Google Cloud Architecture Center

Ideas you will meet

Distributed Systems

Consensus, time, failure and the fundamentals of scale-out.

Deployment

Releases, feature flags, rollbacks and continuous delivery.

What we already know about this

Our own lessons on these ideas. Read them here before you start, so it makes sense.

• Core Concepts: How Things Actually Work · 8 minDeployment strategiesRolling, blue-green, canary and feature flags: how to release changes with less risk, including database changes.Read hereClose

  Why strategy matters

  Most outages follow a change. A good deployment strategy limits the blast radius and makes rollback fast.

  The main strategies

  Recreate (big bang)

  Stop the old version, start the new one. Simple, but there is downtime and no easy rollback.

  Rolling update

  Replace instances a few at a time. No downtime and little extra capacity, but for a while both versions serve traffic, so they must be compatible. Rollback means rolling back the same way.

  Blue-green

  Run two identical environments. Blue serves live traffic; deploy to green, test it, then switch the router to green. Rollback is flipping back. Cost: double the capacity during the switch, and shared state (databases) still needs care.

  Canary

  Send a small share (1%, 5%, 25%...) of traffic to the new version, watch the metrics, then widen. If errors rise, roll back automatically. Needs good monitoring and traffic splitting.

  100%

  Figure SDA-CORE-12-1 · Canary · © forcsguy.com

  Feature flags

  Ship code switched off, and enable it for chosen users (or a percentage) at runtime. It separates deploying from releasing, and gives an instant kill switch. Remove old flags to avoid clutter.

  100%

  Figure SDA-CORE-12-2 · Four ways to put a new version live · © forcsguy.com

  Before: release to everyone at once

  100%

  After: canary: a few users first

  100%

  What changed

  • A bad release reaches few users before it is caught
  • Rolling back means shifting traffic back, not redeploying
  • You compare error rates between old and new

  Databases are the hard part

  Code can roll back instantly; data cannot. Use expand and contract:

  1. Expand: add new columns or tables, compatible with the old code.
  2. Deploy code that works with both shapes and writes to both if needed.
  3. Migrate data (backfill in batches).
  4. Contract: remove the old structure in a later release.

  Never combine a destructive schema change with the code that depends on it in one step.

  Checklist for safer releases

  • Automated tests and a staging environment that resembles production.
  • Health checks and automatic rollback on failure.
  • Monitoring on error rate and latency, watched during rollout.
  • Small, frequent changes over large, rare ones.
  • A written, practised rollback plan.

  More on this site

  Related reading

  • Blue Green DeploymentMartin FowlerBlogs
  • Ensuring rollback safety during deploymentsAmazon Builders' Library · Amazon Web ServicesBlogs
  • Feature Toggles (aka Feature Flags)Pete Hodgson · Martin FowlerBlogs
  • Going faster with continuous deliveryAmazon Builders' Library · Amazon Web ServicesBlogs

  Show 6 moreShow fewer

  • Online migrations at scaleJacqueline Xu · StripeCase Studies
  • Continuous Integration and Deployment with Bazel at DropboxDropbox engineers · DropboxCase Studies
  • HashiCorp BlogHashiCorp engineers · HashiCorpBlogs
  • Software Engineering at GoogleTitus Winters, Tom Manshreck and Hyrum Wright · O'Reilly / GoogleBooks
  • Scaling iOS CI with Anka at ShopifyShopify engineers · ShopifyCase Studies
  • Mozilla Release EngineeringMozilla Release Engineering engineers · Mozilla Release EngineeringBlogs

  Open this lesson with its quiz and exercise

• Advanced Distributed Systems · 13 minKubernetes essentialsPods, deployments, services, ingress and operators: the building blocks of the most common container platform and how a request reaches a pod.Read hereClose

  What Kubernetes does

  Kubernetes (K8s) runs containers across a cluster of machines. You describe the desired state (for example "three copies of this image, reachable at this address") and controllers continuously make reality match it: restarting failed containers, replacing lost nodes and rolling out new versions. (Containers themselves are introduced in the cloud models lesson.)

