Flagger: Progressive Delivery for Kubernetes
Flagger is an automated traffic cop for Kubernetes releases. It gradually shifts traffic to new versions while monitoring metrics, enabling safe canary or blue/green deployments with service meshes or ingress controllers.
Why it exists
Standard Kubernetes rollouts can be an all-or-nothing risk. A single buggy deployment can bring down a critical service. Progressive delivery was created to de-risk this process by making releases gradual, observable, and automated.
The mental model
Think of Flagger as an automated SRE for your deployments. It watches for a new container image, then starts a controlled experiment: it diverts a small percentage of users to the new version, watches key metrics like error rates and latency, and runs tests. If all looks good, it slowly increases traffic. If not, it automatically rolls back, all without human intervention.
How it works
Flagger is a Kubernetes operator configured via a Custom Resource. You define a 'Canary' object specifying the deployment to watch, the traffic-shifting steps (e.g., 'increase by 10% every 5 minutes'), and success criteria (e.g., 'request success rate > 99%'). Flagger then manipulates a service mesh (like Istio) or an ingress controller (like NGINX) to split traffic. It queries a monitoring system (like Prometheus or Datadog) to validate the release against your criteria. If metrics degrade at any point, Flagger aborts the rollout and reverts traffic to the stable version.
When to use it
Use Flagger for critical, high-traffic services in Kubernetes where you need to eliminate deployment-related downtime. It's especially powerful in a GitOps workflow, where a code merge can trigger a fully automated, safe rollout managed by Flagger.
When not to use it
For simple, non-critical applications or early-stage development environments, the overhead of setting up Flagger, a service mesh, and a monitoring stack may be overkill. A standard Kubernetes rolling update is often sufficient in these cases.
One canonical example
A team uses Flux CD for GitOps. A developer's commit triggers a CI pipeline to build a new image. Flux updates the Kubernetes Deployment with the new image tag. Flagger, watching this deployment, intercepts the change. It provisions a canary version, uses Istio to route 5% of traffic to it, and queries Prometheus for 5 minutes. If error rates are low, it increases traffic to 25%, then 50%, and finally 100%, at which point it promotes the canary and decommissions the old version.
Interview question
Which of the following best describes Flagger's core approach to ensuring safe progressive delivery in Kubernetes?
- a.It creates a dedicated, isolated staging environment for each new release to run extensive end-to-end tests.
- b.It performs comprehensive security scans and vulnerability checks on new container images before they are deployed.
- c.It requires manual sign-off from a designated operations team at every incremental traffic increase to prevent regressions.
- d.It automates the gradual shifting of live user traffic to a new version, continuously validating its health against predefined metrics.Correct
Why? this is the answer
Flagger's primary function is to act as an automated SRE, gradually shifting live user traffic to a new version while continuously monitoring key performance metrics to validate its stability. Option C is a tempting distractor, as manual approval is a common safety measure, but Flagger's core value is its automation, explicitly designed to operate 'without human intervention'.
Just read this? Test yourself on what you have been reading.
Read the original → docs.flagger.app
- #kubernetes
- #ci/cd
- #gitops
- #progressive delivery
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on kubernetes — each one lists the topics its interview covers.
See open roles