🕵️ SicherheitslückenHak5: Hackers Just Poisoned the Rust Supply Chain | Threat Wire(01.09.2026 um 14:00 Uhr)
🕵️ SicherheitslückenHak5: Hackers Found a Way Into Humanoid Robots | Threat Wire(04.09.2026 um 15:04 Uhr)
🔧 AI Nachrichten Bits und so #1021 (Passwort für Laufwerk)(31.08.2026 um 22:15 Uhr)
🔧 AI Nachrichten Bits und so #1022 (Wie Weißbier)(06.09.2026 um 20:39 Uhr)
🍏 iOS / Mac OSHue-App 6.0 ist da: das sind die Neuerungen(07.09.2026 um 17:21 Uhr)
🕵️ SicherheitslückenHak5: Hackers Just Poisoned the Rust Supply Chain | Threat Wire(01.09.2026 um 14:00 Uhr)
🕵️ SicherheitslückenHak5: Hackers Found a Way Into Humanoid Robots | Threat Wire(04.09.2026 um 15:04 Uhr)
🔧 AI Nachrichten Bits und so #1021 (Passwort für Laufwerk)(31.08.2026 um 22:15 Uhr)
🔧 AI Nachrichten Bits und so #1022 (Wie Weißbier)(06.09.2026 um 20:39 Uhr)
🍏 iOS / Mac OSHue-App 6.0 ist da: das sind die Neuerungen(07.09.2026 um 17:21 Uhr)

🔧 Programmierung 🕛 kürzlich 13 Min Lesezeit
0

From Minikube to AWS EKS: How I Built a Zero-Downtime Blue-Green Deployment Pipeline for ShopSwift

↗ Quelle (dev.to)
🗣️ Stimme:
📑 Inhaltsübersicht

I built ShopSwift, a Node.js/Express e-commerce API, and wrapped it in a production-grade local validation, CI, , and takes a different approach. Two environments run in parallel. One is live. The other is where the new release lands. Traffic switches only after validation. Rollback is a routing change, not a redeployment.



The question I wanted to answer with this project was practical:




Can I build a blue-green pipeline that delivers genuinely zero failed requests through a traffic switch, a rollback, and a simulated broken release - locally and in the cloud?




The answer is yes. But the path had a real failure in it. That failure made the project better.



Repository: and , ,


Local Kubernetes



Container Registry



CI/CD



Manifest Validation
, ,










Architecture: The Final Routing Model



After testing and refinement (including one important failure), the traffic routing model settled into this:




CODE
User request
|
AWS Load Balancer (cloud) or kubectl port-forward (local)
|
NGINX Ingress Controller
|
shopswift-ingress
|
shopswift-active-service
|
selector: environment=blue OR environment=green
|
Blue pods Green pods






The key design principle: NGINX Ingress never changes. The only thing that changes during a switch is the label selector on shopswift-active-service.



This distinction matters - and it came from a real failure. More on that below.









Phase 1: The Application



I started with the Express API and immediately wrote tests using before touching Docker or Kubernetes.




CODE
Test Suites: 1 passed
Tests: 7 passed






This was deliberate. Kubernetes deployment should not begin with an untested application. The health, readiness, and version endpoints needed to be correct before any of the deployment logic could trust them.









Phase 2: Dockerizing ShopSwift



The Docker image was designed to support both Blue and Green from the same codebase using environment variables:




CODE
# Blue container
docker run -e APP_VERSION=v1.0.0 -e APP_ENV=blue shopswift:v1.0.0

# Green container
docker run -e APP_VERSION=v2.0.0 -e APP_ENV=green shopswift:v2.0.0






No separate codebases. No duplicated Dockerfiles. One image, configured at runtime.



I also wrote smoke test scripts to validate all endpoints quickly after each build - a habit that paid dividends throughout the project.






Challenge: npm ci Caught a Lockfile Mismatch



The Docker build failed at:




CODE
RUN npm ci --omit=dev






The cause: package-lock.json was out of sync with package.json.



This is precisely why .



Kubernetes resources deployed:




CODE
Namespace:  ecommerce-bluegreen
Deployment: shopswift-blue
Service: shopswift-blue-service
Ingress: shopswift-ingress









Challenge: WSL + Docker Driver = Unreliable Ingress Access



Running Minikube with the Docker driver inside WSL meant that accessing shopswift.local directly was unreliable - a known networking limitation of this environment. The app and Service were fine; the issue was local DNS and networking.



The solution was to port-forward the NGINX Ingress Controller and pass the correct Host header:




CODE
kubectl port-forward -n ingress-nginx service/ingress-nginx-controller 8080:80 &

curl -H "Host: shopswift.local" http://localhost:8080/version






This still exercised the full NGINX Ingress routing path - just without relying on local DNS resolution. It was the right tradeoff for a local validation environment.









Phase 5: Deploying Green and Switching Traffic



With Blue stable, I deployed Green:




CODE
Deployment: shopswift-green
Service: shopswift-green-service






Before switching traffic, I tested Green internally through its own Service. This is non-negotiable in a proper blue-green workflow - Green pods running does not mean Green is ready to serve users.



Green internal check confirmed:




CODE
{
"app": "ShopSwift",
"version": "v2.0.0",
"environment": "green",
"commit": "minikube-green",
"port": 3000,
"status": "running"
}






Both environments were now running. Time to switch traffic.









The Failure That Made This Project Better



My first switching approach was to patch the Ingress backend directly:




CODE
# Before
backend:
service:
name: shopswift-blue-service

# After patching
backend:
service:
name: shopswift-green-service






Logical. Clean-looking. But during a continuous zero-downtime test:




CODE
FAILED request: status=503
Failed requests: 1 of 26






A single 503 during a traffic switch means the design cannot honestly be called zero-downtime. I did not hide this result. I used it to understand what was happening.