  The cluster

  • Control plane: the API server (everything talks to it), etcd (the consistent store of cluster state, built on Raft; see the consensus lesson), the scheduler (decides which node runs a pod) and controllers (reconcile desired and actual state).
  • Nodes: machines that run pods, each with a node agent (kubelet), a container runtime and a networking component.

  The core objects

  100%

  Figure SDA-ADS-07-1 · From request to pod · © forcsguy.com

  Object	Purpose
  Pod	Smallest unit: one or more containers sharing network and volumes
  ReplicaSet / Deployment	Keep N pods running; roll out updates and roll back
  Service	Stable virtual IP and DNS name that load balances to matching pods
  Ingress	HTTP routing from outside to services (host, path, TLS), handled by an ingress controller
  ConfigMap / Secret	Configuration and sensitive values injected as environment variables or files
  StatefulSet	Pods with stable identity and storage, for databases and brokers
  DaemonSet	One pod per node (log shippers, agents)
  Job / CronJob	Run to completion, once or on a schedule
  Namespace	Logical separation of resources and quotas
  PersistentVolume(Claim)	Durable storage requested by pods

  Networking in one paragraph

  Every pod gets its own IP and can reach every other pod without NAT. Because pods are short-lived, clients use Services (found through cluster DNS such as orders.shop.svc). Network policies restrict which pods may talk to which. An Ingress (or the newer Gateway API) handles external HTTP(S) traffic.

  A deployment and a rolling update

  apiVersion: apps/v1
  kind: Deployment
  metadata: { name: web }
  spec:
    replicas: 3
    selector: { matchLabels: { app: web } }
    strategy: { type: RollingUpdate, rollingUpdate: { maxSurge: 1, maxUnavailable: 0 } }
    template:
      metadata: { labels: { app: web } }
      spec:
        containers:
          - name: web
            image: example/web:1.4.2
            resources: { requests: { cpu: 200m, memory: 256Mi }, limits: { memory: 512Mi } }
            readinessProbe: { httpGet: { path: /healthz, port: 8080 } }
  

  100%

  Figure SDA-ADS-07-2 · Rolling update · © forcsguy.com

  Probes: readiness decides if a pod receives traffic; liveness decides if it should be restarted; startup gives slow starters time. Requests and limits tell the scheduler how much CPU and memory a pod needs and cap what it can use.

  Autoscaling

  A Horizontal Pod Autoscaler adds or removes pods by metrics such as CPU or request rate; a cluster autoscaler adds or removes nodes when pods cannot be placed. Scaling is useless without correct resource requests.

  Extending Kubernetes: operators and CRDs

  A Custom Resource Definition (CRD) adds a new object type (for example PostgresCluster). An operator is a controller that watches those objects and does the operational work (create replicas, take backups, fail over), encoding human runbooks as code. Many databases and brokers ship operators.

  Things that often go wrong

  Missing readiness probes (traffic to pods not ready), no resource requests (noisy neighbours, evictions), latest image tags (unrepeatable deploys), secrets in plain config, a single replica for a critical service, and running stateful systems without understanding storage and failure behaviour.

  Real-world reading

  Related reading

  • TechWorld with Nana: Docker & KubernetesNana Janashia · TechWorld with NanaYouTube
  • AWS Containers BlogAmazon Web Services engineers · Amazon Web ServicesBlogs
  • Awesome KubernetesRamit Surana · ramitsuranaGitHub
  • Kubernetes ConceptsKubernetes Authors · CNCF / KubernetesDocumentation

  Show 6 moreShow fewer

  • Kubernetes: IngressKubernetes · CNCF / KubernetesDocumentation
  • Docker BlogDocker engineers · DockerBlogs
  • DevOps Roadmaproadmap.sh community · roadmap.shCourses
  • Kubernetes BlogKubernetes community · CNCF / KubernetesBlogs
  • From bare-metal to Kubernetes at BetabrandBetabrand engineers · BetabrandCase Studies
  • Large-scale cluster management at Google with Borg (paper)Verma et al. · GooglePapers

  Open this lesson with its quiz and exercise

• Messaging and Microservice Patterns · 13 minOperating microservices: config, secrets, feature flags, tracing and loggingThe operational toolkit around a service: configuration and secrets done safely, feature flags for controlled releases, and traces and logs that follow a request across services.Read hereClose

  Configuration

  Separate configuration from code. Anything that changes between environments (database address, feature limits, endpoints) should come from environment variables, config files or a config service, not be baked into the build ("build once, run anywhere").

