Kubernetes Rollback-Strategien: Sichere Deployments für deutsche Unternehmen

Kubernetes Rollback Patterns
├── Manual Rollback
│   ├── kubectl rollback
│   ├── Helm rollback
│   └── GitOps rollback
├── Automated Rollback
│   ├── Health Check Rollback
│   ├── Performance Rollback
│   └── Error Rate Rollback
├── Blue-Green Deployment
│   ├── Traffic Switching
│   ├── Instant Rollback
│   └── Zero Downtime
├── Canary Deployment
│   ├── Gradual Rollout
│   ├── Traffic Splitting
│   └── Progressive Rollback
└── A/B Testing
    ├── Feature Flags
    ├── User Segmentation
    └── Data-Driven Rollback

# Rollback Decision Matrix
apiVersion: v1
kind: ConfigMap
metadata:
  name: rollback-strategy
data:
  strategy.yaml: |
    rollback_triggers:
      health_checks:
        - condition: "liveness probe failure"
          action: "immediate rollback"
          threshold: "3 failures"
        
        - condition: "readiness probe failure"
          action: "rollback after 5 minutes"
          threshold: "5 failures"
      
      performance_metrics:
        - condition: "response time > 2000ms"
          action: "rollback after 2 minutes"
          threshold: "80% of requests"
        
        - condition: "error rate > 5%"
          action: "immediate rollback"
          threshold: "1 minute"
      
      business_metrics:
        - condition: "conversion rate drop > 10%"
          action: "rollback after 5 minutes"
          threshold: "compared to baseline"
        
        - condition: "user complaints > 10"
          action: "manual review required"
          threshold: "within 10 minutes"

# Deployment Rollback mit kubectl
# 1. Aktuelle Deployment-Historie anzeigen
kubectl rollout history deployment/app-deployment

# 2. Spezifische Revision anzeigen
kubectl rollout history deployment/app-deployment --revision=2

# 3. Rollback zur vorherigen Version
kubectl rollout undo deployment/app-deployment

# 4. Rollback zur spezifischen Revision
kubectl rollout undo deployment/app-deployment --to-revision=2

# 5. Rollback-Status überwachen
kubectl rollout status deployment/app-deployment

# 6. Rollback abbrechen
kubectl rollout pause deployment/app-deployment
kubectl rollout resume deployment/app-deployment

# Helm Rollback Commands
# 1. Release-Historie anzeigen
helm history my-app

# 2. Rollback zur vorherigen Version
helm rollback my-app

# 3. Rollback zur spezifischen Revision
helm rollback my-app 2

# 4. Rollback mit Custom Values
helm rollback my-app 2 --values custom-values.yaml

# 5. Rollback-Status überprüfen
helm status my-app

# GitOps Rollback mit ArgoCD
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: production-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://git.company.local/kubernetes/apps
    targetRevision: HEAD
    path: production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
    retry:
      limit: 3
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

# Automated Health Check Rollback
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-deployment
  annotations:
    rollback.kubernetes.io/health-check: 'true'
    rollback.kubernetes.io/health-check-interval: '30s'
    rollback.kubernetes.io/health-check-threshold: '3'
spec:
  replicas: 3
  selector:
    matchLabels:
      app: app
  template:
    metadata:
      labels:
        app: app
    spec:
      containers:
        - name: app
          image: company/app:latest
          ports:
            - containerPort: 8080
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 30
            periodSeconds: 10
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
            failureThreshold: 3

# Performance Monitoring Rollback
apiVersion: v1
kind: ConfigMap
metadata:
  name: performance-rollback
data:
  rollback.yaml: |
    performance_thresholds:
      response_time:
        warning: 1000ms
        critical: 2000ms
        rollback_threshold: 3000ms
      
      error_rate:
        warning: 1%
        critical: 5%
        rollback_threshold: 10%
      
      cpu_usage:
        warning: 70%
        critical: 85%
        rollback_threshold: 95%
      
      memory_usage:
        warning: 75%
        critical: 90%
        rollback_threshold: 98%

    rollback_actions:
      - metric: "response_time"
        condition: "> 3000ms for 2m"
        action: "immediate_rollback"
      
