drill at least once per quarter.

Alerts on error rate, latency, pod restarts, disk

Pager routes to on-call; runbook linked in alert.

CI uses OIDC — no static AWS keys in GitHub secrets

AWS_ROLE_ARN + id-token write permission.

NetworkPolicy or security groups restrict pod traffic

Default deny where policy requires.

Rollback tested (helm rollback or kubectl rollout undo)

Document last known good revision.

Container image scanned (Trivy) — no critical CVEs

Gate deploy on scan in CI for prod.