CAST AI Production Readiness Gate

Overview

Approve production only when identity, ownership, connectivity, observability, scaling safety, cost interpretation, rollback, and evidence are all explicit. An unchecked or unknown item is a stop, not a soft pass.

Prerequisites

• Exact production kube context and CAST AI organization/region
• Reviewed infrastructure plan and pinned artifacts
• Workload owners, SLOs, PDBs, HPAs, quotas, and maintenance window
• Incident, rollback, and support escalation owners

Instructions

Step 1: Verify identity and ownership

Use Read and Grep to prove cluster, organization, region, cloud account, IaC source, reconcilers, and secret references. Confirm one owner for node provisioning, vertical rightsizing, and each HPA.

Step 2: Verify installation and access

Use Bash(castctl:) for supported version or status inspection, Bash(helm:) for pinned release evidence, and Bash(kubectl:*) for component readiness and warning events. Confirm least-privilege cloud permissions and required outbound connectivity.

Step 3: Verify scaling guardrails

Review node templates, maximum CPU, cloud quotas, protected namespaces, workload policy assignment, minimum/maximum requests, apply mode, recommendation confidence, PDB behavior, HPA bounds, and ownership transfer. Reject deprecated cluster minimum CPU configuration.

Step 4: Verify cost and reporting

Confirm baseline source, representative data window, public versus adjusted prices, automation adoption, and reconciliation owner. Do not use available or modeled savings as an unconditional release gate.

Step 5: Verify delivery and rollback

Use Bash(terraform:) for the saved plan and Bash(helm:) for the reviewed render. Confirm no unexpected deletion, disconnect, IAM expansion, CRD replacement, webhook collision, or automation enablement. Use Write or Edit to record tested rollback steps and thresholds.

Step 6: Make the decision

Record PASS only when every required item has evidence. Otherwise record HOLD with the exact owner and missing proof. Approve one cluster ring and one automation dimension at a time.

Tool Discipline

Use Read and Grep for evidence review. Use Write and Edit for the signed gate record. Use Bash(kubectl:), Bash(helm:), Bash(terraform:), and Bash(castctl:) for non-secret inspection, render, and plan operations; do not perform the production change from the checklist.

Output

• Evidence-linked readiness matrix
• Explicit PASS or HOLD decision
• Approved scope, window, and owners
• Rollback and incident triggers

Examples

A cluster passes observation readiness but holds node automation because Karpenter ownership is unresolved. Another passes a Deferred workload canary while managed HPA takeover remains out of scope.

Error Handling

Failure	Response
Evidence is stale or from another cluster	Mark the gate HOLD
Ownership is shared or implicit	Resolve control authority before release
Rollback is untested	Limit to observation mode
Secret appears in an artifact	Stop, rotate, and regenerate evidence

Resources

• Readiness evidence and source notes
• Connect with castctl
• Node Autoscaling
• Workload Autoscaler overview