Microservice Production-Readiness Checklist

When to Use This Checklist

Use this checklist before a microservice carries production traffic, whether it is newly built or freshly extracted from a monolith. A microservice is an independently deployable unit that owns its data and exposes a network API. Independence is the point and the risk: each service must be observable, resilient, and secure on its own because no shared process protects it.

How to Use This Checklist

Group work into contract, observability, resilience, and security tracks. Start with the API contract and SLOs because they define the service's promises. Wire up the four golden signals and tracing before launch so you can debug from day one. Confirm resilience patterns such as timeouts and circuit breakers protect every downstream dependency. Treat security items as mandatory gates.

The service should ship through its own pipeline with automated rollback. Optional items such as load testing and idempotency checks are strongly recommended for write-heavy services.

What Good Looks Like

A production-ready service has a published, versioned contract; live dashboards for latency, traffic, errors, and saturation; and an on-call runbook with symptom-based alerts. Health and readiness probes let the orchestrator manage it. Downstream calls have timeouts and circuit breakers. Secrets come from a vault, scans run on every build, and a single command rolls the service back.

Common Pitfalls

Teams launch services with no SLOs and then cannot agree what "healthy" means. Missing timeouts turn one slow dependency into a fleet-wide outage. Logging without tracing makes distributed debugging guesswork. Hardcoded secrets and skipped scans create avoidable breaches. Finally, shipping a service that still shares a database with its origin monolith undermines its independence.

Related Resources

See the production-ready microservices checklist, service-level objectives, the four golden signals, and the circuit breaker pattern. OpenTelemetry semantic conventions standardize your telemetry, and secrets management best practices cover credential handling.