How do I do a canary or blue-green deployment?

Short answer

For Canary, the new version is added as a separate Backend Service and a small share of the traffic is given to it: with Weight (Algorithm = Weighted Round Robin is required), with a Dynamic Condition with the Random Number variable, or with a condition that selects only specific users. In a Blue-green switchover, two environments are kept ready and the traffic is switched in a single move: by turning Maintenance Mode on and off, or by changing the Default Backend Services list of the vService. Before the new version is opened to users, it can be tried with a copy of the real traffic using Traffic Mirroring; Backup Service, in turn, returns the traffic to the old version if the new version becomes unreachable.

Problem: The New Version Must Go Live Without Taking Risks

Opening a new version to all users at once affects everyone when there is a bug. In the canary approach, the new version is first opened to a small part of the traffic and the share is increased gradually; in the blue-green approach, two environments are kept ready and the traffic is switched to the new environment in a single move, and if there is a problem, it is reverted just as fast. In TR7, both approaches are set up with Backend Service settings and Conditional Backend Services (Content Switching); no additional configuration is required on the Backend Service side.

Solution: Seven Methods

The methods can also be used together: for example, the new version is first tried with Traffic Mirroring, then opened gradually with Weight.

Your situation	Suitable method
Gradual share (canary), the user can be pinned	Method 1: Weight
Percentage per request (canary)	Method 2: Dynamic condition + Random number
Only beta users (canary)	Method 3: Targeted condition
Trying without opening to users	Method 4: Traffic Mirroring
Switchover in a single move (blue-green)	Method 5: Maintenance Mode
Switchover by changing the target (blue-green)	Method 6: Changing the Default Backend Services list
Automatic fallback if the new version goes down	Method 7: Backup service

Method 1: Gradual Canary with Weight Recommended

• How it works Backend Services receive traffic in proportion to Weight; the share of the new version is grown gradually by increasing its Weight value.
• Where it is openedLoad Balancer → Backend Services → Weight · vService → LB Algorithm → Algorithm
• Requirement Algorithm = Weighted Round Robin (the default Round Robin ignores Weight values)
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Define the new version

A Backend Service is created for the new version with Load Balancer → Backend Services → Add; Backend Service Name and Address (the IP and port of the new version's server, e.g. 192.0.2.21:8080) are entered, a Health Check profile is selected, and it is saved with Add (How is a Backend Service added; which information is required?).

2

Adım 2 Set the Weight

In each of the two Backend Services in turn, Edit is used to enter a share in the Weight field (1–256), and it is saved with Edit; for example, old version 99, new version 1 → the new version receives about 1%. For servers in a Backend Group, the same field is found at the server level.

3

Adım 3 Open the vService form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

4

Adım 4 Select the targets and the algorithm

Both Backend Services are added to the Default Backend Services list; in the LB Algorithm section, Algorithm = Weighted Round Robin is selected. In a Network vService, its counterpart is Weighted Round-Robin.

5

Adım 5 Pin the user (optional)

For a user who lands on the canary to stay there, Persistence = New cookie is selected in the HTTP vService.

6

Adım 6 Save the vService

The vService is saved with Save. If no problem is seen, the Weight value of the new version is raised step by step; each change is saved with Edit on the Backend Service.

Verification

1DistributionTR7 side

In the Left Monitor Panel, the vService is opened and the Backend Service column is checked on the HTTP Logs screen in the Logs & Tracking tab; for HTTP Logs, a Logs profile must be assigned to the vService.

ExpectedRequests distributed in proportion to Weight

2ResponsesTR7 side

HTTP Response Codes is monitored on the Backend Service dashboard of the new version.

ExpectedNo increase in error responses on the new version

Method 2: Dynamic Condition + Random Number

• How it works For each request, a number between 0 and Random max. − 1 is generated; if the number is below the threshold, the request goes to the new version. The decision is made per request; the user is not pinned.
• Where it is openedLoad Balancer → Conditions → Dynamic Condition · vService → + Conditional backend services
• Requirement HTTP or L7 TCP vService
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add (how to add).