The likely cause: when the Ingress backend is patched, NGINX reloads its configuration. During that reload - even briefly - upstream connections can fail. One request landed in that gap.









The Fix: The Stable Active Service Pattern



Instead of touching the Ingress, I introduced a stable intermediary:




CODE
# shopswift-active-service - this never changes in Ingress
apiVersion: v1
kind: Service
metadata:
name: shopswift-active-service
spec:
selector:
app: shopswift
environment: blue # <-- only this changes during a switch






The Ingress always points to shopswift-active-service. To switch traffic, I only patch the selector:




CODE
# Switch to Green
kubectl patch service shopswift-active-service \
-n ecommerce-bluegreen \
--type='merge' \
-p '{"spec":{"selector":{"app":"shopswift","environment":"green"}}}'

# Roll back to Blue
kubectl patch service shopswift-active-service \
-n ecommerce-bluegreen \
--type='merge' \
-p '{"spec":{"selector":{"app":"shopswift","environment":"blue"}}}'






detected this and never admitted the broken pods to the Service's endpoint pool. The rollout timed out. Traffic never left Blue.



Live /version response during the broken Green simulation:




CODE
{
"app": "ShopSwift",
"version": "v1.0.0",
"environment": "blue",
"commit": "minikube-blue",
"port": 3000,
"status": "running"
}






The live smoke test still passed. Users were never affected.




Readiness probes are not decoration. They are an operational safety control. A pod that fails its readiness probe never receives production traffic - regardless of whether it is running.










Phase 8: GitHub Actions CI Pipeline



The and pin the Trivy binary version to match.



Final CI result:




CODE
ShopSwift CI: PASSED






This phase closed an important gap. The project now had automated validation, not just manual testing.









Phase 9: AWS EKS Cloud Deployment



Local validation proved the architecture. AWS EKS proved it at scale.



Cloud stack:




















Component Service
Kubernetes
Ingress NGINX Ingress Controller via


Cluster configuration:




CODE
Cluster: shopswift-bluegreen-eks
Region: us-east-1
Nodes: 2 x t3.small






Images pushed to ECR:




CODE
677276115158.dkr.ecr.us-east-1.amazonaws.com/shopswift:v1.0.0
677276115158.dkr.ecr.us-east-1.amazonaws.com/shopswift:v2.0.0






AWS Blue baseline confirmed:




CODE
{
"app": "ShopSwift",
"version": "v1.0.0",
"environment": "blue",
"commit": "aws-blue",
"port": 3000,
"status": "running"
}









AWS Blue to Green






CODE
Total requests:  21
Failed requests: 0
AWS zero-downtime switch: PASSED









AWS Green to Blue Rollback






CODE
Total requests:  23
Failed requests: 0
AWS zero-downtime rollback: PASSED






The active Service selector pattern that was proven in Minikube held in AWS without modification. The architecture was portable.









Phase 10: Prometheus and Grafana Monitoring



Deployment is only part of production readiness. Observability is the other part.



I installed - metrics collection and storage


  • - alert routing


  • - node-level metrics

  • Prometheus Operator - automated scrape configuration



  • I also enabled and or for traffic-driven scaling


  • for pod-level traffic isolation


  • (IAM Roles for Service Accounts) to replace node-level IAM


  • Centralized logging with or or



    If you are reviewing this project, the strongest places to start:





    • k8s/active-service.yaml - the stable switching mechanism


    • scripts/zero-downtime-test.sh - the load test that caught the 503


    • k8s/broken-green/ - the readiness probe failure simulation


    • .github/workflows/ci.yml - the full CI pipeline


    • evidence/ - AWS EKS deployment, monitoring, and teardown evidence


    • README.md - complete deployment walkthrough with copy-paste commands






    Built with Node.js, Docker, Kubernetes, GitHub Actions, AWS EKS, Prometheus, and Grafana. Questions or feedback? Drop a comment below.

    Vollständiger Original-Bericht
    Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.
    ↗ Original-Artikel auf dev.to lesen
  • Wie bewertest du diesen Beitrag?
    1 Klick Feedback
    Teilen mit Netzwerk & Team:

    Community-Analysen & Experten-Meinungen 0

    Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog.
    Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf Eigene Analyse verfassen“!
    Community Pulse: Relevanz-Einschätzung
    1 Klick Experten-Votum
    🔴 Akute Relevanz 0%
    🟡 In Evaluierung 0%
    🟢 Keine Auswirkung 0%
    Spannende Innovation 0%
    Verwandte Story-Cluster & Quellen (Vektor-KI)
    Port 8095 Engine
    1 Quelle
    Hackers Just Poisoned the Rust Supply Chain | Threat Wire
    1 Quelle
    Hackers Found a Way Into Humanoid Robots | Threat Wire
    1 Quelle
    Bits und so #1021 (Passwort für Laufwerk)
    Ähnliche Beiträge
    🔍 Verwandte News

    Auch interessante Nachrichten From Minikube to AWS EKS: How I Built a Zero-Downtime Blue-Green Deployment Pipeline for ShopSwift

    Thematisch verwandte Begriffe: From, Minikube, Built, ZeroDowntime · 6 Treffer

    Laden...

    Videos werden geladen ...

    Laden...

    Beiträge werden geladen ...

    Laden...

    Videos werden geladen ...

    Laden...

    Beiträge werden geladen ...

    Laden...

    Videos werden geladen ...

    Laden...

    Beiträge werden geladen ...

    Laden...

    Videos werden geladen ...

    Laden...

    Beiträge werden geladen ...

    Laden...

    Videos werden geladen ...