Mastering IngressRoute Cascade: Blue‑Green Deployments and Canary Releases

The previous article introduced the basic working principle of the Contour distributed architecture and a simple IngressRoute configuration. This continuation explores the more advanced capabilities of IngressRoute, especially the cascade feature.

Basic IngressRoute Example

A simple IngressRoute is defined in the examples/example-workload directory. It includes a virtualhost (the root IngressRoute) and an fqdn that specifies the full domain name, which can be accessed by setting the Host: header in an HTTP request.

To change the matching path, replace match: / with match: /test. Since the kuard service does not expose /test, the request initially fails. By adding a rewrite rule that maps /test back to /, the URL becomes reachable again.

Cascade Functionality

The cascade feature allows multiple IngressRoute objects to inherit configuration from a parent (root) IngressRoute. Child routes can reside in different namespaces, enabling hierarchical traffic management.

Example: creating a delegate IngressRoute without a valid fqdn results in an orphaned status. After applying a root IngressRoute that references the delegate, the delegate's status changes to valid and the service becomes accessible.

kubectl apply -f delegate-from-main.yaml
kubectl get ingressroute delegate-from-main -o jsonpath='{.status.currentStatus}'
# output: orphaned

Use Cases

Scenario 1: Use cascade for blue‑green deployments. Switching the parent IngressRoute’s configuration redirects traffic from the green (stable) version to the blue (new) version.

Scenario 2: Administrators can delegate specific route permissions to other namespaces, allowing fine‑grained control while keeping the root IngressRoute authoritative.

Blue‑Green Deployment

In a blue‑green setup, two complete environments run simultaneously: the green environment serves production traffic, while the blue environment is used for testing. After validation, traffic is switched to the blue environment, which then becomes the new green.

Using IngressRoute cascade, create a root IngressRoute (e.g., root-blog) with the domain yangcs.net/blogs, and cascade its routing rules to a child IngressRoute (e.g., blog) that points to either the green or blue service.

Canary Release

Canary (or gray) release gradually shifts a small portion of traffic to a new version. If no issues arise, the weight of the new version is increased until it reaches 100 %.

IngressRoute can implement canary by assigning traffic weights in the child routes. Adjust the green weight to 100 and the blue weight to 0 once the new version is verified.

In summary, the cascade feature of IngressRoute enables sophisticated traffic management patterns such as blue‑green deployments and canary releases, providing fine‑grained control over routing rules across namespaces.