      - metric: "error_rate"
        condition: "> 10% for 1m"
        action: "immediate_rollback"
      
      - metric: "cpu_usage"
        condition: "> 95% for 5m"
        action: "scale_up_or_rollback"

# Custom Rollback Operator
apiVersion: apps/v1
kind: Deployment
metadata:
  name: rollback-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      app: rollback-operator
  template:
    metadata:
      labels:
        app: rollback-operator
    spec:
      serviceAccountName: rollback-operator
      containers:
        - name: operator
          image: rollback-operator:latest
          env:
            - name: WATCH_NAMESPACE
              value: 'production'
            - name: ROLLBACK_THRESHOLD
              value: '5'
            - name: HEALTH_CHECK_INTERVAL
              value: '30s'
            - name: SLACK_WEBHOOK
              valueFrom:
                secretKeyRef:
                  name: slack-secret
                  key: webhook
          volumeMounts:
            - name: rollback-config
              mountPath: /config
      volumes:
        - name: rollback-config
          configMap:
            name: rollback-config

# Blue-Green Deployment Configuration
apiVersion: v1
kind: Service
metadata:
  name: app-service
  annotations:
    blue-green.kubernetes.io/enabled: 'true'
spec:
  selector:
    app: app-blue # Initially points to blue
  ports:
    - port: 80
      targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-blue
  labels:
    version: blue
spec:
  replicas: 3
  selector:
    matchLabels:
      app: app-blue
  template:
    metadata:
      labels:
        app: app-blue
        version: blue
    spec:
      containers:
        - name: app
          image: company/app:blue
          ports:
            - containerPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-green
  labels:
    version: green
spec:
  replicas: 0 # Initially scaled to 0
  selector:
    matchLabels:
      app: app-green
  template:
    metadata:
      labels:
        app: app-green
        version: green
    spec:
      containers:
        - name: app
          image: company/app:green
          ports:
            - containerPort: 8080

# Traffic Switching Script
apiVersion: batch/v1
kind: Job
metadata:
  name: traffic-switch
spec:
  template:
    spec:
      containers:
        - name: traffic-switch
          image: traffic-switch:latest
          command: ['python', 'switch_traffic.py']
          env:
            - name: BLUE_DEPLOYMENT
              value: 'app-blue'
            - name: GREEN_DEPLOYMENT
              value: 'app-green'
            - name: SERVICE_NAME
              value: 'app-service'
            - name: ROLLBACK_THRESHOLD
              value: '5%'
      restartPolicy: Never
  backoffLimit: 3

# Blue-Green Rollback Script
import kubernetes
from kubernetes import client, config
import time
import requests

def switch_traffic_to_blue():
    """Switch traffic back to blue deployment"""
    v1 = client.CoreV1Api()

    # Update service selector to blue
    service = v1.read_namespaced_service(
        name="app-service",
        namespace="production"
    )

    service.spec.selector = {"app": "app-blue"}
    v1.patch_namespaced_service(
        name="app-service",
        namespace="production",
        body=service
    )

    print("Traffic switched to blue deployment")

def monitor_green_deployment():
    """Monitor green deployment health"""
    while True:
        try:
            response = requests.get("http://app-green-service/health", timeout=5)
            if response.status_code != 200:
                print("Green deployment unhealthy, rolling back to blue")
                switch_traffic_to_blue()
                break
        except Exception as e:
            print(f"Green deployment error: {e}")
            switch_traffic_to_blue()
            break

        time.sleep(30)

if __name__ == "__main__":
    config.load_incluster_config()
    monitor_green_deployment()

# Canary Deployment Configuration
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-canary
  annotations:
    canary.kubernetes.io/enabled: 'true'
    canary.kubernetes.io/traffic-percentage: '10'
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app-canary
  template:
    metadata:
      labels:
        app: app-canary
        version: canary
    spec:
      containers:
        - name: app
          image: company/app:new-version
          ports:
            - containerPort: 8080
          env:
            - name: CANARY_FLAG
              value: 'true'
            - name: CANARY_PERCENTAGE
              value: '10'

