The strongest point here is that zero-downtime is an end-to-end property, not something Kubernetes or the load balancer can guarantee by itself. The frontend/CDN version mismatch is a good example of how every layer can be individually healthy while the release still produces customer-visible failures.
The other useful distinction is treating rollback as a traffic decision rather than another deployment operation. Keeping the previous environment alive makes recovery much less dependent on rebuilding infrastructure under pressure. I’d also keep the warning about retries front and center: retrying a static asset is very different from retrying a state-changing operation such as a transfer, where idempotency and transaction semantics have to come first.
The strongest point here is that zero-downtime is an end-to-end property, not something Kubernetes or the load balancer can guarantee by itself. The frontend/CDN version mismatch is a good example of how every layer can be individually healthy while the release still produces customer-visible failures.
The other useful distinction is treating rollback as a traffic decision rather than another deployment operation. Keeping the previous environment alive makes recovery much less dependent on rebuilding infrastructure under pressure. I’d also keep the warning about retries front and center: retrying a static asset is very different from retrying a state-changing operation such as a transfer, where idempotency and transaction semantics have to come first.