Stage 5 · Platform
Progressive Delivery Controllers
Flagger Canaries
Configuring Flagger Canary resources, Prometheus checks, webhooks, and service mesh traffic shifts.
Flagger Overview
Flagger is a progressive delivery tool that automates the promotion of canary deployments. It works with Kubernetes deployments and service meshes (Istio, Linkerd, NGINX) to gradually shift traffic while monitoring metrics. If the canary degrades, Flagger automatically rolls back.
Flager watches the primary resource (Deployment, DaemonSet) and creates a Canary resource. It manages the canary replica set, adjusts traffic weights, and runs analysis checks. When analysis passes, the primary resource is updated with the new version.
Canary Resource
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
name: myapp
namespace: production
spec:
targetRef:
apiVersion: apps/v1
kind: Deployment
name: myapp
progressDeadlineSeconds: 600
service:
port: 8080
targetPort: 8080
gateways:
- myapp-gateway
hosts:
- myapp.example.com
trafficPolicy:
tls:
mode: DISABLE
analysis:
interval: 1m
threshold: 5
maxWeight: 50
stepWeight: 10
metrics:
- name: request-success-rate
thresholdRange:
min: 99
interval: 1m
- name: request-duration
thresholdRange:
max: 500
interval: 1m
webhooks: []The Canary resource targets a Deployment. analysis defines the progressive delivery strategy: start at 10% traffic, increase by 10% each minute, with a maximum of 50%. If success rate drops below 99% or latency exceeds 500ms, the canary is rolled back.
Analysis Metrics
analysis:
metrics:
# HTTP success rate
- name: request-success-rate
thresholdRange:
min: 99
interval: 1m
# HTTP latency (p95)
- name: request-duration
thresholdRange:
max: 500
interval: 1m
# Custom Prometheus query
- name: error-rate
templateRef:
name: prometheus-query
namespace: flagger-system
thresholdRange:
max: 1
interval: 1m
# Custom metric with labels
- name: db-connections
thresholdRange:
min: 1
max: 100
interval: 5m
# Canary weight
- name: canary-weight
thresholdRange:
max: 50
interval: 1mFlagger supports built-in metrics (request-success-rate, request-duration) and custom Prometheus queries. Each metric has a threshold range and interval. The canary progresses only when all metrics are within thresholds.
Webhooks
analysis:
webhooks:
# Load testing during canary
- name: load-test
url: http://flagger-loadtester.flagger-system/
timeout: 15s
metadata:
type: bash
cmd: "hey -z 1m -q 10 -c 2 http://myapp-canary.production:8080/"
# Slack notification
- name: slack-notification
url: https://hooks.slack.com/services/xxx
timeout: 5s
metadata:
type: json
cmd: |
{
"text": "Canary {{ namespace }}/{{ target }} {{ .Status }}
Weight: {{ .Weight }}",
"channel": "#deployments"
}
# Custom validation webhook
- name: validate-api
url: http://validation-webhook:8080/validate
timeout: 10s
metadata:
type: jsonWebhooks run at each analysis step. The load-test webhook generates traffic during the canary. The Slack notification sends deployment status. Custom validation webhooks can check API compatibility or data integrity.
Traffic Shifting
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
name: myapp
spec:
targetRef:
apiVersion: apps/v1
kind: Deployment
name: myapp
service:
port: 8080
gateways:
- myapp-gateway
hosts:
- myapp.example.com
analysis:
interval: 2m
threshold: 3
maxWeight: 100
stepWeight: 20
metrics:
- name: request-success-rate
thresholdRange:
min: 99
interval: 1m
webhooks: []stepWeight: 20 means traffic increases by 20% at each step: 20%, 40%, 60%, 80%, 100%. maxWeight: 100 allows full promotion. With Istio, Flagger creates VirtualService and DestinationRule resources to manage traffic splitting.
Rollback Behavior
- Metric threshold breach — success rate drops below 99% or latency exceeds 500ms.
- Webhook failure — a custom webhook returns a non-2xx status code.
- Progress deadline exceeded — the canary does not reach the target weight within the deadline.
- Manual intervention — run kubectl annotate canary/myapp flagger.app/abort=true.
The Flagger load tester generates synthetic traffic during the canary. This ensures the canary receives realistic load for metric analysis. Without load testing, the success rate metric may not have enough data points.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.