RousselTMLEARNING

Proxy & networking

Deployment strategies with Traefik: blue/green, canary and rolling

Implement deployment strategies with Traefik: rolling update by the orchestrator, blue/green by switching routers, canary with weighted services (WRR), mirroring, and rollback.

1. Choosing a strategy #

Risk, cost and rollback speed.

Comparison #

Deployment strategies
Traefik handles blue/green and canary; rolling update is the orchestrator's job.
StrategyPrincipleRollbackCost
RollingInstances are replaced progressivelyNew deployment of the old versionLow
Blue/greenTwo complete environments, traffic switchInstant (switch back)Double capacity during the switch
CanaryA small share of traffic on the new version, then increasedSet the weight back to 0Low; requires good metrics
MirroringTraffic copied to the new version, responses ignoredNo user impactDouble load

2. Implementation #

Weighted services and switching.

Canary with the file provider #

http:
  services:
    app:
      weighted:
        services:
          - name: app-v1@docker
            weight: 90
          - name: app-v2@docker
            weight: 10
        sticky:
          cookie: { name: version }      # un utilisateur reste sur la même version
  routers:
    app:
      rule: Host(`app.exemple.fr`)
      service: app

Canary in Kubernetes (TraefikService) #

apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata: { name: app-canary, namespace: app }
spec:
  weighted:
    services:
      - { name: app-v1, port: 80, weight: 90 }
      - { name: app-v2, port: 80, weight: 10 }

Blue/green and mirroring #

For blue/green, you change the service targeted by the router (app-blue → app-green); with the file provider, the switch is applied on the fly. Mirroring copies a share of traffic to a test version:

http:
  services:
    app-miroir:
      mirroring:
        service: app-v1@docker
        mirrors:
          - { name: app-v2@docker, percent: 20 }

3. Best practices #

Deploying without fear.

Rules #

  • Define success criteria in advance (error rate, p95 latency) and monitor them per service.
  • Make database migrations compatible with both versions (expand / contract).
  • Automate progression and rollback rather than changing weights by hand: that is Flagger's role (next article).
  • Health checks on services so that Traefik automatically removes a failing instance.

Related articles

Traefik: securing and transforming requests with middlewares (BasicAuth, ForwardAuth…)

Traefik middlewares modify requests and responses between the router and the service: BasicAuth and ForwardAu…

Traefik: providers (Docker, Kubernetes, Nomad, Consul, files, key-value stores)

Providers feed Traefik's dynamic configuration: service discovery for Docker, Swarm, Kubernetes, Nomad and Co…

Traefik as an Ingress Controller for Kubernetes (Helm, IngressRoute, Gateway API)

Install Traefik in Kubernetes with Helm and publish applications with Ingress, the IngressRoute and Middlewar…

Keep learning

Support us

♥ SUPPORT US

Support RousselTM Learning

Courses, articles, labs and certificates stay free with no intrusive ads. A voluntary contribution, of any amount you choose, pays for hosting, lab environments and new content.

Contribute with PayPal Any amount · card or PayPal accountLearn more
QR code PayPal
Or scan this QR code with your phone

Thank you, every contribution counts!