# Istio Virtual Service für Canary
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: app-virtual-service
spec:
  hosts:
    - 'app.company.com'
  gateways:
    - app-gateway
  http:
    - route:
        - destination:
            host: app-stable
            port:
              number: 8080
          weight: 90 # 90% traffic to stable
        - destination:
            host: app-canary
            port:
              number: 8080
          weight: 10 # 10% traffic to canary
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: app-destination-rule
spec:
  host: app-stable
  subsets:
    - name: stable
      labels:
        version: stable
    - name: canary
      labels:
        version: canary

# Canary Rollback Controller
apiVersion: apps/v1
kind: Deployment
metadata:
  name: canary-controller
spec:
  replicas: 1
  selector:
    matchLabels:
      app: canary-controller
  template:
    metadata:
      labels:
        app: canary-controller
    spec:
      containers:
        - name: controller
          image: canary-controller:latest
          command: ['python', 'canary_controller.py']
          env:
            - name: CANARY_DEPLOYMENT
              value: 'app-canary'
            - name: STABLE_DEPLOYMENT
              value: 'app-stable'
            - name: ROLLBACK_THRESHOLD
              value: '5%'
            - name: MONITORING_INTERVAL
              value: '30s'
          volumeMounts:
            - name: canary-config
              mountPath: /config
      volumes:
        - name: canary-config
          configMap:
            name: canary-config

# Feature Flag Configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: feature-flags
data:
  flags.yaml: |
    features:
      new_ui:
        enabled: true
        percentage: 50
        rollback_threshold: 10%
      
      new_algorithm:
        enabled: false
        percentage: 0
        rollback_threshold: 5%
      
      beta_features:
        enabled: true
        percentage: 20
        rollback_threshold: 15%

    rollback_triggers:
      - feature: "new_ui"
        metric: "conversion_rate"
        condition: "drop > 10%"
        action: "disable_feature"
      
      - feature: "new_algorithm"
        metric: "error_rate"
        condition: "increase > 5%"
        action: "disable_feature"

# A/B Testing Rollback Service
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ab-testing-service
spec:
  replicas: 2
  selector:
    matchLabels:
      app: ab-testing
  template:
    metadata:
      labels:
        app: ab-testing
    spec:
      containers:
        - name: ab-service
          image: ab-testing:latest
          env:
            - name: EXPERIMENT_DURATION
              value: '24h'
            - name: STATISTICAL_SIGNIFICANCE
              value: '0.05'
            - name: ROLLBACK_THRESHOLD
              value: '0.1'
          volumeMounts:
            - name: ab-config
              mountPath: /config
      volumes:
        - name: ab-config
          configMap:
            name: ab-testing-config

# Disaster Recovery Configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: disaster-recovery
data:
  recovery.yaml: |
    disaster_scenarios:
      - scenario: "Complete cluster failure"
        action: "restore_from_backup"
        rto: "4 hours"
        rpo: "1 hour"
      
      - scenario: "Application failure"
        action: "rollback_to_previous_version"
        rto: "15 minutes"
        rpo: "0 minutes"
      
      - scenario: "Data corruption"
        action: "restore_database"
        rto: "2 hours"
        rpo: "30 minutes"

    backup_strategies:
      - type: "etcd backup"
        frequency: "every 1 hour"
        retention: "30 days"
        location: "s3://backups/etcd"
      
      - type: "application backup"
        frequency: "every 6 hours"
        retention: "90 days"
        location: "s3://backups/apps"
      
      - type: "database backup"
        frequency: "every 1 hour"
        retention: "30 days"
        location: "s3://backups/databases"

# Disaster Recovery Operator
apiVersion: apps/v1
kind: Deployment
metadata:
  name: disaster-recovery-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      app: disaster-recovery
  template:
    metadata:
      labels:
        app: disaster-recovery
    spec:
      containers:
        - name: recovery-operator
          image: disaster-recovery:latest
          command: ['python', 'recovery_operator.py']
          env:
            - name: BACKUP_LOCATION
              value: 's3://backups'
            - name: RESTORE_TIMEOUT
              value: '4h'
            - name: NOTIFICATION_CHANNEL
              value: 'slack'
          volumeMounts:
            - name: recovery-config
              mountPath: /config
      volumes:
        - name: recovery-config
          configMap:
            name: disaster-recovery-config

