Platform Deploy Highlights Summary

Every highlight bullet from the 7 pages in this section, gathered on one page and grouped by the page it came from.

The Container Orchestration Model

• You declare desired state; the orchestrator's job is to keep reality matching it, continuously
• A reconciliation loop, not a one-time deploy script, is what actually keeps replicas running
• The scheduler decides where, health checks decide whether, replicas decide how many
• Different orchestrators trade control for operational simplicity along the same spectrum

Platform Deploy Basics

• One codebase, many deploys via config in the environment
• Treat logs as event streams; write JSON to stdout
• Stateless processes; persist to backing services
• Port binding via process.env.PORT on 0.0.0.0
• Release phase separate from run (migrations vs node dist/main.js)
• Dev/prod parity: same Node 24 image from CI to production

Kubernetes Deployment

• maxUnavailable: 0 with preStop sleep 5 enables graceful rollout shutdown
• Use immutable SHA tags instead of latest to prevent unpredictable rollouts
• Add preStop hooks and graceful shutdown to prevent 502 errors during rollouts
• Set database checks on readiness probes only to prevent restart storms
• Set CPU requests from load test p99 to prevent throttling under load
• PodDisruptionBudget minAvailable: 2 protects against node drains

HPA & Resource Limits

• CPU target 65-70% of requests, not limits; add 5-minute scale-down window
• Node.js single-threaded: CPU limits can throttle the event loop and inflate latency
• Set memory limit 1.5-2x request to provide headroom for GC spikes
• HPA without resource requests shows unknown metrics; set requests on containers
• Use custom metrics for I/O-bound APIs where CPU poorly correlates with load
• Cap maxReplicas at DB pool size to prevent database connection storms

ECS Fargate & Cloud Run

• ECS Fargate fits steady AWS APIs; Cloud Run better for spiky HTTP traffic
• ECS rolling deploys use minimumHealthyPercent 100 for zero-downtime updates
• Tune Cloud Run concurrency to event loop saturation, not the default 80 requests
• ECS execution role pulls images and secrets; task role calls AWS services
• Add ALB health check on /health to prevent bad Fargate tasks from getting traffic
• Cloud Run scales to zero; Fargate keeps tasks running for minimal cold starts

ConfigMaps & Secrets

• Store non-secret config in ConfigMap, credentials in Secret
• Base64 in ConfigMap is not encryption; use Secret always
• Inject via envFrom configMapRef and secretRef at boot
• File mounts avoid env var 1 MiB limit and env logging leaks
• ConfigMap changes require pod restart to take effect
• Never bake secrets in image ENV; inject via orchestrator

Platform Deploy Best Practices

• 12-factor config via environment variables validated at boot
• One Node process per container; platform scales replicas
• NODE_ENV=production set in Deployment, not only Dockerfile
• Separate release (migrations) from run (node dist/main.js)
• Requests and limits derived from load tests, not guesses
• Secrets in Secret/SSM, never in image layers