2

Adım 2 Define the condition

Condition Name is entered, and Criteria = Dynamic Condition is selected. In the Query Key field, the Random number variable is selected with fx and Random max. = 100 is entered; Operator = Integer less than and Integer to compare = 10 are entered. Since the generated number is between 0 and 99, requests match at a rate of about 10%.

3

Adım 3 Save the condition

The condition is saved with Add.

4

Adım 4 Define the new version (if needed)

If the new version is not yet a Backend Service in TR7, Backend Service Name, Address and Health Check are entered with Load Balancer → Backend Services → Add, and it is saved with Add (How is a Backend Service added; which information is required?).

5

Adım 5 Add the block

The vService is opened with Edit; + Conditional backend services above the Default Backend Services table is clicked. The condition is selected in the Select Conditions field of the block, and the new version in the Backend Services table.

6

Adım 6 Save the vService

The vService is saved with Save; requests that do not meet the condition continue to go to Default Backend Services.

Verification

1DistributionTR7 side

In the Left Monitor Panel, the vService is opened and the Backend Service column is checked on the HTTP Logs screen in the Logs & Tracking tab.

ExpectedAbout 10% of requests on the new version

Method 3: Targeted Canary

• How it works Only requests that carry a specific header, cookie or source address are sent to the new version.
• Where it is openedLoad Balancer → Conditions → HTTP Header / User Cookie Name / Source IP · vService → + Conditional backend services
• Requirement HTTP vService (the Source IP condition can also be used in L7 TCP)
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add (how to add).

2

Adım 2 Define the condition

Condition Name is entered and the criterion that separates the beta users is selected: e.g. an HTTP Header condition with Header Name = X-Canary and matching Is present, a User Cookie Name condition that looks for the cookie named beta, or Source IP (Manual) for internal network addresses.

3

Adım 3 Save the condition

The condition is saved with Add.

4

Adım 4 Define the new version (if needed)

If the new version is not yet a Backend Service in TR7, it is defined with Load Balancer → Backend Services → Add (How is a Backend Service added; which information is required?).

5

Adım 5 Add the block

The vService is opened with Edit; a block is added with + Conditional backend services, and the condition and the new version are selected.

6

Adım 6 Save the vService

The vService is saved with Save.

Verification

1Targeted requestClient side

One request with the header and one without it are sent (e.g. curl -H "X-Canary: 1" https://www.example.com/); on the HTTP Logs screen, the Backend Service the requests went to is checked.

ExpectedRequest with header → new version · without header → Default backend services

Method 4: Pre-Testing with Traffic Mirroring

• How it works A copy of the real requests is sent to the new version; the response of the copy is discarded, and the user always receives the response from the current version.
• Where it is openedLoad Balancer → Actions → Traffic Mirroring
• Requirement HTTP vService; the target is a single Backend Service
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Define the target Backend Service (if needed)

If the new version to which the copy will be sent is not yet a Backend Service in TR7, it is defined with Load Balancer → Backend Services → Add (How is a Backend Service added; which information is required?). Mirror Target Service accepts only a single Backend Service; a Backend Group cannot be selected.

2

Adım 2 Open the action form

Load Balancer → Actions → Add is clicked.

3

Adım 3 Define the action

Action Name is entered, Action Type = Traffic Mirroring is selected, and the new version is selected in the Mirror Target Service field (shadow testing).

4

Adım 4 Save the action

The action is saved with Add.

5

Adım 5 Bind to the vService

The vService is opened with Edit; the action is selected in the Details → Actions field.

6

Adım 6 Save the vService

The vService is saved with Save.

Verification

1MirroringTR7 side

The Mirrored/s, Skipped/s and Dropped/s values are checked in the Traffic Mirroring section on the Live Stats screen of the vService (monitoring the mirroring).

ExpectedMirrored/s > 0

Method 5: Blue-Green with Maintenance Mode

• How it works A Backend Service in Maintenance Mode does not receive new traffic; the traffic is switched in a single move by swapping the Maintenance Mode status of the two environments.
• Where it is openedLoad Balancer → Backend Services → Edit → Maintenance Mode
• Requirement Blue and Green in the same Default Backend Services list
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Define Green (if needed)

If the new environment (Green) is not yet a Backend Service, Backend Service Name, Address and Health Check are entered with Load Balancer → Backend Services → Add; Maintenance Mode is checked and it is saved with Add. This way, it does not receive traffic when it is added to the list (How is a Backend Service added; which information is required?).