  • Keep defaults in code and overrides in the environment.
  • Validate configuration at start-up and fail fast with a clear message.
  • For values that must change at runtime, use a config service or watch a mounted file, and treat changes like deployments (versioned, reviewed, auditable).
  • Keep config in version control (as code or templates) so changes are reviewed and reversible.

  Secrets

  Secrets (passwords, API keys, private keys, tokens) need stricter handling.

  • Never commit them, put them in images, or print them in logs.
  • Store them in a secrets manager (a cloud service, HashiCorp Vault, or an encrypted platform secret store) with access control, audit logs and encryption at rest.
  • Inject at runtime (environment, mounted file or an agent), and use short-lived credentials where possible (cloud roles, dynamic database credentials).
  • Rotate regularly and after any suspected leak; design services to reload secrets without downtime.
  • Least privilege: each service gets only its own secrets.

  Feature flags

  A feature flag is a runtime switch controlling whether code runs, separate from deployment.

  100%

  Figure SDA-MSV-05-1 · Deploy is not release · © forcsguy.com

  Uses: gradual rollout, kill switches for risky features, A/B tests, per-customer entitlements, and decoupling release from deploy (see the deployment strategies lesson). Cautions: flags multiply test combinations, can be left in place forever, and a flag service outage must fail to a safe default.

  Distributed tracing

  A request through a microservice system touches many services. A trace records the whole journey as a tree of spans (one per operation), joined by a trace id passed in request headers.

  100%

  Figure SDA-MSV-05-2 · One request traced across services · © forcsguy.com

  • OpenTelemetry is the vendor-neutral standard for instrumentation (traces, metrics, logs) and the W3C Trace Context header standardises propagation.
  • Propagate the id through every hop, including message queues (put it in message headers).
  • Add useful attributes (user type, order size) but never secrets or personal data.
  • Sampling: keep all errors and slow traces, a small share of the rest.

  Centralised logging

  Logs written on many short-lived instances are useless unless shipped to one searchable place.

  • Write structured logs (JSON with fields: time, level, service, trace id, message, key attributes) to standard output; let the platform collect them.
  • Ship to a central system (the ELK/OpenSearch stack, Loki, Splunk, cloud logging).
  • Always include the trace id so logs and traces connect.
  • Set levels sensibly; avoid logging personal data and secrets; set retention by value and legal need.
  • Alert on log-derived signals sparingly; prefer metrics for alerting.

  Health checks

  Expose liveness (the process is alive; restart if not), readiness (ready to take traffic; remove from rotation if not) and optionally startup endpoints. Readiness should check what the service truly needs without cascading (a failing optional dependency should degrade, not mark the service unready for everyone).

  A minimum for every service

  A health endpoint, structured logs with trace ids, the standard metrics (request rate, errors, latency, saturation), propagated trace headers, config and secrets from the environment, and a runbook. The next lesson turns these signals into targets and alerts.

  Real-world reading

  Related reading

  • Feature Toggles (aka Feature Flags)Pete Hodgson · Martin FowlerBlogs
  • DevOps Roadmaproadmap.sh community · roadmap.shCourses
  • Ensuring rollback safety during deploymentsAmazon Builders' Library · Amazon Web ServicesBlogs
  • Dapper: a Large-Scale Distributed Systems Tracing Infrastructure (paper)Sigelman et al. · GooglePapers

  Show 6 moreShow fewer

  • Blue Green DeploymentMartin FowlerBlogs
  • The Twelve-Factor AppAdam Wiggins · 12factor.netDocumentation
  • XCMetrics: All-in-One Tool for Tracking Xcode Build Metrics at SpotifySpotify engineers · SpotifyCase Studies
  • Going faster with continuous deliveryAmazon Builders' Library · Amazon Web ServicesBlogs
  • Unicorn: Remediation System at eBayeBay engineers · eBayCase Studies
  • Distributed Tracking, Tracing, and MeasuringOreilly engineers · OreillyCase Studies

  Open this lesson with its quiz and exercise