# Rollback Monitoring Configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: rollback-monitoring
data:
  dashboard.yaml: |
    metrics:
      - name: "Rollback Frequency"
        query: "rollback_count_total"
        alert_threshold: 5
        unit: "per day"
      
      - name: "Rollback Success Rate"
        query: "rollback_success_rate"
        alert_threshold: 95
        unit: "%"
      
      - name: "Rollback Duration"
        query: "rollback_duration_seconds"
        alert_threshold: 300
        unit: "seconds"
      
      - name: "Failed Deployments"
        query: "deployment_failure_count"
        alert_threshold: 3
        unit: "per day"

    alerts:
      - name: "High Rollback Rate"
        condition: "rollback_count > 5 in 1h"
        severity: "warning"
        notification: "slack"
      
      - name: "Rollback Failure"
        condition: "rollback_success_rate < 95%"
        severity: "critical"
        notification: "phone + slack"
      
      - name: "Long Rollback Time"
        condition: "rollback_duration > 5m"
        severity: "warning"
        notification: "slack"

# Rollback Alerting Rules
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: rollback-alerts
  namespace: monitoring
spec:
  groups:
    - name: rollback.rules
      rules:
        - alert: HighRollbackRate
          expr: rate(rollback_count_total[1h]) > 5
          for: 5m
          labels:
            severity: warning
          annotations:
            summary: 'High rollback rate detected'
            description: 'Rollback rate is {{ $value }} per hour'

        - alert: RollbackFailure
          expr: rollback_success_rate < 0.95
          for: 2m
          labels:
            severity: critical
          annotations:
            summary: 'Rollback failure detected'
            description: 'Rollback success rate is {{ $value }}%'

        - alert: LongRollbackTime
          expr: rollback_duration_seconds > 300
          for: 1m
          labels:
            severity: warning
          annotations:
            summary: 'Long rollback time detected'
            description: 'Rollback took {{ $value }} seconds'

# Pre-Deployment Checklist
apiVersion: v1
kind: ConfigMap
metadata:
  name: deployment-checklist
data:
  checklist.yaml: |
    pre_deployment:
      - item: "Backup current deployment"
        required: true
        action: "kubectl get deployment -o yaml > backup.yaml"
      
      - item: "Verify rollback image exists"
        required: true
        action: "docker pull previous-image:tag"
      
      - item: "Test rollback procedure"
        required: true
        action: "dry-run rollback in staging"
      
      - item: "Update documentation"
        required: true
        action: "update deployment docs"
      
      - item: "Notify stakeholders"
        required: false
        action: "send deployment notification"

    post_deployment:
      - item: "Monitor health checks"
        required: true
        duration: "5 minutes"
      
      - item: "Verify performance metrics"
        required: true
        duration: "10 minutes"
      
      - item: "Check business metrics"
        required: false
        duration: "30 minutes"
      
      - item: "Update deployment status"
        required: true
        action: "mark deployment as successful"

# Rollback Testing Strategy
apiVersion: v1
kind: ConfigMap
metadata:
  name: rollback-testing
data:
  testing.yaml: |
    test_scenarios:
      - scenario: "Health check failure"
        test: "Simulate liveness probe failure"
        expected: "Automatic rollback within 2 minutes"
      
      - scenario: "Performance degradation"
        test: "Simulate high response time"
        expected: "Rollback after 5 minutes"
      
      - scenario: "Error rate increase"
        test: "Simulate high error rate"
        expected: "Immediate rollback"
      
      - scenario: "Manual rollback"
        test: "Execute manual rollback"
        expected: "Rollback within 1 minute"

    test_automation:
      tools:
        - "k6 for load testing"
        - "chaos-mesh for failure injection"
        - "prometheus for metrics"
        - "grafana for visualization"