🔵 Blue-green deployment on Kubernetes

Two deployments — switch Service selector or Ingress weight for zero-downtime cutover. · ~45 min

Reviewed: ·Tested on: Kubernetes 1.29, Terraform 1.8, Ubuntu 22.04

If you're on Kubernetes 1.27 or older

  • Ingress: networking.k8s.io/v1 is required — v1beta1 removed in 1.22+
  • Pod Security: PodSecurityPolicy removed in 1.25 — use Pod Security Admission (PSA) labels
  • HPA v2 autoscaling/v2 is stable — check API version in manifests

If you're on Kubernetes 1.28

  • Sidecar containers (1.29+) change init-container ordering — review sidecar docs before upgrade
  • Verify metrics-server and HPA after control plane bump

If you're on Terraform 1.7 or older

  • S3 native locking (use_lockfile) differs from DynamoDB — don't mix backends mid-migration
  • Provider version constraints: run terraform init -upgrade after bump
  • terraform test (1.6+) replaces some external test harness patterns

1. Blue deployment (current prod)

kubectl apply -f k8s/deployment-blue.yaml
kubectl label deploy/myapp version=blue -n apps --overwrite
Config →

2. Deploy green (new version)

kubectl apply -f k8s/deployment-green.yaml
kubectl rollout status deploy/myapp-green -n apps
kubectl run curl --rm -it --image=curlimages/curl -- curl -s http://myapp-green.apps.svc/health

3. Switch Service selector to green

kubectl patch svc myapp -n apps -p '{"spec":{"selector":{"version":"green"}}}'
curl -I https://app.example.com/health
Config →

4. Rollback — patch selector back to blue

kubectl patch svc myapp -n apps -p '{"spec":{"selector":{"version":"blue"}}}'
kubectl delete deploy myapp-green -n apps
Guide →

Related runbook: Open runbook →