Konrad Kowalski (rootsher)Principal Platform & Reliability Architect000010000010001011001101111100100011001001010111

Targeted Rollout: A/B Tests, Rings, and Segments

date
category
CI/CD
also in
Reliability Engineering
reading
2 min / 310 words

5% of traffic does not always mean the same thing.

It can mean a random sample of requests.

It can mean five percent of users assigned permanently.

It can mean one region, one tenant, or company employees.

Canary usually asks:

text
does the new version break the system?

Targeted rollout asks something else:

text
who sees the change first?

Why it appeared

A traffic percentage is too poor when risk is not evenly distributed.

Internal users may accept a bug faster than customers.

Beta customers may knowingly test new behavior.

One region may have simpler integrations.

One paid plan may use a feature that others do not.

That is where rings and segments come from.

text
ring 0: internal
ring 1: beta
ring 2: selected customers
ring 3: everyone

This is no longer only traffic distribution.

It is exposure policy.

Minimal example

The simplest mechanism is a decision in the application.

js
function variantFor(user) {
  if (user.email.endsWith("@example.com")) return "new";
  if (user.plan === "beta") return "new";
  return "old";
}

Another minimal mechanism is sticky assignment by user_id.

js
function bucket(userId) {
  return hash(userId) % 100;
}

const useNewVersion = bucket(user.id) < 5;

A user should reach the same version on later requests.

Without that, we test random behavior mixing, not a rollout.

At the routing layer, this can use a header:

text
X-Ring: internal

or a cookie:

text
variant=B

The decision can live in the application, gateway, or edge.

A/B test is not canary

An A/B test usually has a product question:

text
which version performs better?

Canary has an operational question:

text
is the new version safe?

The mechanisms can look similar technically.

The goal is different.

A/B tests care about:

text
experiment
cohort
sticky assignment
success metric
result significance

Rollouts care more about:

text
blast radius
rollback
alerts
compatibility
exposure control

Where the name lies

Targeted rollout sounds precise.

The precision depends on where the decision is made.

A gateway sees request, host, path, headers, and cookies.

The application sees user, tenant, plan, and business context.

A feature flag system may see even more, but then you pay the cost of maintaining rules.

If the mechanism has no sticky assignment, a user can get two different worlds in one session.

If the segment is poorly chosen, rollout does not reduce risk, it only gives false confidence.

Targeted rollout is really about controlling who sees a change first.

It does not replace metrics.