Operate a Production SaaS

The capstone. Fifteen questions in a fixed order, then ten things that go wrong while you are answering them. The order matters: each answer constrains the ones below it, which is why the interesting failures in real systems are almost never in the component that failed.

The brief

You own production for a multi-tenant SaaS platform serving millions of users. Frequent deployments, no planned downtime, safe database changes, fast rollback, tenant isolation, observability, on-call, backups, disaster recovery and cost awareness are all requirements — not aspirations. Work the questions in order; each answer constrains the ones below it.

The questions

Answer each one out loud before opening it. The answer is much less useful if you have not first committed to one of your own.

  1. 1

    How does code reach production?

  2. 2

    What exactly is the artifact?

  3. 3

    How is configuration injected, and how are secrets delivered?

  4. 4

    How is infrastructure created?

  5. 5

    How is the deployment rolled out?

  6. 6

    How are health checks defined?

  7. 7

    What happens on shutdown?

  8. 8

    How are migrations deployed?

  9. 9

    How is a bad release detected?

  10. 10

    How is it rolled back?

  11. 11

    What alerts page on-call?

  12. 12

    What is the runbook?

  13. 13

    How much capacity is reserved?

  14. 14

    How are backups restored?

  15. 15

    How does region failover work?

Injected failures

Each of these arrives while the system is running. Every one has a response that looks right and makes things worse or leaves the mechanism intact — read the trap even when you got the cause.

A CI dependency is compromised
How it presents

Nothing. Builds are green and the application behaves normally.

A container image ships with the wrong config
How it presents

The service starts and serves, but points at the staging database.

A new deployment fails readiness
How it presents

The rollout stalls. Old instances keep serving; the new ones never take traffic.

A database migration blocks writes
How it presents

Write latency climbs sharply; timeouts spread across every endpoint that writes.

Traffic increases 8x
How it presents

Latency rises, then errors, then autoscaling adds instances that do not help.

A certificate expires
How it presents

Clients fail to connect. The service itself is healthy and its dashboards are green.

Redis disappears
How it presents

Database load multiplies; latency spikes; some requests fail outright.

The queue backlog grows continuously
How it presents

The API is healthy. Users report stale data rather than errors.

One region fails
How it presents

Half of traffic is failing. The surviving region is at full utilisation.

A backup restore is slower than expected
How it presents

Recovery is underway and will not meet the stated objective.

Where to practise the pieces