Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Package the app as a Helm chart (templated manifests + values.yaml for per-environment overrides), and harden it for production: resource requests and limits on every container, a HorizontalPodAutoscaler driven by CPU/metrics, a least-privilege ServiceAccount + Role/RoleBinding (no cluster-admin), a non-root securityContext, and a documented rolling-update + rollback procedure. Demonstrate an upgrade and a rollback via Helm.
A working chart with templated manifests and values overrides; install/upgrade/rollback via Helm releases demonstrated.
Requests/limits set sensibly; an HPA scales on metrics (needs requests + metrics-server); behavior shown under load.
Least-privilege ServiceAccount + Role/RoleBinding (not cluster-admin); non-root securityContext; secrets handled safely.
Rolling update + rollback documented and demonstrated; probes/PDB considered.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# Production-ready manifests: Helm, autoscaling & RBAC ## Goal Package the app as a Helm chart (templated manifests + values.yaml for per-environment overrides), and harden it for production: resource requests and limits on every container, a HorizontalPodAutoscaler driven by CPU/metrics, a least-privilege ServiceAccount + Role/RoleBinding (no cluster-admin), a non-root securityContext, and a documented rolling-update + rollback procedure. Demonstrate an upgrade and a rollback via Helm. ## Acceptance criteria - [ ] Helm packaging: A working chart with templated manifests and values overrides; install/upgrade/rollback via Helm releases demonstrated. - [ ] Autoscaling & resources: Requests/limits set sensibly; an HPA scales on metrics (needs requests + metrics-server); behavior shown under load. - [ ] RBAC & security: Least-privilege ServiceAccount + Role/RoleBinding (not cluster-admin); non-root securityContext; secrets handled safely. - [ ] Operability: Rolling update + rollback documented and demonstrated; probes/PDB considered. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.