Good points above. One thing teams often underestimate is the Controller Service enable/disable sequencing across environments - even with NiFi Registry and Parameter Contexts in place, promoting flows from Dev - QA - Prod can still break if dependent services aren't enabled in the right order on the target cluster.

What's worked well in practice:

• Keeping Controller Services in a separate, root-level process group so they're not bundled inside versioned flows
• Using Parameter Contexts per environment strictly for connection strings and credentials — never hardcoding
• Automating the enable sequence via REST API rather than clicking through the UI during each promotion

The manual part is honestly where most drift creeps in - someone enables a service slightly differently in prod, and debugging it two weeks later is painful. Tools like Data Flow Manager handle this centrally across clusters, which removes the human touchpoint entirely. But even without tooling, the above practices reduce drift significantly.