| # Microservice Golden Path Checklist |
|
|
| ## Pre-Deployment |
| - [ ] Service name follows naming convention: lowercase-hyphenated |
| - [ ] Dockerfile uses multi-stage build + distroless base |
| - [ ] Image is signed with Cosign |
| - [ ] SBOM is generated and attested |
| - [ ] All security scans pass (Trivy, Semgrep, Checkov) |
| - [ ] Health endpoints: /healthz (liveness) + /readyz (readiness) |
| - [ ] Graceful shutdown handles SIGTERM |
|
|
| ## Kubernetes |
| - [ ] Resource requests AND limits defined |
| - [ ] runAsNonRoot: true + readOnlyRootFilesystem: true |
| - [ ] capabilities.drop: ["ALL"] |
| - [ ] Probes configured (liveness + readiness) |
| - [ ] PDB created (minAvailable >= 2) |
| - [ ] HPA configured |
| - [ ] NetworkPolicy: default deny + selective allow |
| - [ ] Secrets from External Secrets Operator (not hardcoded) |
| - [ ] automountServiceAccountToken: false (unless needed) |
| - [ ] TopologySpreadConstraints for multi-AZ |
|
|
| ## Observability |
| - [ ] Prometheus metrics endpoint exposed |
| - [ ] Structured JSON logging |
| - [ ] OpenTelemetry traces emitted |
| - [ ] Dashboard exists in Grafana |
| - [ ] Alert rules defined in Prometheus |
|
|
| ## CI/CD |
| - [ ] DevSecOps pipeline passes (SAST + scan + sign + test) |
| - [ ] ArgoCD application manifest created |
| - [ ] Kustomize overlay for each environment |
|
|
