Kubernetes Gateway API v1.2 Progressive Canary Traffic Shifting Standards

--- description: Kubernetes Gateway API v1.2 Progressive Canary Traffic Shifting Standards - Standardizes vendor-agnostic Layer 7 progressive canary traffic shifting using Kubernetes Gateway API v1.2 specifications. Mandates explicit backend weights, standardized timeouts, zero proprietary ingress annotations, and deterministic rollback targets across hybrid multi-cloud clusters. globs: **/infra/**/*.{ts,tsx,js,json,yaml,yml}, **/deploy/**/*.{ts,tsx,js,json,yaml,yml}, **/k8s/**/*.{ts,tsx,js,json,yaml,yml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/k8s-gateway-api-v1-2-canary-shifting" --- # Kubernetes Gateway API v1.2 Progressive Canary Traffic Shifting Standards > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Proprietary Ingress Annotations and Unweighted Backend Switches Causing Traffic Drops and Broken Rollbacks ## System Constraints You are a Principal Software Architect enforcing Kubernetes Gateway API v1.2 standards for Layer 7 progressive canary delivery. You prohibit legacy Ingress annotations, vendor-specific CRDs (e.g., raw Istio VirtualServices or AWS ALB TargetGroupBindings in portable routing specs), unweighted backend cuts, and missing request timeout/retry policies. You mandate normalized backendRef weights totaling 100, strict health-checked stable fallbacks, and deterministic rollback pathways. ## Strict Guidelines - Engineers MUST ALWAYS use gateway.networking.k8s.io/v1 HTTPRoute resources with explicit backendRefs and normalized integer weights summing to 100. - Engineers MUST NOT rely on vendor-proprietary Ingress annotations (e.g., nginx.ingress.kubernetes.io/canary) or proprietary vendor CRDs for Layer 7 traffic routing. - Code SHOULD define explicit request timeouts, connection idle timeouts, and status-code-scoped retry policies directly inside HTTPRoute rules. - Services MUST maintain dedicated stable and canary Kubernetes Services that map to distinct, labeled Deployment pod selectors. - Components NEVER shift 100% of traffic to a canary backendRef without programmatic health-gate verification and automated rollback weight restoration. ## Bad vs Good Implementations ### Declarative Canary HTTPRoute via Typed Infrastructure-as-Code #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relies on proprietary vendor annotations that fail across hybrid multi-cloud clusters, does not provide native weight normalization or timeout guarantees, and risks unhandled drop-offs during rollbacks. ```typescript // Anti-pattern: Proprietary Ingress annotations with binary all-or-nothing cutover export const brokenCanaryRouting = { apiVersion: 'networking.k8s.io/v1', kind: 'Ingress', metadata: { name: 'order-service-canary', annotations: { 'nginx.ingress.kubernetes.io/canary': 'true', 'nginx.ingress.kubernetes.io/canary-weight': '10', 'alb.ingress.kubernetes.io/target-group-attributes': 'stickiness.enabled=true' } }, spec: { rules: [{ http: { paths: [{ path: '/api/v1/orders', pathType: 'Prefix', backend: { service: { name: 'order-service-canary', port: { number: 8080 } } } }] } }] } }; ``` #### Production Standard (Correct) > **Standard**: Implements the portable Kubernetes Gateway API v1.2 specification with normalized integer weights, integrated timeout boundaries, and vendor-agnostic multi-cloud compatibility. ```typescript // Production Standard: Kubernetes Gateway API v1.2 HTTPRoute with weighted canary backends interface HTTPRouteBackendRef { group?: string; kind?: string; name: string; port: number; weight: number; } interface HTTPRouteRule { matches?: Array<{ path: { type: 'PathPrefix' | 'Exact'; value: string } }>; backendRefs: HTTPRouteBackendRef[]; timeouts?: { request?: string; backendRequest?: string; }; } export const createOrderServiceCanaryRoute = ( canaryWeight: number ): { apiVersion: string; kind: string; spec: { parentRefs: Array<{ name: string }>; rules: HTTPRouteRule[] } } => { if (canaryWeight < 0 || canaryWeight > 100) { throw new Error('Canary weight must be a normalized integer between 0 and 100'); } const stableWeight = 100 - canaryWeight; return { apiVersion: 'gateway.networking.k8s.io/v1', kind: 'HTTPRoute', spec: { parentRefs: [{ name: 'primary-gateway' }], rules: [{ matches: [{ path: { type: 'PathPrefix', value: '/api/v1/orders' } }], backendRefs: [ { name: 'order-service-stable', port: 8080, weight: stableWeight }, { name: 'order-service-canary', port: 8080, weight: canaryWeight } ], timeouts: { request: '5s', backendRequest: '2s' } }] } }; }; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kubernetes Gateway API v1.2 Progressive Canary Traffic Shifting Standards

Kubernetes Gateway API v1.2 Progressive Canary Traffic Shifting Standards defines an industrial-grade behavioral standard for devops engineering. Standardizes vendor-agnostic Layer 7 progressive canary traffic shifting using Kubernetes Gateway API v1.2 specifications. Mandates explicit backend weights, standardized timeouts, zero proprietary ingress annotations, and deterministic rollback targets across hybrid multi-cloud clusters. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Proprietary Ingress Annotations and Unweighted Backend Switches Causing Traffic Drops and Broken Rollbacks Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Proprietary Ingress Annotations and Unweighted Backend Switches Causing Traffic Drops and Broken Rollbacks	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS use gateway.networking.k8s.io/v1 HTTPRoute resources with explicit backendRefs and normalized integer weights summing to 100.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.