What is a best practice for canary deployment safety?

What is a best practice for canary deployment safety?

• A. Validate predefined metrics and enable automatic rollback on failure
• B. Roll back only after manual confirmation
• C. Disable monitoring during deployment
• D. Proceed regardless of performance

Answer: (B)

In canary deployments, safety comes from automatic, rapid response to problems rather than waiting for a person to decide. The best practice is to validate predefined metrics and enable automatic rollback on failure. This means you set measurable signals—like error rate, latency, or throughput—and define clear thresholds that, when breached, trigger a rollback to the previous stable version without human intervention. This approach minimizes the blast radius, reduces recovery time, and removes the delays and variability that come with awaiting manual approval. Keeping monitoring active throughout the rollout is essential so the system can detect issues promptly. Manual confirmation before rolling back introduces latency and human error, which can let problems affect more users before reversal. Disabling monitoring or proceeding regardless of performance undermines safety and visibility, making it harder to protect users during the rollout.

In canary deployments, safety comes from automatic, rapid response to problems rather than waiting for a person to decide. The best practice is to validate predefined metrics and enable automatic rollback on failure. This means you set measurable signals—like error rate, latency, or throughput—and define clear thresholds that, when breached, trigger a rollback to the previous stable version without human intervention. This approach minimizes the blast radius, reduces recovery time, and removes the delays and variability that come with awaiting manual approval. Keeping monitoring active throughout the rollout is essential so the system can detect issues promptly. Manual confirmation before rolling back introduces latency and human error, which can let problems affect more users before reversal. Disabling monitoring or proceeding regardless of performance undermines safety and visibility, making it harder to protect users during the rollout.