Kubernetes blue-green deployment

How it works

• In Kubernetes, a Service uses a LabelSelector to link to different versions of a Deployment, and a VirtualService controls the traffic routing policies.

• When a blue-green deployment starts, Feiliu creates a new blue environment based on the current green environment.

• After the blue environment is created, the pipeline updates Istio's DestinationRule to generate a routing table and modifies the VirtualService to apply the configured traffic weight.

• You can set a canary tag to determine which traffic is routed to the blue environment.

• After manual verification, all traffic is switched to the blue environment, and the system removes the green environment instances.

Prerequisites

• The Service, VirtualService, and DestinationRule must have the same name.

• The Deployment labels must include all labels from the Service's selector. For example:

  ---
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      run: spring-boot-sample
    name: spring-boot-sample
  spec:
    replicas: 2
    selector:
      matchLabels:
        run: spring-boot-sample
    template:
      metadata:
        labels:
          run: spring-boot-sample
      spec:
        containers:
        - image: ${IMAGE}
          name: app
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: spring-boot-service
    labels:
      test: test
      labele2: label
  spec:
    ports:
      - name: http
        port: 8080
        protocol: TCP
        targetPort: 8080
      - name: https
        port: 443
        protocol: TCP
        targetPort: 443
    selector:
      run: spring-boot-sample
    sessionAffinity: None
    type: ClusterIP

Prepare an Istio application

In Alibaba Cloud Container Service for Kubernetes (ACK), after creating a cluster and deploying the Istio components, deploy your application. Then, use the console to create a VirtualService, such as sample-svc, and associate it with your v1 application instance.

Add a blue-green release task to a pipeline

After creating a pipeline and configuring the image build, add the Kubernetes Blue-Green Release task using the task wizard.

In the Select Task Group dialog box, select Deploy from the categories on the left, and then select Kubernetes Blue-Green Release from the card list on the right.

In the blue-green deployment configuration, configure the release cluster and target service. Before deploying, ensure that the Istio components are correctly installed on the target cluster and that the associated namespace has Istio auto-injection enabled:

In the Kubernetes Blue-Green Release task editing panel, configure Kubectl Version (for example, v1.16.4), Namespace (for example, default), Service Name (for example, sample-svc), Container Name (for example, sample), Image (for example, with the tag ${DATETIME}), Canary Traffic Cookie Identifier (for example, ^(.*?;)?(canary=true)(;.*)?$), and Initial Traffic Weight for the Canary Version (for example, 0%).

By setting the Canary Traffic Cookie Identifier, you can use a cookie to access the new environment to validate its functionality. The initial traffic weight for the canary version directs a portion of production traffic to the new environment upon release. For applications with a long startup time, you can set a startup wait time to ensure that the traffic rules for the new version take effect only after the application has fully deployed and the specified wait time has passed.

Trigger a blue-green deployment

Running the pipeline triggers the blue-green deployment process.

After the pipeline starts, it executes the Alibaba Cloud Image Build and Kubernetes Blue-Green Release stages sequentially. After the image is built successfully, the blue-green release task enters a canary validation state. At this point, click More below the task to expand the Rollback, Complete, and Logs actions.

You can use the cookie identifier to access the new environment for verification. After successful verification, click Complete to switch to the new application. If verification fails, click Rollback to cancel the release.

The pipeline includes the Alibaba Cloud Image Build and Kubernetes Blue-Green Release stages. Upon successful completion, the pipeline's status is displayed as Publish Complete.

During the release process, you can also view the current traffic policies in Alibaba Cloud Container Service for Kubernetes.

On the details page for the sample-svc service, the Version Management area shows that for version v1 (workload: sample, instances: 1), the canary policy sets the traffic proportion to 100%. For the new version v20200518172159 (instances: 1), the traffic proportion is 0%. This confirms that after the blue-green deployment is triggered, all traffic remains routed to the original version.