Progressive delivery
Stop exposure before investigating the release in depth
When a candidate is harming users, use the tested control to limit further impact. Preserve enough evidence to understand what already happened.
In this article
Confirm the affected release path
Identify the candidate build, exposure rule and affected workflow. Check whether the problem is limited to the candidate or shared with the stable service.
Use the predefined abort or feature-disable action when its conditions are met. Do not wait for a complete root-cause explanation while exposure continues to expand.
Record the action and time so later metrics can be interpreted against the actual traffic state.
Verify that exposure really stopped
Inspect requests through the normal entry point and confirm the candidate no longer receives the prohibited scope. A controller status alone may not reveal stale routing or a separate background worker.
Check in-flight operations and queues. Stopping new web traffic does not cancel work already accepted.
For a synthetic example, a candidate may have queued 500 document conversions before abort. Those jobs need a deliberate hold, drain or compatible worker path rather than being forgotten because the website now serves the stable build.
Preserve and reconcile effects
Capture operation identities and relevant versioned diagnostics. Keep sensitive payloads in controlled systems.
Determine whether the candidate produced incorrect data or external actions. Deployment rollback does not reverse those effects. Use the application's repair procedure and duplicate protection.
Avoid rerunning all failed requests with new operation identities. Some may have committed before their responses were lost.
Resume only with new evidence
Reproduce the fault safely, fix it and test the affected behaviour. Update the canary analysis if the previous signals failed to detect the issue promptly.
Choose a fresh rollout scope based on what the incident revealed. Reusing the same short observation window without addressing its blind spot adds little confidence.
Record the final service state and outstanding repair work for support. The incident can remain operationally incomplete after stable traffic is restored if affected customer records still need reconciliation.
Primary sources
Argo Rollouts: canary deploymentsReferences checked 11 September 2026.