A canary with nobody watching
Releases go to five percent of traffic first, then to everyone twenty minutes later. It's called a canary and everyone feels safer.
Nothing looks at the five percent. The last bad release burned twenty minutes at five percent and then went to a hundred, and the rollback happened after a customer reported it.
Outside every boundary: Traffic, Current version (95%), Everyone (after 20 minutes), New version (5%; FAILED: unwatched), an empty slot for the between the canary and full rollout Connections: Traffic calls Current version (step 1) Traffic calls between the canary and full rollout — 5% (step 2) between the canary and full rollout calls New version (step 3) between the canary and full rollout controls Everyone — only if it's healthy (step 4)