2

Adım 2 Add both environments to the list

The vService is opened with Edit; Blue and Green are added to the Default Backend Services list and the vService is saved with Save. Since Maintenance Mode is on in Green, traffic goes only to Blue.

3

Adım 3 Turn Green on

The Green Backend Service is opened with Edit, the Maintenance Mode check is removed, and it is saved with Edit. Once the health check succeeds, Green starts receiving traffic.

4

Adım 4 Turn Blue off

The Blue Backend Service is opened with Edit, Maintenance Mode is checked, and it is saved with Edit. The existing connections on Blue are not cut; they are left to complete; new connections go to Green. To go back, steps 3 and 4 are applied in the reverse direction.

Verification

1SwitchoverTR7 side

In the Load Balancer → Backend Services list, the maintenance icon is seen next to Blue's name; on the HTTP Logs screen, the Backend Service column of the new requests is checked.

ExpectedNew requests → Green

Method 6: Changing the Default Backend Services List

• How it works The Blue Backend Service or group in the Default Backend Services list of the vService is replaced with Green.
• Where it is opened vService → Edit → Default Backend Services
• Requirement Green defined as a separate Backend Service or Backend Group
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Define Green (if needed)

If Green is not yet defined in TR7, it is added as a Backend Service with Load Balancer → Backend Services → Add; if multiple servers are to be managed as a single target, a Backend Group is created with Load Balancer → Backend Groups → Add (How is a Backend Service added; which information is required?).

2

Adım 2 Open the vService form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

3

Adım 3 Change the list

Blue is removed from the Default Backend Services list and Green is added.

4

Adım 4 Save the vService

The vService is saved with Save. To go back, the list is restored to its previous state.

Verification

1SwitchoverTR7 side

The target is seen in the Backend Services section in the Load Balancer Management tab of the vService; on the HTTP Logs screen, the Backend Service the new requests go to is checked.

ExpectedNew requests → Green

Method 7: Safety Net with Backup Service

• How it works Green is kept as the main service and Blue as the backup; if all the main services of Green become unreachable, the traffic switches to Blue, and once Green is healthy again, the traffic returns to Green on its own.
• Where it is openedLoad Balancer → Backend Services → Backup Service
• Requirement A Health check profile must be assigned to Green; without a profile, unreachability is not detected
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Assign the health check profile

The Green Backend Service is opened with Edit; a profile is selected in the Health Check field (default No check), and it is saved with Edit. If there is no suitable profile, it is first created with Load Balancer → Profiles → Health Checks → Add (how to add).

2

Adım 2 Make Blue the backup

The Blue Backend Service is opened with Edit; Backup Service is checked and it is saved with Edit. Green remains a normal service.

3

Adım 3 Add both to the list

The vService is opened with Edit; Green and Blue are added to the Default Backend Services list and the vService is saved with Save.

Verification

1Normal stateTR7 side

On the HTTP Logs screen, the Backend Service the requests go to is checked; in the Backend Services list, the backup service icon is seen next to Blue's name.

ExpectedAll requests → Green

Common Mistakes

• Expecting Weight with the default algorithm. Round Robin, the default in new vServices, ignores Weight values; Weighted Round Robin must be selected.
• Thinking that the Random number split pins the user. The decision is made again on each request; in applications that require a session, Weight is used with New Cookie.
• Adding a block without a condition. A Conditional Backend Services block with an empty condition does not match any request.
• Mistaking a gradual weight change for blue-green. Blue-green is a switchover in a single move; gradually shifting the share is canary.
• Making the change separately on both devices in a cluster. Weight, Maintenance Mode and vService changes pass to the peer device on their own with the default auto-sync; Synchronize is needed only while Manual Sync Mode is on.

How it is done in the documentation

• Backend Services · Weight
• Backend Services · Maintenance Mode
• Backend Services · Backup Service
• Traffic Mirroring · Shadow Testing

Related questions

• Can I send only a certain percentage of traffic to a new version?
• Can I send a copy of the traffic to a test environment (Traffic Mirroring)?
• Can I route only users coming from the internal network (specific IPs) to a test server?