Skip to main content

ADR-0005: Progressive delivery as traffic division between Releases

Status​

Accepted

Context​

ADR-0001 predicted that canary and blue/green would become "how many Releases receive traffic and in what proportion". M4 implements that without new CRDs or external delivery controllers (Argo Rollouts, Flagger).

Decision​

Strategies are configuration (deploy.strategy, typically set by environment profiles). Both build on the same primitive — two immutable Releases rendered side by side with distinct selector identities:

  • Canary: the primary track keeps serving the old Release while a parallel <app>-canary Deployment/Service runs the new one. Traffic weight lives at the edge: nginx-ingress canary annotations, or weighted HTTPRoute backendRefs in gateway mode. The controller advances through deploy.canary.steps after each healthy stepInterval, promotes past the last step, and aborts (with autoRollback) if the canary stalls — the primary never stops serving.
  • Blue/green: two color tracks (<app>-blue, <app>-green). New releases stage on the idle color; when fully ready the stable Service's selector flips — instant cutover. The previous color keeps running until the next release replaces it, so rollback is an instant flip back (the rollback API just points at the old Release, which is still warm on the other color).

NetworkPolicy and PDB select the pagifier.io/application label, which every track carries, so policy follows the app rather than a workload name.

Consequences​

  • No new CRDs: canary progress and color state live in Application status; every step is visible in kubectl get and the API.
  • Health judgment is deliberately simple in V1 (deployment readiness + progress deadline). Metric-based analysis (error rates, latency) can slot into the same advance/abort decision later.
  • Canary requires edge weighting, hence ingress (or a Gateway); blue/green works anywhere because it is a selector flip.
  • Cost: blue/green briefly doubles capacity, and the idle color keeps running between releases by design — that standby capacity is the price of instant rollback.