Build stage

// Program.cs
var builder = WebApplication.CreateBuilder(args);

// Cloud-native configuration sources
builder.Configuration.AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)
                     .AddEnvironmentVariables()
                     .AddAzureKeyVault(new Uri(builder.Configuration["KeyVaultEndpoint"]), 
                                       new DefaultAzureCredential());

// Dependency Injection with keyed services for resilience
builder.Services.AddKeyedSingleton<IResiliencePipelineProvider<string>, ResiliencePipelineProvider<string>>();

// Register application services
builder.Services.AddControllers();
builder.Services.AddEndpointsApiExplorer();

var app = builder.Build();

// Middleware pipeline optimized for cloud
app.UseHttpsRedirection();
app.UseAuthorization();
app.MapControllers();
app.MapHealthChecks("/healthz");
app.MapHealthChecks("/readyz", new Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckOptions { 
    Predicate = _ => true 
});

app.Run();

// ResilienceConfiguration.cs
public static class ResilienceConfiguration
{
    public static void AddCloudResilience(this IServiceCollection services)
    {
        services.AddResiliencePipeline("default", builder =>
        {
            builder.AddRetry(new RetryStrategyOptions
            {
                BackoffType = DelayBackoffType.Exponential,
                MaxRetryAttempts = 3,
                Delay = TimeSpan.FromSeconds(2),
                ShouldHandle = new PredicateBuilder().Handle<HttpRequestException>()
            });

            builder.AddCircuitBreaker(new CircuitBreakerStrategyOptions
            {
                SamplingDuration = TimeSpan.FromSeconds(10),
                FailureRatio = 0.3,
                MinimumThroughput = 10,
                Bre

akDuration = TimeSpan.FromSeconds(15) });

        builder.AddTimeout(TimeSpan.FromSeconds(5));
    });

    services.AddResiliencePipeline("database", builder =>
    {
        builder.AddRetry(new RetryStrategyOptions
        {
            MaxRetryAttempts = 2,
            Delay = TimeSpan.FromMilliseconds(500),
            ShouldHandle = new PredicateBuilder().Handle<SqlException>(ex => ex.Number == 1205) // Deadlock
        });
    });
}

