03 — Deploy & Serve

A/B & Canary Rollouts#

DeploymentStatistical 1 min read
◆ The PatternShip models safely with progressive traffic splitting

Deploying a new model to 100% of traffic is reckless. Canary rollouts send a small fraction (1–5%) of traffic to the new model while monitoring metrics. Blue-green deploys keep the old version warm for instant rollback. A/B tests run both models simultaneously to measure real-world lift.

// Interactive — canary traffic split
Canary %5%
Rollback triggers: Define automatic rollback criteria before deploying — e.g., if p99 latency exceeds 200ms or error rate exceeds 1%, revert immediately.
Pattern bridge: Canary rollouts apply the same risk management as position sizing — start small, scale up only when evidence confirms safety. The Bayesian A/B framework from The Toolkit directly applies to evaluating canary metrics.
Worked example

To catch an error rate rising from 1.0% to 1.5% with the usual 5% significance and 80% power takes about 7,747 requests in each arm. With 100,000 requests a day and the canary on 5%, that is 1.5 days of canary traffic. A ten-minute canary on 1% of traffic can only catch outright breakage, not a regression of this size.

Where it misleads
  • Peeking at the canary every few minutes and stopping when it looks fine inflates false confidence; decide the sample size or use a sequential test.
  • Canary traffic is often not a random slice (one region, one client version), so the comparison can be confounded.
  • Business metrics such as conversion move slowly; a canary judged only on latency and errors can still ship a worse model.
In code
from scipy.stats import norm
p0, p1 = 0.010, 0.015                  # error rate today, and the regression we want to catch
alpha, power = 0.05, 0.80
z = norm.ppf(1 - alpha / 2) + norm.ppf(power)
n = z**2 * (p0 * (1 - p0) + p1 * (1 - p1)) / (p1 - p0) ** 2    # requests needed in each arm
daily = 100_000
days_at_5pct = n / (0.05 * daily)       # canary gets 5% of traffic
Python, in your browser — edit the code and run it again

Assumes import numpy as np and import pandas as pd. Each snippet carries its own example numbers; the comments say which are made up or simulated.

The same idea with a library
# Kubernetes canary with Istio traffic split
# VirtualService:
#   http:
#   - route:
#     - destination:
#         host: model-service
#         subset: stable
#       weight: 95
#     - destination:
#         host: model-service
#         subset: canary
#       weight: 5
Sources
  • Trustworthy Online Controlled Experiments, R. Kohavi, D. Tang & Y. Xu, Cambridge University Press, 2020
  • The Site Reliability Workbook, B. Beyer, N. R. Murphy, D. K. Rensin, K. Kawahara & S. Thorne (eds.), O’Reilly, 2018 — “Canarying Releases”

Last reviewed October 2026 · How this site checks its content · Report a mistake

Check yourself

1. A canary on 1% of traffic runs for an hour without alarms. Is the new model safe?

Show answer

C. A canary is a smoke test. Size and duration decide which failures it can possibly detect.

2. Why randomise an A/B test by user rather than by request?

Show answer

C. If one user sees both versions, their behaviour mixes the two and the comparison is contaminated.

3. You check an A/B test every day and stop as soon as it is significant. What is the problem?

Show answer

C. Use a fixed horizon or a sequential method designed for repeated looks.

Linked from 2
← Previous
Serving Patterns
Open in the full reader, with the topic sidebar