Why a Service Mesh Beats Application Gateway for Pod-Level Canary Control
You are designing a release pipeline for a critical application that requires zero-downtime deployments. The application runs on Azure Kubernetes Service (AKS) with multiple replicas. You are using Azure Pipelines with a canary deployment strategy. What is the best approach to gradually shift traffic to the new version while monitoring for errors?
Quick Answer
A service mesh like Istio is the right tool for gradual, monitored traffic shifting on AKS — it splits traffic at the pod level with fine-grained percentage control. Application Gateway only routes at the ingress layer without that granularity, a plain rolling update replaces pods without splitting traffic at all, and a VIP swap shifts everything at once, which is blue-green, not canary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a service mesh like Istio to route a percentage of traffic to the new version.
Using a service mesh like Istio allows granular traffic splitting between versions, enabling gradual canary deployments with real-time monitoring. Option B is incorrect: Azure Application Gateway can route traffic to backends, but it works at the ingress level and cannot easily shift traffic at the pod level without additional configuration; it's less flexible than a service mesh for canary. Option C is incorrect: AKS rolling update gradually replaces pods but does not split traffic between old and new; all traffic goes to the new version once a pod is updated, making it unsuitable for gradual traffic shift. Option D is incorrect: VIP swap is a blue-green deployment, which switches all traffic at once, not gradually.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a service mesh like Istio to route a percentage of traffic to the new version.
Why this is correct
Istio enables precise traffic routing for canary deployments.
- ✗
Use Azure Application Gateway as an ingress controller with weighted backend pools.
Why it's wrong here
Application Gateway can distribute traffic but is not as fine-grained as a service mesh.
- ✗
Use the AKS rolling update strategy with max surge.
Why it's wrong here
Rolling update replaces pods gradually but does not split traffic between versions.
- ✗
Deploy to a staging environment, then swap VIPs with production.
Why it's wrong here
This is a blue-green deployment, not a gradual canary.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Azure Pipelines
Azure Pipelines is a cloud-based CI/CD service from Microsoft that automatically builds, tests, and deploys code to any platform or cloud.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses GitHub Actions for CI/CD. You need to implement a deployment strategy where a new version of the application is gradually shifted from the stable environment to a canary environment, and if health checks pass, the traffic is fully shifted to the canary. Which GitHub Actions deployment strategy should you use?
hard- A.Recreate deployment
- ✓ B.Canary deployment
- C.Blue-green deployment
- D.Rolling deployment
Why B: A canary deployment gradually shifts traffic from the stable environment to a new canary environment, using health checks to validate the new version before fully routing all traffic to it. This matches the requirement of a gradual shift with health-check gating. GitHub Actions supports this via deployment strategies like `canary` in environments or custom workflows with traffic-splitting tools.
Variation 2. A company uses Azure Pipelines to deploy microservices to Azure Kubernetes Service (AKS). They want to implement a canary deployment strategy. What should they use?
medium- ✓ A.Use Kubernetes native deployment strategies with multiple replica sets and traffic splitting
- B.Use Azure Front Door to route traffic between clusters
- C.Use deployment slots in Azure App Service
- D.Use Azure Container Instances as a staging environment
Why A: Kubernetes natively supports canary deployments by running multiple replica sets of the same application and using a service mesh or ingress controller (e.g., Istio, NGINX Ingress) to split traffic between the stable and canary versions. Azure Pipelines can orchestrate this by updating the canary deployment and adjusting traffic weights gradually, enabling controlled rollouts and rollbacks without external routing services.
Variation 3. Which THREE components are essential for implementing a canary deployment strategy using Azure Kubernetes Service (AKS) and Azure Pipelines? (Choose three.)
medium- A.Azure Traffic Manager for global load balancing.
- ✓ B.A service mesh like Istio or Linkerd for traffic splitting.
- ✓ C.A health check endpoint to validate the canary deployment.
- D.Multiple Kubernetes namespaces to separate canary and stable deployments.
- E.Azure Front Door for routing traffic to the canary.
Why B: Canary deployment in AKS requires a mechanism to split traffic (service mesh), a health check endpoint to validate the canary, and a way to run the canary version alongside the stable version (typically separate deployments, not necessarily separate namespaces). The only two essential options from the list are B and C. The question must be changed to 'Choose two.'
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.