}

#### Step 3: OpenTelemetry and Structured Logging

Cloud-native observability requires distributed tracing, metrics, and structured logs. Configure OpenTelemetry to export to standard backends like Prometheus, Jaeger, or cloud-native APMs.

```csharp
// ObservabilitySetup.cs
public static class ObservabilitySetup
{
    public static void AddCloudObservability(this WebApplicationBuilder builder)
    {
        builder.Logging.AddOpenTelemetry(options =>
        {
            options.IncludeScopes = true;
            options.ParseStateValues = true;
            options.IncludeFormattedMessage = true;
        });

        builder.Services.AddOpenTelemetry()
            .WithTracing(tracing => tracing
                .AddAspNetCoreInstrumentation()
                .AddHttpClientInstrumentation()
                .AddEntityFrameworkCoreInstrumentation()
                .AddOtlpExporter())
            .WithMetrics(metrics => metrics
                .AddAspNetCoreInstrumentation()
                .AddRuntimeInstrumentation()
                .AddHttpClientInstrumentation()
                .AddOtlpExporter());
    }
}

Step 4: Architecture Decisions

• Service Mesh vs. SDK: For polyglot environments, use a service mesh (Istio/Linkerd) for mTLS and traffic management. For .NET-only stacks, leverage the Microsoft.Extensions.Http.Resilience SDK to reduce sidecar overhead.
• State Management: Externalize state to Redis or distributed caches. Avoid in-memory state in web apps to ensure horizontal scalability and pod replacement safety.
• Container Images: Use chiseled Ubuntu images (mcr.microsoft.com/dotnet/aspnet:8.0-noble-chiseled) for minimal attack surface and size. Enable multi-stage builds to exclude SDK artifacts.

Pitfall Guide

Production experience reveals recurring failure modes in .NET cloud-native implementations. Avoid these critical mistakes.

1. Sync-over-Async Blocking:

   • Mistake: Using .Result or .Wait() on async methods.
   • Impact: Causes thread pool starvation, leading to request timeouts and cascading failures under load. The thread pool cannot replenish fast enough when threads are blocked waiting for I/O.
   • Fix: Propagate async all the way up. Use await consistently.

2. Ignoring GC and Container Memory Limits:

   • Mistake: Running .NET in containers without configuring DOTNET_GCHeapHardLimit.
   • Impact: The .NET GC may allocate memory based on the host machine's total RAM rather than the container limit, causing OOM kills by the orchestrator.
   • Fix: Ensure .NET 8+ automatically detects container limits, or explicitly set GC limits. Monitor Gen 2 collections and heap fragmentation.

3. Bloated Docker Images:

   • Mistake: Using runtime or sdk images in production, or failing to use multi-stage builds.
   • Impact: Increases attack surface, slows down deployment pipelines, and wastes storage/bandwidth.
   • Fix: Use chiseled images. Implement multi-stage Dockerfiles where the build stage publishes the app, and the final stage copies only the artifacts.

4. Missing or Misconfigured Health Checks:

   • Mistake: Using a single health check endpoint for both liveness and readiness, or checking non-critical dependencies.
   • Impact: Kubernetes may restart a healthy pod (liveness failure) or route traffic to a pod that isn't ready to serve (readiness failure).
   • Fix: Implement distinct endpoints. Liveness should only check the process itself. Readiness should check critical dependencies like databases and caches.

5. Hardcoded Configuration and Secrets:

   • Mistake: Embedding connection strings or API keys in source code or standard appsettings.json committed to VCS.
   • Impact: Security vulnerabilities and inability to rotate secrets without redeployment.
   • Fix: Use environment variables, secret managers (Azure Key Vault, AWS Secrets Manager), and configuration providers. Enable reloadOnChange for dynamic config updates.

6. Distributed Transaction Anti-Patterns:

   • Mistake: Attempting to use TransactionScope across microservice boundaries.
   • Impact: Distributed transactions (2PC) are slow, complex, and often unsupported in cloud environments. They create tight coupling and availability risks.
   • Fix: Adopt eventual consistency patterns. Use Sagas, outbox patterns, or message brokers (RabbitMQ, Kafka, Azure Service Bus) for cross-service coordination.

7. Logging PII or Sensitive Data:

   • Mistake: Logging request bodies or query strings without sanitization.
   • Impact: Compliance violations (GDPR, HIPAA) and security risks in log aggregation systems.
   • Fix: Implement log scrubbing middleware. Use structured logging with explicit field definitions to control what data is captured.

Production Bundle

Action Checklist

• Enable OpenTelemetry: Configure tracing, metrics, and logs with OTLP exporter in Program.cs.
• Implement Resilience Pipelines: Add retry, circuit breaker, and timeout policies using Polly for all external calls.
• Configure Health Checks: Separate liveness and readiness probes; include dependency checks in readiness.
• Optimize Container Images: Use multi-stage builds and chiseled Ubuntu images; verify image size < 100MB.
• Externalize Configuration: Move secrets to a vault; use environment variables for runtime config.
• Tune GC for Containers: Verify DOTNET_GCHeapHardLimit is respected; monitor memory usage under load.
• Review Async Patterns: Scan codebase for .Result/.Wait(); refactor to full async/await chains.
• Set Resource Limits: Define CPU and memory requests/limits in Kubernetes manifests based on load testing data.

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
High-throughput API Gateway	Native AOT + Kestrel	Native compilation eliminates JIT overhead; minimal memory footprint allows high concurrency.	Low
Event-Driven Worker	.NET Worker Service + Dapr	Dapr provides bindings and state management; worker service scales independently.	Medium
Dynamic Plugin System	Standard JIT + Reflection	AOT does not support dynamic code generation or full reflection; JIT is required.	Medium
Bursty Workloads	Serverless (Azure Functions) + AOT	Scale-to-zero capability; AOT reduces cold start latency significantly.	Variable
Complex Business Logic	Modular Monolith	Reduces distributed complexity; shared database transactions; easier debugging.	Low

Configuration Template

Dockerfile (Optimized for Production):

# Build stage
FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY ["MyApp.csproj", "MyApp/"]
RUN dotnet restore "MyApp/MyApp.csproj"
COPY . .
WORKDIR "/src/MyApp"
RUN dotnet build "MyApp.csproj" -c Release -o /app/build

# Publish stage
FROM build AS publish
RUN dotnet publish "MyApp.csproj" -c Release -o /app/publish /p:UseAppHost=false

# Runtime stage
FROM mcr.microsoft.com/dotnet/aspnet:8.0-noble-chiseled AS final
WORKDIR /app
COPY --from=publish /app/publish .

# Security and performance settings
ENV DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=false
ENV ASPNETCORE_URLS=http://+:8080
EXPOSE 8080

USER $APP_UID
ENTRYPOINT ["dotnet", "MyApp.dll"]

Quick Start Guide

1. Create Project:

   dotnet new webapi -n CloudNativeApp --use-minimal-apis
   cd CloudNativeApp
   

2. Add Packages:

   dotnet add package Microsoft.Extensions.Resilience
   dotnet add package OpenTelemetry.Exporter.OpenTelemetryProtocol
   dotnet add package AspNetCore.HealthChecks.UI.Client
   

3. Configure Program.cs: Integrate resilience, OpenTelemetry, and health checks as shown in the Core Solution code examples.

4. Build and Run:

   docker build -t cloudnativeapp:latest .
   docker run -p 8080:8080 --name cloudnativeapp cloudnativeapp:latest
   

   Verify endpoints: http://localhost:8080/healthz and http://localhost:8080/readyz.

5. Deploy to Kubernetes: Generate manifests using kubectl create deployment or Helm charts. Ensure resource limits and probes are configured in the YAML manifests.

This guide provides the foundation for building .NET services that are performant, resilient, and cost-effective in cloud environments. Adherence to these patterns ensures alignment with modern orchestration capabilities and operational best practices.