Launch Coordination

SRE Book Chapter 27 — production readiness reviews, launch checklists, traffic ramping, and the structured process that prevents launches from becoming outages.

Overview

Launching into billions of requests

SRE Book Chapter 27, Reliable Product Launches at Scale, describes how Google launches products that may immediately receive billions of requests. Launch Coordination Engineers run a launch checklist; the related Production Readiness Review (PRR), covered in Chapter 32, is the structured review a service completes before SRE agrees to support it in production.

> [!IMPORTANT] A canary tests whether the new binary is correct. A launch ramp tests whether the infrastructure can handle the load.

The eight readiness domains

Architecture and dependencies — Is the dependency graph understood?
Capacity planning — Is the service provisioned for peak plus N+2?
Failure modes — Are single points of failure identified and mitigated?
Monitoring and alerting — Are SLIs defined, with alerting on SLO burn?
Rollout and rollback — Is there a tested rollback procedure?
Operational documentation — Are runbooks written and reviewed?
Security — Are authentication and authorization correct?
Privacy — Does the service handle user data appropriately?

The traffic ramp

Sequence — 1%, 10%, 25%, 50%, 100%
Holds — 15-60 minutes at each increment
Launch freeze — No configuration or code changes during the ramp

> [!WARNING] Correlated changes during a ramp make incident diagnosis impossible. That is why the launch freeze is standard.

Key concepts

Production Readiness Review (PRR): A structured checklist-based review that a service must pass before receiving SRE support and production traffic. Covers architecture, capacity, failure modes, monitoring, rollback, runbooks, security, and privacy.
Launch Coordination Lead (LCL): An SRE assigned as the single owner of the launch process. Coordinates pre-launch checks, owns the traffic ramp decision, and is the escalation point during the launch window.
Traffic ramp: Progressive exposure of the new service to production traffic: 1% → 10% → 25% → 50% → 100%. Each increment has a hold period for metric validation before proceeding.
Launch freeze: A period of no configuration or code changes during the traffic ramp. Eliminates correlated changes that make incident diagnosis impossible when the service is in a partially-ramped state.
Post-launch monitoring window: A 24-72 hour period after full rollout with enhanced SRE coverage — typically tighter alerting thresholds and on-call engineer briefed on the launch details. Most launch-related incidents occur in this window.

When to use it

"How do you ensure a new service is production-ready before launch?" — PRR checklist
"What does your team do differently for a major traffic event vs. a regular deploy?"
Designing a launch process for a new service that will receive high traffic immediately
"What is a production readiness review and what does it cover?"

Interview questions

Design a launch process for a new service that must handle 100,000 QPS within 24 hours of public launch.