Memory hook: Control exposure separately from deployment, and make rollback compatible with state.
Must remember
- Rolling replaces instances in batches; blue/green maintains separate environments; canary exposes a small share first; rings expand by user/cohort; A/B testing compares behaviour. Choose with capacity, state, risk and rollback constraints.
- Feature flags, including App Configuration feature-management capabilities, can decouple code deployment from feature exposure. Flags need owners, defaults, audit and retirement; they should not become permanent undocumented branches.
- App Service slots provide eligible staging/swap behaviour; mark sticky settings and validate warmup. Container deployments need probes, compatible image versions and traffic policy. A green startup probe is not proof the business workflow works.
- Database changes should support old/new code during the transition. Expand schema, migrate/backfill data, switch clients and contract only after rollback needs expire. A destructive column drop cannot be undone by redeploying the previous container.
- IaC provisions infrastructure; configuration management maintains supported machine/application settings. ARM/Bicep, Machine Configuration, Automation State Configuration and Deployment Environments have different scope/ownership. Review dependencies and desired-state drift.
- Hotfix paths should retain review, artifact identity, tests and audit while shortening unnecessary waiting. Define error-rate/latency/business-health gates and rollback actions. Capture incident feedback in tests/runbooks after recovery.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Release code but enable it for only one cohort | Feature flag/ring exposure. |
| Need rapid traffic rollback with spare capacity | Blue/green or eligible slot swap. |
| Old and new app versions overlap | Backward-compatible database migration sequencing. |
Traps
- A feature flag does not automatically secure the hidden endpoint.
- Rollback of binaries does not reverse data mutation.
- A canary without representative traffic is weak validation.
Active recall
1. What is the benefit of separating deployment and exposure?
Code can be deployed and validated before all users receive the feature.
2. Why retire old feature flags?
To reduce hidden states and long-term testing complexity.
3. What should a rollback alarm measure?
A meaningful service failure signal, including business outcomes where possible.
4. Why perform expand before contract?
To preserve compatibility during mixed-version operation and rollback.
5. What should a hotfix preserve?
Traceability, appropriate review/testing, controlled credentials and an identifiable artifact.