Deployment strategies and safe releases

A green CI pipeline means the artifact is fit to try. Deployment is how that artifact replaces what is running. Release is when users actually experience the change. Teams that merge these ideas either ship rarely, because every deploy feels like a launch, or break production, because every merge reaches 100% of users at once. Safe delivery keeps the two apart, shifts traffic gradually and always keeps a way back.

The same ideas apply whether you run Kubernetes, ECS, Cloud Run or plain VMs.

The concept pages

Mobile and client releases

Mobile apps and desktop clients are not rolled back with a load balancer. Users stay on old versions for weeks. Four habits help.

• Staged store rollouts catch crashes before the release reaches everyone.
• Server-side kill switches and remote config disable a bad feature without waiting for store review.
• Backwards-compatible APIs for several versions back, through versioning or tolerant readers.
• Server-driven flags for risky behaviour, so the fix does not wait for an app review.

Progressive delivery tools

Start with what your platform already offers. Add an automation tool when humans become the bottleneck for every percentage change.

Common mistakes

• A canary that shares a poisoned global cache with the baseline. The comparison then tells you nothing.
• Bake times too short for the traffic. Low-traffic services need longer bakes or bigger canaries.
• Blue-green sharing one database with incompatible writers. The flip does not migrate the schema.
• Rolling updates with maxUnavailable: 50% on a two-pod service. Half the capacity disappears during each step.
• Feature flags that default to on in production. New code reaches everyone before anyone has checked it.

Key takeaways

• Separate deploy from release. Flags and traffic splits are different levers.
• Rolling is simple, canary limits blast radius, and blue-green makes the cutover fast.
• Automate the canary gates on errors and latency, with real bake times.
• Make every binary change rollback-safe, and use expand and contract for schemas.
• Mobile and client changes need staged rollouts, kill switches and long API compatibility.

Further learning

Clare Liguori from AWS explains hands-off pipelines, one-box deploys, bake time and automatic rollback.

Steve McGhee covers safe serverless deploys on Cloud Run, including CI/CD, fast rollback and canaries.

Automating safe, hands-off deployments (Amazon Builders' Library) and Canarying Releases (Google SRE Workbook) cover the same ideas in writing.

Next, start with the distinction that makes all of this possible: deploy vs release.