Go-live checklist

Work top to bottom. Skip optional rows that are out of scope for this customer.

1. Infrastructure (bring your own)

• [ ] AKS cluster healthy (kubectl get nodes)
• [ ] Application Gateway / ingress controller routing to the cluster
• [ ] DNS for AMS hostname configured
• [ ] TLS certificate and Kubernetes TLS Secret available
• [ ] ACR pull working
• [ ] Databases / storage required by charts reachable
• [ ] Operator access path validated (network access)

2. Shared platform services

• [ ] Observability installed; Grafana or equivalent reachable
• [ ] OTEL / collector endpoints documented for apps and adapters
• [ ] Keycloak installed; realm and clients ready
• [ ] Test user can authenticate

3. Application modules

Select one or more:

• [ ] Command Center
• [ ] ARE
• [ ] EOBS
• [ ] FortifyOps

Landing rule:

• [ ] If all four → root.module: command-center
• [ ] If only one → root.module matches that module

4. Infrastructure ingress

• [ ] Infrastructure ingress applied
• [ ] https://<ams-host>/ opens the expected primary UI
• [ ] Module-specific paths work for every installed module

5. Optional adapters

• [ ] Dify
• [ ] EMA
• [ ] LibreChat
• [ ] Lyzer
• [ ] MS Copilot

6. Optional platforms

• [ ] Dify / Langfuse / LibreChat deployed as needed
• [ ] Matching adapters configured (platform notes)
• [ ] Test agent or chat visible in observability

7. Final acceptance

• [ ] SSO login works for each installed UI
• [ ] TLS valid in browsers
• [ ] No CrashLoopBackOff in critical namespaces
• [ ] Backup / support contacts documented outside this site
• [ ] Customer runbook updated with their IAC and secret locations

You are ready for controlled user access when sections 1–4 are complete; sections 5–6 are additive.